chore(deps): bump the production group with 7 updates - #112
Closed
dependabot[bot] wants to merge 136 commits into
Closed
chore(deps): bump the production group with 7 updates#112dependabot[bot] wants to merge 136 commits into
dependabot[bot] wants to merge 136 commits into
Conversation
Muster agents can now pull threat-intelligence context from Brolga: given an observable from an alert, `brolga.context.pack` returns what is known about it, with the evidence to cite. Declarative rather than a bespoke client. Brolga is a `product`, the preset is one query template against `POST /api/v1/context`, and it goes through `executeGovernedQuery` — so it inherits the SSRF guard, the byte and rate limits, and the encrypted-at-rest token that every other connector has. Read-only by construction: Brolga has no route that changes stored intelligence, so an agent that can reach it cannot alter what anyone else reads. The capability sits in `readCapabilities` for the same reason — withholding it would mean an analyst can see an alert but not check whether the address in it is already known bad. Two things the schemas encode deliberately: - `disposition` admits `unknown` and `benign` as distinct values. `unknown` means Brolga has not heard of the subject. An agent that collapsed them would close an alert about an address Brolga has simply never seen. - `evidence` and `gaps` are in the output schema. An agent asserting something in a case without evidence has nothing to point at, and `gaps` is how Brolga states what it does not know rather than leaving it to be inferred from an empty array. Subject kinds include the spellings an agent actually holds — `ip`, `hostname`, a bare `sha256` — because Brolga normalises them and echoes the canonical form back. An integration that has to translate vocabulary will translate it wrong. `optionalEnvironmentConnector` restated the product union by hand, so adding a product needed an edit in two places or it failed to typecheck for a reason that did not name the cause. It now derives from `ConnectorConfiguration["product"]`. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Ship CompanyOsShell, Command/Approvals/Missions/Audit/Integrations views, typed API layer, session/missions/audit/command endpoints. Preserve org scoping and ADR 0006 chat boundary.
Drag-drop Operations board, empty Teams/Capabilities without fixtures, Guides section.
Teams and Capabilities were empty-state stubs. Both now read governed, organisation-scoped APIs: the directory (humans, agents, grants) and the agent-harness manifests. No fixture roster or catalogue is introduced. Pack handoff v1 adds governed agent-to-agent delegation: - Explicit route graph in @muster/agents (Parker<->Jessie, Parker<->Alfie, Jessie->Alfie for research). Anything unlisted, self-handoff, and non-pack agents are refused. No free mesh. - pack_handoffs table with composite (actor_id, organisation_id) foreign keys and database-level status/reason checks, so a cross-organisation handoff cannot be persisted. - New agents.handoff capability, granted alongside agents.invoke and backfilled for existing installs by migration 0023. - High-risk handoffs (state-changing capability, or the response reason) create a pack.handoff.high-risk approval and never dispatch until a human decides. - Refused routes persist as blocked rows and surface as Command attention items instead of vanishing into logs. - Worker dispatch attaches the brief to the target run as untrustedHandoffEvidence, never merged into humanRequest. - Slack posts a notice into the originating thread only. - One shared domain serves the web API, the muster_request_agent_handoff MCP tool, and the harness, so there is no weaker second path. Documented in ADR 0008. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Bootstrap rewrites starter-actor capability assignments on every boot, so it clobbered the migration backfill for the local administrator. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…I edge Both were persisted as blocked rows, but pack_handoffs_distinct_agents_check rejects a self-handoff insert, surfacing a raw query error. These are malformed requests, not operational refusals worth reviewing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…tons Settings rendered 14 disabled section buttons that did nothing, plus editable workspace inputs backed by placeholder demo data that discarded every edit. It now reads the real organisation from the session and links to the governed surface that owns each concern. Workspace identity is shown read-only: there is no write API for it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…yout Dispatching work to an agent was only reachable through the API. The Operations board now creates tasks and hands them to an agent. - New task composer: title, detail, assignee (agents grouped separately from people, with live readiness), priority, and optional room. "Create and dispatch" queues the agent run in one step. - Pack brief cards name what Parker, Jessie, and Alfie are each for and offer concrete example asks that prefill the composer, so it is obvious what can be handed to an agent. - Dispatch button in the task drawer, with the blocking reason shown up front — wrong assignee type, agent not ready, or a run already active — rather than failing on submit. - Board cards and the list now show assignee type and run status. Layout sweep: - Shared PageBody container replaces eleven different hand-rolled max-width and padding combinations. - Sidebar is grouped into Operate / Workforce / Govern / Configure, and page eyebrows now use that same vocabulary instead of nineteen one-off labels. - Tests pin both: every feature view routes through PageBody, and every eyebrow stays within the sidebar's group names. