Repository navigation
Conversation
…angelog contributor-list accuracy
…w recognized) (#314)
cldmv-bot
Bot
added
! release → master
🔒 Dependency Review
|
Contributor
Author
📦 Bundle size unchanged
📊 Generated by |
docs/ isn't in package.json's files allowlist (only README.md, REFERENCE.md, and a few others ship), so every relative ./docs/*.md link in README.md 404s for anyone reading it from an installed package - npm's site, an editor previewing node_modules, etc. Rewritten all 54 as absolute https://github.com/CLDMV/slothlet/blob|tree/master/docs/... URLs (tree for the one folder-only link, blob for every .md file, anchors preserved), so they resolve the same everywhere regardless of what's actually present on disk.
cldmv-bot
Bot
added
the
type: documentation
Harden GitHub Actions token permissions for OpenSSF Scorecard's
Token-Permissions check without changing what any workflow can do:
- Add a read-only top-level default (`permissions: { contents: read }`) to
the caller workflows that declared none. Their jobs already grant their own
scopes, so behavior is unchanged.
- For workflows that declared a dangerous WRITE scope at the top level
(contents/statuses/security-events), narrow the top level to `contents: read`
and move the full original scope set onto the single reusable-calling job, so
the write is granted job-scoped instead of workflow-wide. Affected: branch-
retention, ci, cla, codeql, dependabot-auto-merge, docs, tag-health,
v4-bootstrap.
Non-dangerous top-level grants (pull-requests/issues write, which Scorecard
does not penalize) are left as-is. scorecard.yml keeps writes job-scoped as its
header documents; the header is reworded to match the new read-only default.
These are caller-side permissions, which live in each repo's own workflow files
(a reusable workflow can't set its caller's permissions), so this is a per-repo
change; the CLDMV/.github templates should get the same treatment for future
syncs.
Align the two remaining 2-space workflow files with the fleet's deliberate 4-space YAML convention. Pure reindentation — verified semantically identical (yaml.safe_load before == after); no block scalars, so no embedded-script risk.
Clears the two high-severity advisories flagged by npm audit / OpenSSF Scorecard Vulnerabilities (GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895 in brace-expansion via eslint; GHSA-2v37-7h3g-55p8 in nanoid via vitest). Both are dev-only transitive deps bumped within existing ranges via npm audit fix; the published package has zero runtime dependencies. npm audit now reports 0 vulnerabilities. Lockfile-only — neither package is a direct dependency.
The reusable workflow-feature-pr.yml already maps deps/* -> next (type: deps), and branch-naming.md lists deps/* as an allowed prefix, but this caller's push-trigger branch list omitted deps/**, so deps/* branches never auto-opened a PR. Add deps/** (and the mapping comment) to match the reusable and the convention.
Release-prep docs for v3.15.1 — a maintenance / supply-chain-hardening release with no runtime code changes (API identical to 3.15.0): least-privilege workflow token permissions (#319), dev-toolchain security bumps (brace-expansion, nanoid — dev-only transitive; #322), an OpenSSF Scorecard badge (#320), and doc-link + CI fixes (#316, #321, #314). Adds docs/changelog/v3/v3.15.1.md and promotes v3.15.1 to the README What's New Latest block, demoting v3.15.0 into Recent Releases (kept at the 4-entry cap; v3.13.1 drops off).
