Comparing changes

This PR updates the README to replace jdx/mise-action@v2 by jdx/mise-action@v3 in examples.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github/codeql-action](https://redirect.github.com/github/codeql-action) | action | digest | `64d10c1` -> `a8d1ac4` | --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on friday" in timezone America/Chicago, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/jdx/mise-action).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github/codeql-action](https://redirect.github.com/github/codeql-action) | action | digest | `a8d1ac4` -> `755f449` | --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on friday" in timezone America/Chicago, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/jdx/mise-action).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github/codeql-action](https://redirect.github.com/github/codeql-action) | action | digest | `755f449` -> `4221315` | --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on friday" in timezone America/Chicago, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/jdx/mise-action).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github/codeql-action](https://redirect.github.com/github/codeql-action) | action | digest | `4221315` -> `5d5cd55` | --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on friday" in timezone America/Chicago, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/jdx/mise-action).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

## Summary Fixes the artifact update problem in Renovate PRs (like #294) by replacing non-functional `postUpgradeTasks` configuration with a GitHub Actions workflow. ## Problem The previous configuration used `postUpgradeTasks` and `allowedCommands` in `.github/renovate.json`, which only work with self-hosted Renovate. Since this repo uses GitHub's hosted Renovate app, those settings were being ignored, causing the `dist/` folder to not be updated automatically. ## Solution Created a new GitHub Actions workflow (`.github/workflows/renovate-dist-update.yml`) that: - Automatically triggers when Renovate opens a PR that modifies `package.json`, `package-lock.json`, or `src/` - Only runs for Renovate bot PRs - Runs `npm run all` to rebuild the distribution - Commits and pushes the updated `dist/` folder back to the PR branch Also cleaned up `.github/renovate.json` by removing the non-functional configuration. ## Testing The workflow will automatically run on the next Renovate PR update. You can test it immediately by: 1. Closing and reopening PR #294, or 2. Waiting for the next Renovate update cycle 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > Replace Renovate post-upgrade tasks with a GitHub Actions workflow that rebuilds and commits `dist/` on Renovate PRs. > > - **CI / GitHub Actions**: > - Add `/.github/workflows/renovate-dist-update.yml` to auto-rebuild `dist/` on Renovate PRs. > - Triggers on changes to `package.json`, `package-lock.json`, `src/**`, `tsconfig.json`. > - Runs only for `renovate[bot]`/`renovate-bot`; executes `npm ci` and `npm run all`; commits updated `dist/` if changed. > - **Renovate Config**: > - Simplify `/.github/renovate.json` by removing `postUpgradeTasks` and `allowedCommands`, keeping only `extends`. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 6315814. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>  Co-authored-by: Claude <[email protected]>

This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [@types/handlebars](https://redirect.github.com/wycats/handlebars.js) | [`4.0.40` -> `4.1.0`](https://renovatebot.com/diffs/npm/@types%2fhandlebars/4.0.40/4.1.0) | [![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fhandlebars/4.1.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fhandlebars/4.0.40/4.1.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>wycats/handlebars.js (@types/handlebars)</summary> ### [`v4.1.0`](https://redirect.github.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v410---February-7th-2019) New Features - import TypeScript typings - [`27ac1ee`](https://redirect.github.com/wycats/handlebars.js/commit/27ac1ee) Security fixes: - disallow access to the constructor in templates to prevent RCE - [`42841c4`](https://redirect.github.com/wycats/handlebars.js/commit/42841c4), [#1495](https://redirect.github.com/wycats/handlebars.js/issues/1495) Housekeeping - chore: fix components/handlebars package.json and auto-update on release - [`bacd473`](https://redirect.github.com/wycats/handlebars.js/commit/bacd473) - chore: Use node 10 to build handlebars - [`78dd89c`](https://redirect.github.com/wycats/handlebars.js/commit/78dd89c) - chore/doc: Add more release docs - [`6b87c21`](https://redirect.github.com/wycats/handlebars.js/commit/6b87c21) Compatibility notes: Access to class constructors (i.e. `({}).constructor`) is now prohibited to prevent Remote Code Execution. This means that following construct will no work anymore: ``` class SomeClass { } SomeClass.staticProperty = 'static' var template = Handlebars.compile('{{constructor.staticProperty}}'); document.getElementById('output').innerHTML = template(new SomeClass()); // expected: 'static', but now this is empty. ``` This kind of access is not the intended use of Handlebars and leads to the vulnerability described in [#1495](https://redirect.github.com/wycats/handlebars.js/issues/1495). We will **not** increase the major version, because such use is not intended or documented, and because of the potential impact of the issue (we fear that most people won't use a new major version and the issue may not be resolved on many systems). [Commits](https://redirect.github.com/handlebars-lang/handlebars.js/compare/v4.0.12...v4.1.0) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on friday" in timezone America/Chicago, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled because a matching PR was automerged previously. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/jdx/mise-action).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Updates all GitHub Actions workflows from Node 18/20 to Node 24, matching the version specified in mise.toml and @types/node in package.json. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