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Only hunt and report runs wrote task state back. A task delegated through the ordinary path stayed in_progress with agentRunStatus queued forever, even after the agent run completed. Settlement is guarded on agentRunStatus in (queued, running) so the hunt and report paths that already settled are untouched. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Dispatching a task from the board produced a run id and nothing else: the drawer showed a status word, no result, and no route to the run detail page that already existed at /agent-runs/<id>. RawTask now models the run object the tasks API already returns, and BoardItem carries its structured output, error, cancellation reason, and output hash. A new AgentRunResult component renders the readable text fields first — summary, headline, rationale, impact, title, the same precedence the handoff summariser uses so a run reads the same way everywhere — and keeps arbitrary agent JSON in a collapsed, character-bounded, scrollable block so it can never stretch the drawer. Failed and cancelled runs show their recorded reason instead. The run row settles in the agent gateway, so board status now prefers the run's own status over the task's copy, and useTasks polls like the other governed views. Run output is framed as evidence to judge, never as an instruction to act on. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
A disabled control is a promise the product cannot keep. Every one of these taught an operator that Muster is half-built before they had done anything. - Drop the "New agent" button. There is no agent-creation API, and an empty affordance is worse than no affordance. - Turn the agent detail "Invoke" button into a link to the operations board, where work can genuinely be created, assigned, and dispatched to an agent. The readiness reason survives as the link title, so the signal stays without the dead end. - Render the organisation as plain text when the actor has one membership, keeping the accessible label. The real select now appears only when a second organisation exists, so the switcher is interactive exactly when it works. - The agent directory lists agents, not "human collaborators". Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The directory's `team` value lives on the `users` table and no product surface writes it, so agents can never carry a team and humans only do if a row was edited by hand. In practice every entry returns null, which made the view file the entire organisation under one "Unassigned" heading — a grouping that promised structure the system does not have. Group by team only when at least one entry actually carries one; otherwise fall back to actor type (People / Pack agents / System actors), which is always populated by the server and is the distinction that matters today. Header and footer copy now describe what is on screen, and the summary counts humans and agents per actor type instead of subtracting, so system actors are never reported as humans. No roster is invented and no team-management surface is added — the view still renders exactly what the governed directory returns. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* refactor(web): delete unreachable legacy chat and search UI
ADR 0006 removed chat and room UI from the product surface. The pages at
app/rooms/, app/rooms/admin/, app/rooms/[slug]/ and app/search/ call
redirect("/") unconditionally with no env gate, so their entire component
trees have been unreachable since that change.
Deleted (verified by grep to have no remaining importers):
- components/room-view.tsx (2895 lines) - no importers
- components/room-composer.tsx (983 lines) - imported only by room-view
- components/rooms-browser.tsx (795 lines) - no importers
- components/app-shell.tsx (597 lines) - imported only by the four dead views
- components/room-admin-view.tsx (243 lines) - no importers
- components/search-view.tsx (225 lines) - no importers
- components/command-palette.tsx (169 lines) - imported only by app-shell
- components/operations-chart.tsx (36 lines) - no importers
Pruned 722 lines of lib/demo-data.ts whose only consumers were the deleted
components: demoOrganisation, demoPeople, demoAgents, demoRooms,
demoDirectRooms, roomIdBySlug, demoAlerts, roomTimeline, needsAttention,
activeIncidents, investigationQueue, platformHealth, operationsTrend and
searchResults.
Deliberately kept:
- The four redirect page files. Removing them would turn a working redirect
into a 404 for anyone holding an old /rooms or /search bookmark.
- components/investigation-view.tsx, components/integration-view.tsx and
components/workflows-view.tsx. These are reachable when
MUSTER_DEMO_MODE=true and are a deliberate demo surface, not dead code.
- lib/demo-data.ts exports activeInvestigation, integrationData, workflows,
workflowYaml and the Severity type, still consumed by those demo views,
plus the starterIds/demoIds tables that mirror
packages/database/src/seed-data.ts.