Shinrai
previously approved these changes
Sep 1, 2026
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 26.2.0 to 26.4.0. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.4.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [eslint](https://github.com/eslint/eslint) from 10.9.0 to 10.9.1. - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.9.0...v10.9.1) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.9.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 26.2.0 to 26.4.0. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>
Bumps [eslint](https://github.com/eslint/eslint) from 10.9.0 to 10.9.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/eslint/eslint/releases">eslint's releases</a>.</em></p> <blockquote> <h2>v10.9.1</h2> <h2>Bug Fixes</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/1e641c919fc1421493bf913feb607896982451a3"><code>1e641c9</code></a> fix: no-loss-of-precision false positive with trailing decimal point (<a href="https://redirect.github.com/eslint/eslint/issues/21251">#21251</a>) (Aleksandr Shoronov)</li> </ul> <h2>Documentation</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/ad74a8dada2aaa17bfd0b8cc7b4119ff7a8ac04b"><code>ad74a8d</code></a> docs: add deprecation steps for EOL package versions (<a href="https://redirect.github.com/eslint/eslint/issues/21248">#21248</a>) (Francesco Trotta)</li> </ul> <h2>Chores</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/3c3ae53a43721162f0db76c69665ebd9d752ea52"><code>3c3ae53</code></a> chore: update ecosystem plugins (<a href="https://redirect.github.com/eslint/eslint/issues/21249">#21249</a>) (ESLint Bot)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/eslint/eslint/commit/5c8c2417b9ff462f2dc4e54a062c59135b45b845"><code>5c8c241</code></a> 10.9.1</li> <li><a href="https://github.com/eslint/eslint/commit/a7f3b7ddca7de8464995707d1bbac3ca91090015"><code>a7f3b7d</code></a> Build: changelog update for 10.9.1</li> <li><a href="https://github.com/eslint/eslint/commit/1e641c919fc1421493bf913feb607896982451a3"><code>1e641c9</code></a> fix: no-loss-of-precision false positive with trailing decimal point (<a href="https://redirect.github.com/eslint/eslint/issues/21251">#21251</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/ad74a8dada2aaa17bfd0b8cc7b4119ff7a8ac04b"><code>ad74a8d</code></a> docs: add deprecation steps for EOL package versions (<a href="https://redirect.github.com/eslint/eslint/issues/21248">#21248</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/3c3ae53a43721162f0db76c69665ebd9d752ea52"><code>3c3ae53</code></a> chore: update ecosystem plugins (<a href="https://redirect.github.com/eslint/eslint/issues/21249">#21249</a>)</li> <li>See full diff in <a href="https://github.com/eslint/eslint/compare/v10.9.0...v10.9.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>
Shinrai
approved these changes
Sep 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Slothlet v3.15.1 Changelog
Release Date: August 2026
Release Type: Patch
Branch:
release/3.15.1Overview
Version 3.15.1 is a maintenance and supply-chain-hardening release — no runtime code changed. The public API, loader behavior, and every runtime surface are identical to 3.15.0. This release is entirely CI/release-pipeline hardening, a dev-toolchain security bump, and documentation fixes.
The substantive change is least-privilege GitHub Actions token permissions across the workflow set, alongside clearing two high-severity advisories in the dev-only test/lint toolchain. An OpenSSF Scorecard badge now surfaces the repository's supply-chain posture in the README.
🔒 Security & supply chain
Least-privilege workflow token permissions (#319)
Every GitHub Actions workflow now declares a read-only top-level
permissions: { contents: read }default, with write scopes narrowed to the single job that needs them rather than granted workflow-wide. This satisfies OpenSSF Scorecard's Token-Permissions check and shrinks the blast radius of a compromised action. Behavior is unchanged — each job still receives exactly the permissions it had before, only scoped to the job instead of the whole workflow.Dev-toolchain advisories cleared (#322)
Two high-severity denial-of-service advisories were resolved by bumping dev-only, transitive dependencies:
brace-expansion5.0.7 → 5.0.9 (viaeslint→minimatch) — GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895.nanoid3.3.16 → 3.3.18 (viavitest→vite→postcss) — GHSA-2v37-7h3g-55p8.Both live purely in the test/lint toolchain and are never reachable from the published package, which remains dependency-free at runtime — consumers were never exposed.
npm auditnow reports 0 vulnerabilities.🔧 CI & tooling
deps/**branches (ci(feature-pr): trigger on deps/** branches #321) — the reusable workflow already mappeddeps/*, but this repo's caller trigger omitted it, sodeps/*branches never auto-opened a PR. The trigger list is realigned with the reusable and the branch-naming convention.BOT_NAME/BOT_EMAILare now passed to the v4 release / feature-PR workflows.📚 Documentation
docs/*.mdlinks are now absolute GitHub URLs rather than repo-relative, so they resolve on npm and other non-GitHub renderers.🔧 Dependencies
brace-expansion5.0.7 → 5.0.9,nanoid3.3.16 → 3.3.18 (security; deps: bump brace-expansion 5.0.9 and nanoid 3.3.18 (dev, transitive) #322). No runtime dependency changed — slothlet remains dependency-free.Upgrade notes
👥 Contributors
Avg: 100.0% ·
36fba25· Node lts/*