ci(deps): bump the minor-gh-actions group across 1 directory with 3 updates

[dependabot]

Bumps the minor-gh-actions group with 3 updates in the / directory: oxsecurity/megalinter/flavors/javascript, actions/attest-build-provenance and github/codeql-action/upload-sarif.

Updates oxsecurity/megalinter/flavors/javascript from 9.5.0 to 9.6.0

Release notes

Sourced from oxsecurity/megalinter/flavors/javascript's releases.

v9.6.0

What's Changed

• Breaking changes

  • Linters can no longer be run via a sibling Docker image at runtime. The cli_docker_image, cli_docker_image_version and cli_docker_args descriptor properties (and the matching <LINTER>_DOCKER_IMAGE_VERSION variable) have been removed, and MegaLinter no longer mounts /var/run/docker.sock (in mega-linter-runner, the GitHub Action action.yml files, and the Docker daemon previously bundled in flavor images). This closes the host-privilege escalation surface that the mounted Docker socket exposed. The only linter that used this mechanism was SWIFT_SWIFTLINT, now installed natively (see below). (#8216)
  • SWIFT_SWIFTLINT is now installed from the static swiftlint-static binary instead of running the ghcr.io/realm/swiftlint container. It runs natively on the Alpine image with no Docker socket required. SourceKit-dependent rules are disabled in this build and reported to the console when encountered; pure-syntax style rules are unaffected. (#8216)
  • @eslint/eslintrc shim removed from JavaScript/TypeScript/JSX/TSX Docker images (was only needed for legacy FlatCompat); MegaLinter's bundled test fixtures use native flat config. (#7869)
  • ESLint linters now force migration off .eslintrc.*: JAVASCRIPT_ES, TYPESCRIPT_ES, JSX_ESLINT, TSX_ESLINT activate when they find any eslint.config.* or any deprecated .eslintrc.* / package.json#eslintConfig. In the legacy case the linter does not call ESLint at all — it emits a single hard failure with a migration message so the build stays red until the config is migrated to flat config. See the ESLint flat-config migration guide. To opt out, set DISABLE_LINTERS or DISABLE to exclude the affected linter/descriptor. (#7869)
  • JSON_ESLINT_PLUGIN_JSONC removed: upstream bug ota-meshi/eslint-plugin-jsonc#328 blocks ESLint v10 compatibility and will not be fixed. Use JSON_JSONLINT, JSON_PRETTIER, or JSON_V8R for JSON validation instead. (#7869)

• Core

  • New linter descriptor property common_linter_errors: declare known non-lint failure patterns (config issue, remote service down, missing credentials…) and the guidance message shown to users, directly in YAML — no custom Python class needed. (#7907)
  • Skipped-linters summary now explains why a linter was skipped by an activation rule, including the variable to set to activate it (e.g. MARKDOWN_RUMDL: MARKDOWN_DEFAULT_STYLE=markdownlint (set MARKDOWN_DEFAULT_STYLE=rumdl to activate)), fixing #8017.

• New linters

  • Add betterleaks linter for repository secrets scanning — successor to gitleaks with higher recall (98.6% vs 70.4%), lower false-positive rates, and 4–5× faster scanning via BPE-based detection and CEL filter expressions (#8186)

• Disabled linters

  • SALESFORCE_SFDX_SCANNER_APEX, SALESFORCE_SFDX_SCANNER_AURA and SALESFORCE_SFDX_SCANNER_LWC — disabled because sfdx-scanner 4.12.0 crashes on Node.js 22+ (TypeError: Cannot read properties of undefined (reading 'prototype'), caused by the removal of SlowBuffer.prototype), which is shipped with Alpine 3.24. These linters were already deprecated; use the SALESFORCE_CODE_ANALYZER_APEX / SALESFORCE_CODE_ANALYZER_AURA / SALESFORCE_CODE_ANALYZER_LWC variants instead (#8080).

