You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.
Breaking changes:
require('@​actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@​actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@​actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.
What's Changed
Add ACTIONS_ORCHESTRATION_ID to user-agent string by @Copilot in #695
ci: use deployment: false for integration test environments by @salmanmkc in #712
Enhance caching in setup-node with automatic package manager detection by @priya-kinthali in #1348
This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless.
To disable this automatic caching, set package-manager-cache: false
Add skills/ folder with focused agent skills: skills/dotenv/SKILL.md (core usage) and skills/dotenvx/SKILL.md (encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)
Changed
Tighten up logs: ◇ injecting env (14) from .env (#1003)
Add a new README section on dotenv’s approach to the agentic future.
Changed
Rewrite README to get humans started more quickly with less noise while simultaneously making more accessible for llms and agents to go deeper into details.
🙏 A big thank you to new sponsor Tuple.app - the premier screen sharing app for developers on macOS and Windows. Go check them out. It's wonderful and generous of them to give back to open source by sponsoring dotenv. Give them some love back.
Add additional security and configuration tips to the runtime log (#884)
Dim the tips text from the main injection information text
constTIPS=['🔐 encrypt with dotenvx: https://dotenvx.com','🔐 prevent committing .env to code: https://dotenvx.com/precommit','🔐 prevent building .env in docker: https://dotenvx.com/prebuild','🛠️ run anywhere with `dotenvx run -- yourcommand`','⚙️ specify custom .env file path with { path: \'/custom/path/.env\' }','⚙️ enable debug logging with { debug: true }','⚙️ override existing env vars with { override: true }','⚙️ suppress all logs with { quiet: true }','⚙️ write to custom object with { processEnv: myObject }','⚙️ load multiple .env files with { path: [\'.env.local\', \'.env\'] }']
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/powershell-utils@0.1.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^6.0.3→^8.0.0^22.18.7→^24.0.0^22.19.17→^24.0.0^18.3.24→^19.0.0v4→v7v7→v9v4→v6^7.0.1→^8.0.0^16.6.1→^17.0.0^11.1.0→^13.0.0^16.5.0→^17.0.0^0.577.0→^1.0.022.22.2→24.17.0^10.2.0→^11.0.0^6.2.0→^7.0.010.33.0→11.8.0v4→v6^18.3.1→^19.0.0^9.11.1→^10.0.0^18.3.1→^19.0.0^5.9.3→^6.0.0^5.0.0→^5.0.0 || ^6.0.0Release Notes
actions/checkout (actions/checkout)
v7.0.0Compare Source
v7Compare Source
v6.0.3Compare Source
v6.0.2Compare Source
v6.0.1Compare Source
v6.0.0Compare Source
v6Compare Source
v5.0.1Compare Source
v5.0.0Compare Source
v5Compare Source
actions/github-script (actions/github-script)
v9.0.0Compare Source
New features:
getOctokitfactory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients withgetOctokitfor details and examples.ACTIONS_ORCHESTRATION_IDenvironment variable is automatically appended to the user-agent string for request tracing.Breaking changes:
require('@​actions/github')no longer works in scripts. The upgrade to@actions/githubv9 (ESM-only) meansrequire('@​actions/github')will fail at runtime. If you previously used patterns likeconst { getOctokit } = require('@​actions/github')to create secondary clients, use the new injectedgetOctokitfunction instead — it's available directly in the script context with no imports needed.getOctokitis now an injected function parameter. Scripts that declareconst getOctokit = ...orlet getOctokit = ...will get aSyntaxErrorbecause JavaScript does not allowconst/letredeclaration of function parameters. Use the injectedgetOctokitdirectly, or usevar getOctokit = ...if you need to redeclare it.@actions/githubinternals beyond the standardgithub/octokitclient, you may need to update those references for v9 compatibility.What's Changed
New Contributors
Full Changelog: actions/github-script@v8.0.0...v9.0.0
v9Compare Source
v8.0.0Compare Source
v8: .0.0Compare Source
What's Changed
v2.327.1
Release Notes
Make sure your runner is updated to this version or newer to use this release.
