[github-actions]

Автообновление зависимостей от 2026-11-11 (workflow deps-auto-update): bun update в пределах диапазонов package.json, только minor и patch, прямые и транзитивные пакеты, свежие версии сразу после выхода. Пока PR открыт, ветка пересобирается от последнего commit AgentHits-Dev после каждого push в неё и каждый день в 03:00 UTC.

. — пакетов: 33

Пакет	Было	Стало
@emnapi/core	—	2.0.0-beta.2
@emnapi/core/tslib	—	2.9.1
@emnapi/runtime	1.11.3	2.0.0-beta.2
@emnapi/wasi-threads	—	2.2.0
@emnapi/wasi-threads/tslib	—	2.9.1
@hono/node-server	2.1.6	2.1.7
@img/sharp-wasm32/@emnapi/runtime	—	1.11.3
@img/sharp-wasm32/@emnapi/runtime/tslib	—	2.9.1
@napi-rs/wasm-runtime	—	1.2.6
@rolldown/binding-android-arm-eabi	1.2.18	1.2.19
@rolldown/binding-android-arm64	1.2.18	1.2.19
@rolldown/binding-darwin-arm64	1.2.18	1.2.19
@rolldown/binding-darwin-x64	1.2.18	1.2.19
@rolldown/binding-freebsd-x64	1.2.18	1.2.19
@rolldown/binding-linux-arm-gnueabihf	1.2.18	1.2.19
@rolldown/binding-linux-arm64-gnu	1.2.18	1.2.19
@rolldown/binding-linux-arm64-musl	1.2.18	1.2.19
@rolldown/binding-linux-ppc64-gnu	1.2.18	1.2.19
@rolldown/binding-linux-s390x-gnu	1.2.18	1.2.19
@rolldown/binding-linux-x64-gnu	1.2.18	1.2.19
@rolldown/binding-linux-x64-musl	1.2.18	1.2.19
@rolldown/binding-openharmony-arm64	1.2.18	1.2.19
@rolldown/binding-wasm32-wasi	—	1.2.19
@rolldown/binding-win32-arm64-msvc	1.2.18	1.2.19
@rolldown/binding-win32-x64-msvc	1.2.18	1.2.19
@tybys/wasm-util	—	0.10.4
@tybys/wasm-util/tslib	—	2.9.1
caniuse-lite	1.0.30001823	1.0.30001826
hono	4.13.17	4.13.18
minimatch	11.0.7	11.0.8
postgres	4.1.0	4.1.1
posthog-js	1.447.11	1.447.12
rolldown	1.2.18	1.2.19

bun audit: 1 vulnerability (1 low)

Вывод bun audit

bun audit v1.4.4 (38afee6c8)

deepmerge@4.3.1
  workspace:dokploy > shadcn > @shadcn/registry > deepmerge
  workspace:dokploy > swagger-ui-react > swagger-client > deepmerge
  workspace:dokploy > @react-email/components > @react-email/render > html-to-text > deepmerge
  workspace:dokploy > resend > @react-email/render > html-to-text > deepmerge
  low: deepmerge mergeObject() allows prototype poisoning of returned objects (>=4.2.0 <=4.3.1) - https://github.com/advisories/GHSA-gcqx-w48m-w2h4

1 vulnerability (1 low)

  bun audit fix           upgrade the vulnerable packages within their ranges
  bun audit fix --latest  also cross major versions

bun outdated: колонка Latest выше Update - это major, их workflow не берёт

bun outdated v1.4.4 (38afee6c8)
|-----------------------------------------------------------|
| Package  | Current | Update | Latest | Workspace          |
|----------|---------|--------|--------|--------------------|
| inngest  | 4.26.1  | 4.26.1 | 4.26.2 | @dokploy/api       |
|----------|---------|--------|--------|--------------------|
| ssh2     | 1.16.0  | 1.16.0 | 1.17.0 | dokploy            |
|----------|---------|--------|--------|--------------------|
| stripe   | 17.2.1  | 17.2.1 | 23.1.0 | dokploy            |
|----------|---------|--------|--------|--------------------|
| bullmq   | 5.81.5  | 5.81.5 | 6.7.4  | @dokploy/schedules |
|----------|---------|--------|--------|--------------------|
| ssh2     | 1.16.0  | 1.16.0 | 1.17.0 | @dokploy/server    |
|-----------------------------------------------------------|

---

Перед merge: зелёные прогоны pull-request.yml bun-migration-docker-check.yml с событием workflow_dispatch на голове PR (workflow запускает их сам: push от GITHUB_TOKEN событие pull_request не создаёт). Commit в эту ветку останавливает пересборку. Major - отдельными PR.