• Deprecated linters

  • REPOSITORY_GITLEAKS — deprecated in favour of REPOSITORY_BETTERLEAKS (same author, fully compatible config, significantly better detection). Will be removed in the next major release. Disable it by adding REPOSITORY_GITLEAKS to DISABLE_LINTERS in your .mega-linter.yml. (#8186)

• Removed linters

  • JSON_ESLINT_PLUGIN_JSONC — permanently broken by upstream bug (see Breaking changes) (#7869)

• Linters enhancements

  • REPOSITORY_CHECKOV: in pull-request mode, scan only the files modified in the PR instead of the whole repository (#7119)

• Fixes

  • REPOSITORY_BETTERLEAKS: default scan now runs in filesystem (dir) mode instead of auto-switching to git-history (git) mode when a git repository is detected. betterleaks does not read the global git safe.directory config, so git mode failed with fatal: detected dubious ownership in repository in CI environments (e.g. GitHub Actions /github/workspace). Git-history mode is still used for the opt-in REPOSITORY_BETTERLEAKS_PR_COMMITS_SCAN feature. (#8186)
  • REPOSITORY_BETTERLEAKS: added --verbose so detected findings (file, line and rule) are reported instead of only the leaks found: N summary, matching gitleaks behavior. Secret values stay redacted via --redact. (#8186)
  • REPOSITORY_OSV_SCANNER: exit code 128 ("No package sources found") is now treated as a clean pass instead of a failure — osv-scanner returns this code when the repo contains no lockfiles/manifests/SBOMs, which is not a vulnerability finding (#7917).
  • Fix intermittent ansible-lint load-failure[not-found] error on github_conf/branch_protection_rules.json caused by a race condition with checkov running in parallel. Checkov's transient GitHub-conf directory is now written to a hidden path (.megalinter_github_conf) that project-mode linters skip, eliminating the conflict (#8092).
  • Complete the Alpine 3.24 upgrade across the whole image and fix how alpine version is detected. Docker images now build on the python:3.14-alpine3.24 base image (#8080).
  • Avoid DeprecationWarning / future breakage on Python 3.14 by no longer passing count and flags as positional arguments to re.sub (#8211).
  • Exclude REPORT_OUTPUT_FOLDER from linting when configured as an absolute path inside the workspace (e.g. /tmp/lint/megalinter-reports), fixing #7845.
  • Fix command injection in Roslynator linter (DOTNET_ROSLYNATOR) where a crafted .csproj filename could break out of dotnet restore arguments and execute arbitrary shell commands. The command is now invoked via argv list instead of a shell string. Reported by Francesco Sabiu. (#7857)
  • Fix IndexError when building the single-linter Docker image for a linter whose activation depends on a file (e.g. SPELL_VALE requires .vale.ini): python -m megalinter.run --linterversion now bypasses activation filtering since the per-linter image is built for that linter unconditionally.
  • Fix make bootstrap appearing to hang because exported Make color variables re-evaluated tput during recursive make invocations. (#8090)
  • Allow MegaLinter containers to run in an opt-in non-root mode matching the host UID:GID on POSIX systems, avoiding root-owned generated files on the host (#1975).
  • Restore missing examples in the Dart descriptor that were dropped from the generated documentation (#7913).

• Reporters

  • Update Bitbucket pipeline generator template to trigger builds on pull requests from any branch, by @​yermulnik in oxsecurity/megalinter#7421

• Doc

  • Add pnpm installation and usage documentation for JavaScript and TypeScript linters (#8177)
  • Update Docker pull counters in README badges and flavors-stats.json with latest ghcr.io stats
  • Bump peter-evans/create-pull-request to v8 in the documented workflow examples (#8089)

... (truncated)

Changelog

Sourced from oxsecurity/megalinter/flavors/javascript's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased] (beta, main branch content)

Note: Can be used with oxsecurity/megalinter@beta in your GitHub Action mega-linter.yml file, or with oxsecurity/megalinter:beta docker image

• Breaking changes

  • Removed 14 deprecated or long-disabled linters, and the API, MAKEFILE and PUPPET descriptors, which had no other linter left. MegaLinter does not provide Makefile and Puppet linting anymore.
  • REPOSITORY_GITLEAKS has been removed: migrate to REPOSITORY_BETTERLEAKS, which reads your existing .gitleaks.toml and .gitleaksignore files unchanged.
  • Configuration variables of removed linters remain valid in the JSON schema (flagged as deprecated) and are ignored at runtime, so existing .mega-linter.yml files keep validating. MegaLinter now displays a single notice listing every removed linter or descriptor found in your configuration, with a link to the new Removed linters page.

• Core

  • Forward excluded directories (EXCLUDED_DIRECTORIES + ADDITIONAL_EXCLUDED_DIRECTORIES) to linters running in project CLI lint mode through their native exclusion argument (e.g. trivy --skip-dirs, grype/syft --exclude, checkov --skip-path), via the new descriptor properties cli_lint_mode_project_exclude_arg_name, cli_lint_mode_project_exclude_arg_value and cli_lint_mode_project_exclude_separator. For tools without a usable exclusion flag, Python subclass workarounds forward the exclusions anyway: TruffleHog merges excluded directories into its --exclude-paths file (so it stops crawling .git and build caches), betterleaks gets a generated config extending the resolved one with allowlist path regexes, prettier / csharpier / npm-package-json-lint get generated ignore files merged with their defaults, devskim / bandit / gherkin-lint / luacheck / stylua get their exclusion arguments built with defaults preserved, jscpd / yamllint / rubocop / swiftlint / ls-lint get a generated config merging or inheriting the resolved one, markdownlint / v8r get generated ignore files alongside the defaults their flags would replace, clj-kondo gets an inline merged config, eslint's project mode drops --no-ignore so --ignore-pattern and config ignores apply, phpstan / php-cs-fixer get a generated config including or requiring the resolved one, and secretlint / sqlfluff / cljstyle / coffeelint get an ignore or config file temporarily written at the workspace root (removed after the run) since they only discover such files inside the analyzed repository. Directories identified from FILTER_REGEX_EXCLUDE (global, descriptor or linter scoped) literal prefixes are forwarded as exclusions too when they exist in the workspace. Each forwarded exclusion is traced in the linter's console log, and forwarding can be disabled globally with FORWARD_EXCLUDED_DIRECTORIES: false or per-linter with <LINTER_KEY>_FORWARD_EXCLUDED_DIRECTORIES: false. Default excluded directories now also include common build/cache folders (.wireit, .turbo, .nx, .yarn/cache, .pnpm-store, .parcel-cache, .angular, and the Salesforce CLI .sf / .sfdx state folders), the ">300 gitignored files" performance warning names the heaviest directories it found, and mega-linter-runner prints a hint when the mounted workspace contains well-known heavy folders. This can speed up local runs on workspaces containing build caches by several orders of magnitude, fixes #8645

  • Add megalinter/removed_linters.py as the single source of truth for every linter and descriptor removed since v6, used both at runtime and by the build system, and generate a Removed linters documentation page from it

  • Migrate MegaLinter's internal log secret-masking engine from gitleaks' public ruleset to betterleaks, removing the last internal dependency on gitleaks. The ruleset is pinned, tracked by renovate alongside the betterleaks linter, and vendored in minified form, removing a network call at every MegaLinter run. Redaction coverage nearly doubles (218 to 408 patterns)

  • Allow FILTER_REGEX_INCLUDE and FILTER_REGEX_EXCLUDE (global, per-descriptor and per-linter) to be defined as a list of regexes combined with a logical OR, so filter regexes can be appended across EXTENDS configs via CONFIG_PROPERTIES_TO_APPEND; single-string values remain fully supported, fixes #8361

  • Add ENABLE_DISABLE_LINTERS_PRIORITY variable to let DISABLE_LINTERS override ENABLE_LINTERS when a linter is in both lists (e.g. to trim an inherited ENABLE_LINTERS list via EXTENDS), fixes #8296

  • Add supported_cli_lint_modes descriptor property to declare which CLI lint modes (file, list_of_files, project) each linter supports, generate success/failure tests for every supported mode, and reject a <LINTER>_CLI_LINT_MODE override targeting an unsupported mode with an explicit error, fixes #7120

  • Speed up CI by skipping the file CLI lint mode tests for linters that also support list_of_files, since list_of_files exercises the same code path more cheaply

  • Improve parallel linters scheduling when fixes are applied: only the fixer linters of a descriptor now run serially in the same process, and the check-only linters of that descriptor are scheduled in parallel once the fixers are done, instead of being serialized behind each other (e.g. the PYTHON chain black+isort+ruff+pylint+mypy+flake8+bandit drops from a single ~100s sequence to fixers + the longest checker). Combined with the build-time versions manifest below, linting the MegaLinter repository itself went from 4m26s to 3m18s (-26%)

  • Report linter versions from a manifest collected at Docker image build time instead of spawning one --version process per linter at runtime. New VERSION_GET_AT_RUNTIME configuration variable (env var or .mega-linter.yml) to force calling the linter executables, e.g. if PRE_COMMANDS install different linter versions. Test cases and the linters auto-update job always use runtime versions

  • Display a distinct ☑️ status icon (instead of ⚠️) for linters that found errors but did not block the run because the error count stayed under <LINTER>_DISABLE_ERRORS_IF_LESS_THAN, and show the configured maximum as (max N allowed) in the console linter logs plus a new Max errors column in the console and Pull Request summary tables

  • Add API_REPORTER_PAYLOAD_FORMAT variable (auto, loki or default) to force the payload format sent by API Reporter, instead of only deducing it from the endpoint URL

  • Coding agents integration: add MegaLinter agent skills, installable in Claude Code, Cursor CLI, GitHub Copilot CLI, Codex, Antigravity, OpenCode and other coding agents with npx skills add oxsecurity/megalinter — megalinter-setup, megalinter-check (CI job watching on GitHub/GitLab/Azure/Bitbucket or local Docker runs) and megalinter-fix workflows plus a megalinter orchestrator, with per-linter fix guides generated from the YAML descriptors and sub-agents (installed on platforms supporting them, running on low-cost models) for token-efficient CI watching and parallel fixing. See the new Coding Agents documentation page

  • Add MEGALINTER_FLAVOR and MEGALINTER_VERSION properties to the .mega-linter.yml configuration schema, so the flavor and version of the MegaLinter Docker image can be pinned once in the repository configuration and reused by mega-linter-runner and the agent skills

  • Skip the repository-wide enumeration of .gitignored files when an explicit list of files is provided via MEGALINTER_FILES_TO_LINT (e.g. mega-linter-runner [files...]): the caller already chose the files to lint, and the enumeration could be expensive on large repositories

  • Speed up MegaLinter startup by ~5 seconds on every run: LLM provider SDKs (langchain-openai, langchain-anthropic, google-genai, ...) are now imported lazily, only when LLM Advisor is enabled, instead of at every startup (import megalinter drops from ~7s to ~0.9s)

  • Speed up standalone single-linter images (megalinter-only-*) startup: only the descriptor of the single linter is parsed instead of instantiating the 120+ linters of all descriptors, and plugins initialization (remote descriptor download + install commands) is skipped since a plugin can not provide the built-in single linter

  • Lighter Docker images:

    • LLM Advisor provider SDKs (langchain-openai, langchain-anthropic, langchain-google-genai, langchain-mistralai, langchain-ollama, langchain-deepseek, langchain-community) move to a new llm pip extra, installed in the main and flavor images but excluded from standalone megalinter-only-* images (~200 MB saved per standalone image); a standalone image with LLM_ADVISOR_ENABLED now logs an explicit message instead of loading the advisor

    • The compilation toolchain (gcc, make, musl-dev, libffi-dev) is no longer kept in the final image layers: it is installed as an apk virtual package only while pip/gem install steps may build native extensions, then removed (~110-150 MB saved per image). Pre-commands needing to compile native code can install it back with apk add --no-cache gcc make musl-dev. Descriptors whose linters need the toolchain at runtime (RUST clippy) or in custom install commands (PERL cpanm, LUA luarocks) now declare it explicitly

    • Standalone images no longer ship the ~45 MB __pycache__ layer produced by the build-time version priming (bytecode is regenerated in the container writable layer)

    • New descriptor property install.apk_build for apk packages needed only while pip/gem packages compile native extensions: they join the virtual .ml-build-deps package and are removed from the final layers. Used by SPELL_PROSELINT (build-base, re2-dev, py3-pybind11-dev needed to build google-re2, with only the re2 runtime library kept), which was keeping a full C++ toolchain in every flavor image

    • GROOVY_NPM_GROOVY_LINT now uses the same OpenJDK 21 as the other Java-based linters instead of shipping its own OpenJDK 17 (~300 MB saved in the main image and groovy-including flavors)

    • Development headers and per-descriptor build toolchains no longer ship in the final layers: LUA luarocks, PERL cpm and R install.packages compilations now install their toolchain (gcc, g++, make, musl-dev, *-dev headers) as an apk virtual package removed at the end of their own install step; ruby-dev moved to the shared build-time virtual package, ruby-rdoc and R-doc are not installed anymore, and XML_XMLLINT keeps only the libxml2 runtime library instead of libxml2-dev

    • Python linter venvs are now installed through the uv cache in hardlink mode: identical wheels shared by several venvs (setuptools, black, mypy, ...) are stored once on disk instead of once per venv

    • Extended node_modules pruning: all Markdown files plus test, tests, __tests__, docs and .github directories are removed from /node-deps, along with the leftover /root/.npm cache

    • Removed a stray cpplint Python venv that was mistakenly declared in the CSS_STYLELINT descriptor

    • Measured on linux/amd64 (uncompressed docker images size, before = previous beta measured the same day with the same CI jobs):

      Image	Before	After	Delta
      megalinter-only-groovy_npm_groovy_lint	1.07 GB	695 MB	-35%

... (truncated)

Commits

• ef3e84b Release MegaLinter v9.6.0
• 8b9259b Skill prepare-release (#8245)
• 5810155 chore(deps): bump pymdown-extensions from 10.21.3 to 11.0 in /.config/python/...
• aca415c chore(deps): update dependency semver to v7.8.5 (#8198)
• 2d8b274 Remove max-parallel for linters
• e9ab3e9 chore(ci): manual run of deploy linters beta job (#8242)
• a8a6368 Changelog (#8241)
• 7f363c6 [automation] Auto-update linters version, help and documentation (#8215)
• bce5232 chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.11.25 (#8232)
• 9d98266 chore(deps): update dependency realm/swiftlint to v0.65.0 (#8240)
• Additional commits viewable in compare view

Updates actions/attest-build-provenance from 4.1.0 to 4.1.1

Release notes

Sourced from actions/attest-build-provenance's releases.

v4.1.1

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

• Update actions/attest to v4.1.1 by @​bdehamer in actions/attest-build-provenance#858

Full Changelog: actions/attest-build-provenance@v4.1.0...v4.1.1

Commits

• 0f67c3f Bump actions/checkout from 6.0.3 to 7.0.0 (#857)
• 21b787d Update actions/attest to v4.1.1 (#858)
• f14352a add dependabot cooldown (#851)
• 2c04a00 Bump actions/checkout from 6.0.2 to 6.0.3 in the actions-minor group (#850)
• 10334b5 remove badges from README (#840)
• c5efebd remove prober workflows (#837)
• See full diff in compare view

Updates github/codeql-action/upload-sarif from 4.36.1 to 4.37.3

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.37.3

No user facing changes.

v4.37.2

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

v4.37.1

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

v4.37.0

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v4.36.3

No user facing changes.

v4.36.2

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

... (truncated)

Commits

• e4fba86 Merge pull request #4031 from github/update-v4.37.3-72f6a9da0
• fb50ab5 Update changelog for v4.37.3
• 72f6a9d Merge pull request #4030 from github/mbg/fix/no-proxy
• 3b5ee58 Use default request options instead of undefined
• bfb6be4 Merge pull request #4028 from github/mergeback/v4.37.2-to-main-e0647621
• 526ab84 Rebuild
• d6217b9 Update changelog and version after v4.37.2
• e064762 Merge pull request #4027 from github/update-v4.37.2-385bcdc5a
• e0faed8 Add a couple of change notes
• 73aad0e Update changelog for v4.37.2
• Additional commits viewable in compare view

[lsuwito-bt]

@dependabot rebase