Adds gitIgnoredAuthors to allow Renovate to auto-rebase PRs even after the renovate-dist-update workflow adds commits. Without this, Renovate refuses to auto-rebase because it sees commits from an unrecognized author. Also sets rebaseWhen to "conflicted" to prevent infinite rebase loops that can occur when gitIgnoredAuthors is combined with auto-rebasing. This fixes the warning on PRs like #301 where Renovate says it "does not recognize the last commit author". 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

Switches from manual commit workflow to autofix.ci for automatically updating the dist/ folder when source files change. This has several advantages: 1. Works on ALL PRs, not just Renovate PRs 2. Commits made by autofix.ci (GitHub App) trigger CI workflows, unlike commits made with GITHUB_TOKEN which don't trigger workflows 3. Renovate recognizes autofix.ci commits via gitIgnoredAuthors and can still auto-rebase PRs Changes: - Renamed workflow from renovate-dist-update to auto-update-dist - Removed Renovate-only condition - now runs on all PRs - Replaced manual git commit/push with autofix.ci action - Updated renovate.json to ignore autofix.ci commits - Changed permissions from write to read-only Note: Requires installing the autofix.ci GitHub App: https://github.com/apps/autofix-ci 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

Removes path filters so the workflow runs on every PR, ensuring dist/ is always up to date regardless of which files changed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

## Summary Switches from our custom GitHub Actions workflow to [autofix.ci](https://autofix.ci/) for automatically updating the `dist/` folder. This solves the CI triggering issue and works on all PRs, not just Renovate PRs. ## Problem Solved The previous workflow had a critical issue: commits made with `GITHUB_TOKEN` don't trigger other CI workflows (by design to prevent infinite loops). This meant that after the dist/ folder was updated, CI wouldn't run to verify the changes. ## Solution: autofix.ci autofix.ci uses a GitHub App token to make commits, which **does** trigger CI workflows. This ensures that: - ✅ CI tests run after dist/ is updated - ✅ Works on ALL PRs, not just Renovate - ✅ Renovate still recognizes and can rebase PRs (via `gitIgnoredAuthors`) ## Changes - **Renamed workflow**: `renovate-dist-update.yml` → `autofix.yml` - **Removed filters**: Now runs on all PRs (not just when specific files change) - **Removed Renovate check**: Works for all PR authors, not just renovate[bot] - **Switched to autofix.ci**: Replaced manual commit logic with autofix.ci action - **Updated permissions**: Changed from `write` to `read` (autofix.ci handles commits) - **Updated renovate.json**: Added `autofix.ci[bot]` to `gitIgnoredAuthors` ## Setup Required This PR requires installing the autofix.ci GitHub App: 👉 https://github.com/apps/autofix-ci ## Testing Once the app is installed, this workflow will automatically: 1. Run on every PR 2. Execute `npm run all` to rebuild dist/ 3. Let autofix.ci commit any changes 4. Trigger CI workflows to verify the changes 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > Replaces the Renovate-only dist update workflow with an autofix.ci-based workflow that runs on all PRs and main pushes, and updates Renovate to ignore autofix.ci commits. > > - **CI**: > - Add `/.github/workflows/autofix.yml` to build (`npm run all`) and let `autofix.ci` commit fixes on PRs and `main` pushes. > - Remove `/.github/workflows/renovate-dist-update.yml` and its manual commit/push logic. > - **Renovate**: > - Update `/.github/renovate.json` to set `gitIgnoredAuthors` to `autofix.ci[bot] <autofix.ci[bot]@users.noreply.github.com>`. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 520b55f. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>  --------- Co-authored-by: Claude <[email protected]>

This PR contains the following updates: | Update | Change | |---|---| | lockFileMaintenance | All locks refreshed | 🔧 This Pull Request updates lock files to use the latest dependency versions. --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on monday" in timezone America/Chicago, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/jdx/mise-action).  --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

@jdx

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Comparing changes

Open a pull request

Commits on Oct 8, 2025

Commits on Oct 10, 2025

Commits on Oct 17, 2025

Commits on Oct 24, 2025

Commits on Oct 31, 2025

This comparison is taking too long to generate.

Uh oh!