build(deps): bump Songmu/tagpr from 1.20.0 to 1.20.1 - #339
Conversation
Bumps [Songmu/tagpr](https://github.com/songmu/tagpr) from 1.20.0 to 1.20.1. - [Release notes](https://github.com/songmu/tagpr/releases) - [Changelog](https://github.com/Songmu/tagpr/blob/main/CHANGELOG.md) - [Commits](Songmu/tagpr@e84001b...d1b8138) --- updated-dependencies: - dependency-name: Songmu/tagpr dependency-version: 1.20.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
masutaka
left a comment
masutaka
left a comment
There was a problem hiding this comment.
Overview
- Package: Songmu/tagpr 1.20.0 → 1.20.1
- Dependency type: Development dependency (GitHub Actions; used only by
.github/workflows/release.ymlfor release automation) - Version change: Patch
Key Findings
- Breaking changes: None. The only code change is a fix to preserve CalVer zero-padding (Songmu/tagpr#363). The signature of
retrieveVersionFromFile()changed fromvPrefix booltoref *semvso that CalVer information is inherited. This repository runs on SemVer (vPrefix = true/versionFile = lib/version.goin.tagpr), soasCalendarVersionstays false and the behavior is unchanged. - Security: None. There are zero open Dependabot alerts, and no alert maps to this PR. This is an ordinary version-bump PR, not a security update.
- Supported versions: Unchanged. No changes to the Go version requirement or the action's
runsconfiguration. - CI status: Pass (actionlint, CodeQL (actions), dependency_review, and test all succeeded; the CodeQL parent job and pushover were skipped).
- Cascading updates: None. The diff is a single line. The upstream v1.20.0...v1.20.1 range does include Dependabot updates to GitHub Actions (setup-go 6.5.0, checkout 7.0.0, codecov-action 7.0.0, and others), but those belong to tagpr's own CI and do not affect this repository.
Impact
A single line in .github/workflows/release.yml. The SHA pin is preserved, updating e84001b # v1.20.0 → d1b8138 # v1.20.1. The compare API confirms this SHA matches the HEAD commit of the upstream v1.20.1 tag (Merge pull request #367 from Songmu/tagpr-from-v1.20.0). There is no impact on application code.
The upstream compare (15 commits) was also reviewed and nothing looked suspicious. Actual code changes are confined to versionfile.go, tag.go, tagpr.go, calver_test.go, and versionfile_test.go, with no suspicious URLs, obfuscated strings, or added scripts. All authors are known contributors or Dependabot.
Conclusion
No issues.
This is a patch release with neither breaking changes nor security concerns. The sole code fix targets CalVer workflows and is effectively a no-op for this SemVer-based repository. The SHA pin was updated correctly and CI passes, so this is safe to merge.
1 participant
Bumps Songmu/tagpr from 1.20.0 to 1.20.1.
Release notes
Sourced from Songmu/tagpr's releases.
Changelog
Sourced from Songmu/tagpr's changelog.
... (truncated)
Commits
d1b8138Merge pull request #367 from Songmu/tagpr-from-v1.20.074ee5a6[tagpr] update CHANGELOG.mdc1ca8de[tagpr] prepare for the next releaseb213e4aMerge pull request #365 from Songmu/dependabot/github_actions/actions/checkou...4eb25b8Merge pull request #364 from Songmu/dependabot/github_actions/reviewdog/actio...393784cMerge pull request #362 from Songmu/dependabot/github_actions/codecov/codecov...cf5e2e6Merge pull request #360 from Songmu/dependabot/github_actions/Songmu/tagpr-1....22caad2Merge pull request #366 from Songmu/dependabot/github_actions/actions/setup-g...9766629Merge pull request #363 from usadamasa/fix/calver-zero-padding-345e338183build(deps): bump actions/setup-go from 6.4.0 to 6.5.0Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)