From ecab497a63415c36e1fc7ebe7658f771a339569f Mon Sep 17 00:00:00 2001 From: wenyutang-ms Date: Thu, 6 Aug 2026 14:14:32 +0800 Subject: [PATCH 1/2] Revert "chore(deps-dev): bump fast-uri from 3.1.4 to 3.1.5 (#1665)" This reverts commit 4aaaadb44141669040f5e18661a1a9dbd613ad98. --- package-lock.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index 07e00858..068e22fc 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1222,9 +1222,9 @@ "dev": true }, "node_modules/fast-uri": { - "version": "3.1.5", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz", - "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==", + "version": "3.1.4", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", + "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", "dev": true, "funding": [ { @@ -4167,9 +4167,9 @@ "dev": true }, "fast-uri": { - "version": "3.1.5", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz", - "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==", + "version": "3.1.4", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", + "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", "dev": true }, "fastest-levenshtein": { From 3cb4e9a88469bec8718d464275476831d7785295 Mon Sep 17 00:00:00 2001 From: wenyutang-ms Date: Thu, 6 Aug 2026 14:15:36 +0800 Subject: [PATCH 2/2] build: delay Dependabot updates for CFS availability --- .github/dependabot.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..8cc8a033 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,19 @@ +# To get started with Dependabot version updates, you'll need to specify which +# package ecosystems to update and where the package manifests are located. +# Please see the documentation for all configuration options: +# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file + +version: 2 +updates: + - package-ecosystem: "npm" # See documentation for possible values + directory: "/" # Location of package manifests + schedule: + interval: "daily" + # CI restores packages from the Central Feed Service, which withholds + # upstream versions until they are roughly a week old (measured at ~6.8 + # days; both the packument entry and the tarball return 404 before then). + # Dependabot's built-in cooldown is only 3 days, so bumps otherwise land in + # a window where the feed 404s and the build fails. 10 days leaves margin + # in case the feed's ingestion lag drifts. + cooldown: + default-days: 10