Night review, merge and fix of Dependabot PRs (hq-jobs jobs dependabot-nodkey, dependabot-fix-nodkey) #146

Activity

1. groupsky commented on Oct 31, 2026

   

   groupsky

   on Oct 31, 2026

   ContributorAuthor

   More actions

   hq-jobs dependabot-nodkey (run r-20261101-000013-da2c)

   #99 bump actions/create-github-app-token from 3.2.0 to 3.3.0

   merge

   • What changed: minor update of a GitHub Action, pinned by commit SHA (the SHA changed with the version comment). Notes: "update permission inputs" and two dependency bumps (undici 6.24.0 to 6.29.0, a group of production deps).
   • Where the repo uses it: one step in .github/workflows/release.yml, with client-id and private-key inputs. Neither input is touched by the release notes.
   • Risk: low. CI is green. The release workflow only runs on a release, and a merge never releases. The change is ci:, so it makes no release.

   #149 bump google.golang.org/grpc from 1.83.1 to 1.83.2

   merge

   • What changed: patch update. The only change is a security fix: the gRPC server now rejects requests with no :authority and no Host header.
   • Where the repo uses it: only as an indirect dependency in go.mod (pulled in by the cloud SDKs of the stores). No Go file in this repo imports it, and nodkey runs no gRPC server. Only go.mod and go.sum change.
   • Risk: very low. CI is green. The fix is in server code that nodkey does not run. The commit type is chore, so it makes no release.

   dependabot-verdicts
   #99 merge
   #149 merge
   
2. groupsky commented on Nov 2, 2026

   

   groupsky

   on Nov 2, 2026

   ContributorAuthor

   More actions

   Session dependabot-nodkey (2026-11-02)

   Asked by Geno on 2026-11-02 from the hq session. It covered every open Dependabot PR, not only the held ones.

   #99 bump actions/create-github-app-token from 3.2.0 to 3.3.0

   merged (2026-11-02). The verdict of 2026-11-01 was merge. I checked it against the diff: the new SHA 64ab729 is the v3.3.0 tag of the action. Dependabot rebased it on main, all checks were green, and I squash merged it.

   #150 bump github.com/go-resty/resty/v2 from 2.13.1 to 2.17.2

   reviewed: safe; not merged yet (wait).

   • What changed: v2.14 to v2.17.2 bring bug fixes, plus new options that stay off unless they are turned on (a cap on the answer size, curl output in debug mode, and others). No default changed for retry, redirect, logging, cookie jar, TLS, proxy or gzip.
   • Where the repo uses it: only internal/store/infisical.go. newClient builds a resty client on nodkey's own http.Client, for the go-sdk calls CallUniversalAuthLogin and CallRetrieveSecretV3.
   • Risk: low. Retry stays off. The redirect block stays in place. Nothing is logged. The 1 MiB cap and the context still work, because both live in nodkey's own RoundTrip. Nothing new starts a goroutine. The go.sum hash matches the module. CI was green. The commit type is chore, so it makes no release.
   • Why it is not merged: after ci(deps): bump actions/create-github-app-token from 3.2.0 to 3.3.0 #99 merged, main wants this branch up to date. I asked @dependabot rebase (15:48 UTC) and then @dependabot recreate (16:16 UTC). By 16:54 UTC Dependabot had started no job for either of them. What unblocks it: Dependabot rebases the PR, and the checks are green again. Then it can merge.
   • A small note: DESIGN.md (around line 142) still says "resty v2.13.1". After the merge, a small docs: change should update it. That needs Geno, because docs: makes a release.

   No fix PRs, no new issues, nothing skipped.
3. groupsky commented on Nov 7, 2026

   

   groupsky

   on Nov 7, 2026

   ContributorAuthor

   More actions

   hq-jobs dependabot-nodkey (run r-20261108-000006-859a)

   #150 bump github.com/go-resty/resty/v2 from 2.13.1 to 2.17.2

   merge

   • What changed: github.com/go-resty/resty/v2 goes from v2.13.1 to v2.17.2. This is a minor update (v2.14 to v2.17). The notes list bug fixes and new options that stay off unless turned on (a cap on the answer size, curl output in debug mode, a custom multipart boundary). I found no breaking change, no removed or renamed option, and no changed default. go.mod changes one line. go.sum also drops some old hashes, which is normal after a new version.
   • Where the repo uses it: only internal/store/infisical.go, in newClient. It builds a resty client on nodkey's own http.Client (resty.NewWithClient) and sets the base URL, a logger that drops every line, retry count 0 and the User-Agent.
   • Risk: low. The calls nodkey uses (NewWithClient, SetBaseURL, SetLogger, SetRetryCount, SetHeader) are unchanged. The redirect block, the size cap and the context handling live in nodkey's own transport, not in resty. CI is green (2 of 2 runs). The commit type is chore, so it makes no release.
   • This is the same result as my review of 2026-11-02. The earlier attempts to merge failed only because the branch was behind main and Dependabot had not rebased it yet.
   • Note: DESIGN.md (around line 142) still says "resty v2.13.1". After the merge, a small docs: change should update it. That makes a release, so it needs Geno's OK.

   dependabot-verdicts
   #150 merge