Skip to content

Dependabot/weekly updates - #558

Open
Adediwura-dev wants to merge 7 commits into
Sub-Rosa-Issue:mainfrom
Adediwura-dev:dependabot/weekly-updates
Open

Adediwura-dev wants to merge 7 commits into
Sub-Rosa-Issue:mainfrom
Adediwura-dev:dependabot/weekly-updates

Conversation

@Adediwura-dev

Copy link
Copy Markdown
Contributor

Summary

Supply-chain review

  • No package scripts or dependencies changed. If changed, explain why below.
  • No .vscode/, workflow, or other editor/config file changes. If changed, list them below.
  • No lockfile changes. If changed, explain the update below.
  • No binary or font asset changes. If changed, list and justify them below.
  • I confirm no automatic task (such as preinstall/postinstall) was added.
  • I confirm no hidden executable payload (encoded blob, obfuscated command, or unexpected binary) was added.
  • Any changed executable or binary was reviewed by a maintainer.

Testing

Closes #482

Adediwura-dev and others added 7 commits October 21, 2026 23:24
- Configure weekly schedule for all three ecosystems
- Limit 5 open PRs per ecosystem to reduce noise
- Group patch/minor updates together where supported
- Use 'dependencies' label consistent with repository conventions
- Do not change dependency versions
…categories

- Add SealRoundTooEarly, SealRoundTooLate, InvalidSealRoundZero errors
- Reorganize error codes: 40-42 = seal-round window, 43-49 = escrow accounting
- Update ERRORS.md, types.rs, error_paths.rs, test.rs accordingly
- Update SDK errors.ts and related test fixtures
- Update PasskeyPanel and useTraceHealth to use normalizeError

Co-authored-by: Codebuff <noreply@codebuff.com>
The conflict resolution for Sub-Rosa-Issue#558 mangled three spots in the appraisal model:
`APPRAISAL_MODEL` lost its underscore, the canonical JSON serializer's
destructuring became `([k], v])`, and three rationale interpolations lost their
`$` to a mojibake `ä`. The file now matches the pre-merge version, so the
model hashes and rationale strings match the schema fixture again.

Generated with Codebuff 🤖
Co-Authored-By: Codebuff <noreply@codebuff.com>
The log line lost its closing parenthesis and backtick, leaving bidder.ts
unparseable for every downstream typecheck.

Generated with Codebuff 🤖
Co-Authored-By: Codebuff <noreply@codebuff.com>
… callers

Requiring a per-call quote made the client refuse the bidder and x402 e2e
flows, which only carry a mandate-level quote. Binding now runs whenever the
caller supplies a quote, unparseable challenges stay a payment error, and the
drift/expiry tests pass the quote they are comparing against so they exercise
the binding instead of failing before it.

Generated with Codebuff 🤖
Co-Authored-By: Codebuff <noreply@codebuff.com>
SubRosaClientConfig lost its `session` field, CommitParams lost `session` and
`binding`, RoundReceiptEvent was used without an import, and a local
RoundAssetConfig shadowed the regenerated bindings export that now carries the
same shape — six type errors in every package that compiles the SDK.

Generated with Codebuff 🤖
Co-Authored-By: Codebuff <noreply@codebuff.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

security(repo): enable weekly Dependabot updates for npm, Cargo, and Actions

1 participant