New Contributors
Full Changelog: actions/github-script@v7.1.0...v8.0.0
actions/setup-node (actions/setup-node)
v6.4.0Compare Source
What's Changed
Dependency updates:
New Contributors
Full Changelog: actions/setup-node@v6...v6.4.0
v6.3.0Compare Source
What's Changed
Enhancements:
devEnginesfield by @susnux in #1283Dependency updates:
Bug fixes:
New Contributors
Full Changelog: actions/setup-node@v6...v6.3.0
v6.2.0Compare Source
What's Changed
Documentation
Dependency updates:
New Contributors
Full Changelog: actions/setup-node@v6...v6.2.0
v6.1.0Compare Source
What's Changed
Enhancement:
Dependency updates:
Documentation update:
Full Changelog: actions/setup-node@v6...v6.1.0
v6.0.0Compare Source
What's Changed
Breaking Changes
Dependency Upgrades
Full Changelog: actions/setup-node@v5...v6.0.0
v6Compare Source
v5.0.0Compare Source
What's Changed
Breaking Changes
This update, introduces automatic caching when a valid
packageManagerfield is present in yourpackage.json. This aims to improve workflow performance and make dependency management more seamless.To disable this automatic caching, set
package-manager-cache: falseMake sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes
Dependency Upgrades
New Contributors
Full Changelog: actions/setup-node@v4...v5.0.0
v5Compare Source
archiverjs/node-archiver (archiver)
v8.0.0Compare Source
What’s changed
Breaking changes
Maintenance
Documentation
Dependency updates
motdotla/dotenv (dotenv)
v17.4.2Compare Source
Changed
v17.4.1Compare Source
Changed
injectingtoinjected(#1005)v17.4.0Compare Source
Added
skills/folder with focused agent skills:skills/dotenv/SKILL.md(core usage) andskills/dotenvx/SKILL.md(encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)Changed
◇ injecting env (14) from .env(#1003)v17.3.1Compare Source
Changed
v17.3.0Compare Source
Added
Changed
v17.2.4Compare Source
Changed
DotenvPopulateInputacceptNodeJS.ProcessEnvtype (#915)v17.2.3Compare Source
Changed
v17.2.2Compare Source
Added
v17.2.1Compare Source
Changed
v17.2.0Compare Source
Added
DOTENV_CONFIG_QUIET=truein your environment or.envfile to quiet the runtime log (#889)DOTENV_CONFIG_environment variables take precedence over any code set options like({quiet: false})v17.1.0Compare Source
Added
v17.0.1Compare Source
Changed
v17.0.0Compare Source
Changed
quietto false - informational (file and keys count) runtime log message shows by default (#875)isaacs/node-glob (glob)
v13.0.6Compare Source
v13.0.5Compare Source
v13.0.4Compare Source
v13.0.3Compare Source
v13.0.2Compare Source
v13.0.1Compare Source
v13.0.0Compare Source
v12.0.0Compare Source
sindresorhus/globals (globals)
v17.7.0Compare Source
v17.6.0Compare Source
00a4dd9v17.5.0Compare Source
5d84602v17.4.0Compare Source
d43a051v17.3.0Compare Source
295fba9v17.2.0Compare Source
jasmine: AddthrowUnlessandthrowUnlessAsyncglobals (#335)97f23a7v17.1.0Compare Source
webpackandrspackglobals (#333)65cae73v17.0.0Compare Source
Breaking
audioWorkletenvironment frombrowser(#320)7bc293eImprovements
ebe1063chromeandfirefox(#321)59ceff8bunBuiltinenvironment (#324)1bc6e3bdenoBuiltinenvironment (#324)1bc6e3bpaintWorkletenvironment (#323)4b78f56sharedWorkerenvironment (#322)4a02a85lucide-icons/lucide (lucide-react)
v1.21.0: Version 1.21.0Compare Source
What's Changed
versionscripts in package scripts by @ericfennis in #4479broken-boneicon by @Patolord in #4131New Contributors
Full Changelog: lucide-icons/lucide@1.20.0...1.21.0
v1.20.0: Version 1.20.0Compare Source
What's Changed
square-arrow-*icons by @jguddas in #3926search-icons by @jamiemlaw in #4099save-checkicon by @Konixy inConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.