- components/severity.tsx, still imported by investigation-view.tsx.
No behaviour change: typecheck, lint, test and build are clean, and the
/rooms, /rooms/[slug], /rooms/admin and /search routes still build and
still redirect to /.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(web): drop components orphaned by the room-view deletion
room-agent-activity, room-agent-handoffs, and visual-reaction-asset were
imported only by room-view.tsx. agent-handoff-card stays: tasks-view
still uses it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ity (#99) Bootstrap's administrator grant was a hand-maintained array literal that had already drifted from @muster/authz (brolga.context.read was missing), and because bootstrap rewrites capability_assignments on every boot it silently reverts any migration backfill. Starter actor rows now live in seed-data.ts with the administrator grant derived from starterRoleCapabilities.administrator, guarded by a behavioural test that fails on drift and on any undeclared capability in a starter actor. The Missions empty state stated a fact and left the operator stuck. It now names the governed tool (muster_upsert_mission), the capability and scope its caller needs, the operator command that provisions an MCP installation, and links to Guides. No UI create path is introduced; ADR 0005 keeps mission creation on the governed server path. The audit verifier threw a raw error when MUSTER_AUDIT_ORGANISATION_ID was unset. It now accepts --organisation, lists the organisations in the connected database when none is supplied, prints an operator-readable interpretation alongside the JSON report, and separates usage (64) and unreachable-database (69) from a failed chain (1). No audit row is read differently or written; docs/operations/audit-chain-verification.md documents how to run it and how to interpret legacy-compatible-not-strict without ever repairing history. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
#101) Agent detail listed ten tabs but only branched on 'learning' — the other eight all fell through to the Overview panel, so eight distinct-looking links silently showed the same page. Overview already carries the permission, runtime, and tool evidence the readiness payload provides; the rest need APIs that do not exist. Trimmed to Overview and Learning. Add a tab back when it has content of its own. /agent-runs/[id] never rendered error or cancellationReason, so a failed run showed a bare status plus 'No typed result is available yet' — the board drawer said more about a failure than the run's own page did. It also never called its own timeline route. - Timeline route now returns failureCode, error, cancellationReason, structuredOutput, and outputHash. - The page reuses the board's AgentRunResult panel, so a run reads the same way in both places, and renders the execution timeline. - Moved onto CompanyOsShell + PageBody to match the rest of the OS, and polls only while the run is actually in flight. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(web): let operators close expired approvals and retry stuck agent runs Two dead ends where the only escape was the database. Approvals: decide() refused BOTH verdicts once expiresAt passed, and nothing ever moved a row out of pending, so an expired request sat in the inbox forever offering an Approve button that could never succeed. - Approving past the deadline stays blocked. That is what expiry is for. - Rejecting is now allowed: it is strictly de-escalating and it is the only way to close the row with a recorded reason. - expireOverdue() transitions overdue rows to the 'expired' status the enum already had, with an audit event, lazily on inbox read so a workspace self-heals without a scheduler. - Command stops counting overdue rows as pending approvals. - The inbox drops Approve once overdue and offers 'Reject and close', instead of rendering live buttons above 'Approval has expired.' Agent runs: re-dispatching a failed task already worked, but a run wedged at queued/running/awaiting_approval blocked the button permanently and POST /tasks/[id]/cancel was wired nowhere in the portal. - Cancel run appears whenever a run is in flight. - A settled failure now reads 'Retry dispatch' and says what happened. - The blocked message names the way out rather than just refusing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(web): keep expired approvals rejectable after the lazy sweep Self-inflicted by the previous commit and caught in review. expireOverdue() runs on every inbox list, so a row becomes 'expired' the moment anyone opens Approvals. decide() then hit its 'status !== pending' early return and silently answered duplicate:true, and the inbox only treated overdue *pending* rows as closable — so the act of opening the page removed the only way to close the row. Rejection now survives the expired state on both sides. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The scale sat a step below browser defaults — xs 11px, sm 13px, base 15px — and text-xs carried most body copy in the OS (326 uses against 175 of text-sm, 124 of them 12px muted). The product read as small grey print. - Bottom of the scale is now the conventional 12/14/16, so 12px is reserved for genuine metadata rather than being the reading size. - Dark muted foreground lifted off the contrast floor. - Body copy in the primary OS views, and in the shared page header, empty state, and error state, moves up a step. Badges, table cells, and mono identifiers deliberately stay at 12px. Contrast was never the problem; scale was. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The empty task drawer landed after the typography pass, so its instruction was still 12px. Counts, column headers, timestamps, and the output hash stay at 12px deliberately — they are metadata. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…104) Those tabs were removed in #101 because they silently rendered Overview and the data was not exposed. This adds the API layer and brings them back backed entirely by stored state. New GET /api/v1/agents/[id]/profile (agents.read) returns: - Tools: the declared envelope joined with what the agent has actually called, from agent_tool_calls through its own runs. Registry metadata marks each tool read-only or mutating and names its approval action. Tools called but no longer declared are surfaced rather than hidden — a call outside the envelope is exactly what an operator needs to see, as is a declared tool the runtime registry does not implement. - Rooms: allow-listed rooms and real memberships, with Slack exposure per installation. The two disagreeing is shown, not reconciled. - Permissions: declared requirements against actual grants. 'missing' is the governance-critical one — an agent required to hold a capability it does not have fails at run time, and nothing else in the product surfaced that. 'surplus' supports least-privilege review; 'unknown' catches requirements that are not capabilities at all. The panels are strictly read-only. Grants and allow-lists stay server-controlled, and a test asserts the UI has no mutation path. Instructions, Runs, Evaluations, Versions, and Audit remain unbuilt and stay absent rather than falling through to Overview. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…#105) Two ways a work item became permanently stuck. There was no delete or archive path at all — not in the UI, not in the API. 'archivedAt' existed and every list already filtered on it, but nothing could set it, so the only way to clear a task was a manual database update. - PATCH /api/v1/tasks/[id] accepts { archived }, audited as task.archived / task.restored. - Soft delete, never a row delete, so audit events that reference the task keep their target. - Archiving is refused while a run is queued or running: hiding a task whose agent is still burning budget and may still write evidence is worse than leaving it visible. Cancel first. Cancel itself could wedge. It called the gateway and threw on any failure, so a run the gateway had lost — dead worker, expired lease — could never be released, leaving the task undeletable and undispatchable at once. Cancel now force-releases a run only when it provably cannot still be executing: both the lease and the deadline have passed, or the run row is gone. Anything else still refuses with 502 rather than reporting a run cancelled while the gateway may still be running it. A forced release records that the gateway did not confirm, and why. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Address review findings: approvals badge 99+, work-queue filter toggles, drop unused RunActivityPoint label, dedicated myTasks query, deterministic history caps, concurrent panel reads, accessibility nits.
Bumps the production group with 7 updates: | Package | From | To | | --- | --- | --- | | [@openai/codex](https://github.com/openai/codex/tree/HEAD/codex-cli) | `0.145.0` | `0.146.0` | | [@openai/codex-sdk](https://github.com/openai/codex/tree/HEAD/sdk/typescript) | `0.145.0` | `0.146.0` | | [@tiptap/extension-placeholder](https://github.com/ueberdosis/tiptap/tree/HEAD/packages-deprecated/extension-placeholder) | `3.29.0` | `3.29.2` | | [@tiptap/react](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/react) | `3.29.0` | `3.29.2` | | [@tiptap/starter-kit](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/starter-kit) | `3.29.0` | `3.29.2` | | [sharp](https://github.com/lovell/sharp) | `0.35.0` | `0.35.3` | | [bullmq](https://github.com/taskforcesh/bullmq) | `5.81.2` | `5.81.3` | Updates `@openai/codex` from 0.145.0 to 0.146.0 - [Commits](https://github.com/openai/codex/commits/rust-v0.146.0/codex-cli) Updates `@openai/codex-sdk` from 0.145.0 to 0.146.0 - [Commits](https://github.com/openai/codex/commits/rust-v0.146.0/sdk/typescript) Updates `@tiptap/extension-placeholder` from 3.29.0 to 3.29.2 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Changelog](https://github.com/ueberdosis/tiptap/blob/main/packages-deprecated/extension-placeholder/CHANGELOG.md) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.29.2/packages-deprecated/extension-placeholder) Updates `@tiptap/react` from 3.29.0 to 3.29.2 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Changelog](https://github.com/ueberdosis/tiptap/blob/main/packages/react/CHANGELOG.md) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.29.2/packages/react) Updates `@tiptap/starter-kit` from 3.29.0 to 3.29.2 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Changelog](https://github.com/ueberdosis/tiptap/blob/main/packages/starter-kit/CHANGELOG.md) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.29.2/packages/starter-kit) Updates `sharp` from 0.35.0 to 0.35.3 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.35.0...v0.35.3) Updates `bullmq` from 5.81.2 to 5.81.3 - [Release notes](https://github.com/taskforcesh/bullmq/releases) - [Commits](taskforcesh/bullmq@v5.81.2...v5.81.3) --- updated-dependencies: - dependency-name: "@openai/codex" dependency-version: 0.146.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: "@openai/codex-sdk" dependency-version: 0.146.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: "@tiptap/extension-placeholder" dependency-version: 3.29.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: "@tiptap/react" dependency-version: 3.29.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: "@tiptap/starter-kit" dependency-version: 3.29.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: sharp dependency-version: 0.35.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: bullmq dependency-version: 5.81.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Author
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/production-4fb907711d
branch
August 3, 2026 07:48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the production group with 7 updates:
0.145.00.146.00.145.00.146.03.29.03.29.23.29.03.29.23.29.03.29.20.35.00.35.35.81.25.81.3Updates
@openai/codexfrom 0.145.0 to 0.146.0Commits
Updates
@openai/codex-sdkfrom 0.145.0 to 0.146.0Commits
Updates
@tiptap/extension-placeholderfrom 3.29.0 to 3.29.2Release notes
Sourced from @tiptap/extension-placeholder's releases.
Changelog
Sourced from @tiptap/extension-placeholder's changelog.
Commits
5158212chore(release): release new stable release (#8132)896564achore(release): release new stable release (#8128)Updates
@tiptap/reactfrom 3.29.0 to 3.29.2Release notes
Sourced from @tiptap/react's releases.
Changelog
Sourced from @tiptap/react's changelog.
Commits
5158212chore(release): release new stable release (#8132)e914605fix(react): capture and restore DOM selection when moving contentDOM in React...896564achore(release): release new stable release (#8128)6d901e7fix(react): fixes caret placement after split blocks in React NodeViews. (#8127)Updates
@tiptap/starter-kitfrom 3.29.0 to 3.29.2Release notes
Sourced from @tiptap/starter-kit's releases.
Changelog
Sourced from @tiptap/starter-kit's changelog.
... (truncated)
Commits
5158212chore(release): release new stable release (#8132)896564achore(release): release new stable release (#8128)Updates
sharpfrom 0.35.0 to 0.35.3Release notes
Sourced from sharp's releases.
... (truncated)
Commits
1018449Release v0.35.3ba303a7Prerelease v0.35.3-rc.24f94fc5Upgrade to sharp-libvips v1.3.2c5e7a3fBump devDeps, fix Deno/Windows smoke tests9a8d002Docs: Add changelog entry and note about transferable #45208694db0TypeScript: Return more preciseBuffer\<ArrayBuffer>fromtoBuffer(#4520)e000d0bPrerelease v0.35.3-rc.19554ca9Prerelease v0.35.3-rc.06a29fd5Emit warning about native binaries on Linux Electron540d2eaIncrease default concurrency when use of MALLOC_ARENA_MAX detectedUpdates
bullmqfrom 5.81.2 to 5.81.3Release notes
Sourced from bullmq's releases.
Commits
d2831aeci: align release workflow Node version with semantic-release engine requirem...93649b8fix(worker): recover blocking client after sentinel disconnect, fixes… (#4384)820e261ci: refresh OSV-scanned lockfile resolutions (python)(elixir)(php) (#4388)6fccb59fix(deps): update dependency msgpackr to v2.0.5 [security] (#4387)8208aefchore(deps): pin vite and esbuild to patched versions via resolutions (#4386)54127bachore(deps): update rust dependency redis to 1.4 [rust] (#4377)de28f3fchore(deps): update dependency minimatch to v10.2.6 [security] (#4382)d44ae5aci: group renovate security patches into one daily PR (#4375)63675bcdocs: update Rust cargo add instructions to rename bullmq-official (#4376) re...e558424chore(deps): update dependency@semantic-release/gitto v11 [security] (#4367)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions