chore: forward-integrate main into v5 - #775
Merged
tyler-reitz merged 9 commits intoAug 4, 2026
Merged
Conversation
Bumps [re2](https://github.com/uhop/node-re2) from 1.25.0 to 1.26.1. - [Release notes](https://github.com/uhop/node-re2/releases) - [Commits](uhop/node-re2@1.25.0...1.26.1) --- updated-dependencies: - dependency-name: re2 dependency-version: 1.26.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Split out of FirebaseExtended#766 at Jeff's request, so that PR can stay focused on the release checks. This is a pre-existing, repo-wide condition rather than anything the gate introduced: the zizmor scan only runs when a workflow file changes, so it fires against whatever state the file was already in. Both workflows, since he asked for docs.yaml too: - **All 14 action references pinned to commit SHAs**, with the resolved release in a trailing comment so versions stay legible and Dependabot can still bump them. Clears `unpinned-uses`, the only mandatory audit. - **Top-level `permissions: contents: read`.** Neither workflow writes to the repo through GITHUB_TOKEN; the publish job authenticates to npm separately, now via the Google npm service. Clears `excessive-permissions`. - **`persist-credentials: false` on all four checkouts.** The token is not needed after the clone, and leaving it in .git/config exposes it to every later step. Clears `artipacked`. Result, measured with the version CI pins (1.25.2): test.yaml 8 medium, 17 high -> 0 medium, 5 high docs.yaml 2 medium, 2 high -> no findings at all CI fails on Medium or higher, so partial fixes would not have cleared it. The 5 remaining findings on test.yaml are all `cache-poisoning`, which the org scan suppresses; fixing those means restructuring how the workflow caches around the publish path and does not belong here. No functional change to any job. Verified that main's switch of the publish registry to wombat-dressing-room is preserved.
…Extended#770) The emitted .d.ts inherited source's extensionless relative specifiers (`from './useObservable'`, and `from '.'` in two files), which node16 and nodenext resolution reject. Consumers on those settings hit resolution errors reading our declarations, while the runtime bundles were fine, so nothing in the build surfaced it. `moduleResolution: bundler` accepts both forms in source, so this is a no-op for the build and for bundler consumers. Verified with @arethetypeswrong/cli against the packed build, with no ignore rules: before node16 (from ESM) internal resolution error after node16 (from ESM) pass node16 (from CJS) still reports "no types" on this branch; that is the missing `types` export condition, fixed separately in FirebaseExtended#766. With both changes applied, all four resolution modes pass with no suppression. Fixes FirebaseExtended#769.
`v5` already ignores these (line 1 of its .gitignore); `main` does not. The asymmetry means a local CLAUDE.local.md is untracked-but-unignored on any main-based branch, so it shows up in `git status` and a `git clean` deletes it. Matching v5 exactly keeps forward-integration a no-op.
Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.2.0 to 10.4.0. - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.2.0...v10.4.0) --- updated-dependencies: - dependency-name: ip-address dependency-version: 10.4.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.5. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.4...v3.1.5) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.15 to 8.5.25. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.15...8.5.25) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.25 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Forward-integrates main through FirebaseExtended#774. Carries the zizmor workflow hardening (FirebaseExtended#767), which v5 needs: the org-level zizmor scan flags v5's unhardened test.yaml and docs.yaml, so every v5 PR fails zizmor-output until this lands, including PRs touching no workflow files. Also brings FirebaseExtended#770 (explicit .js extensions in emitted .d.ts), FirebaseExtended#771, FirebaseExtended#768 and the ip-address/fast-uri/postcss lockfile bumps.
Contributor
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Forward-integrates
mainintov5through #774.Why now
v5carries the unhardenedtest.yamlanddocs.yaml. The zizmor scan is org-level rather than in.github/workflows/, so it flags those files on everyv5PR and cannot be fixed on a topic branch. The result is thatzizmor-outputfails on v5 PRs that touch no workflow files at all (seen on #740). This unblocks all v5 work, not just that PR.What it carries
test.yamlanddocs.yaml(the blocker above).jsextensions in emitted.d.ts, fixes node16 resolutionCLAUDE.local*Verification
merge-treebeforehand and by the merge itself.cache-poisoning, which CI suppresses. That is the severity setzizmor-outputgates on.v5's fix: surface observable errors via status instead of re-throwing #735 behavior is intact: non-suspense still surfaces errors viastatus: 'error'.src/after merging fix(types): use explicit .js extensions in relative imports #770 against v5's sources.tsconfig.jsonandtsconfig.test.json.Merge instructions
Merge commit, not squash and not rebase, so
mainstays a real ancestor ofv5(same as #758).Expect
Publish (NPM)to show as inherited/unstable on the resulting head. That is the known consequence of forward-integration heads and is not a regression.