service · inferred from evidence
Dependabot
A service that automatically creates pull requests for dependency updates.
- Outdated broadcast-channel dependency introduces vulnerable @babel/runtime transient dependency
A practical guide for Okta. The vulnerable @babel/runtime 7.22.10 comes in transitively via the broadcast-channel dependency. Override it in package.json: `"overrides": { "@babel/runtime": "^7.26.10" }`, then reinstall so package-lock.json
- Dependabot updates are failing due to missing .NET SDK
Dependabot nuget/dotnet updates failing with .NET SDK installation errors: fixed Dependabot-side via #9228 and #9374, and confirmed working by multiple reporters. No action needed on your repo; re-run the failed update.
- v5 token-required error on Dependabot PRs: add token to Dependabot secrets
A practical guide for Codecov. [thomasrockhu-codecov (commenter)]: If codecov-action v5 fails on Dependabot PRs with "token required because branch is protected" even though the token is in your repo secrets, add CODECOV_TOKEN to your Depen
- Custom nuget-feed no longer used, breaking package updates
Teaches how to custom nuget-feed no longer used, breaking package updates. Based on a real issue report and its verified fix.
- Dependabot triggered GitHub Actions cannot access secrets or use a writable token
This is intended GitHub behavior, documented in the official guide "Automating Dependabot with GitHub Actions". Use the pull_request_target event instead of pull_request for workflows that need secrets or a writable token, pull_request_targ