build(deps-dev): Bump @cyclonedx/cyclonedx-npm from 5.0.0 to 6.0.0 - #133
Merged
Amir Bredy (ABMFST) merged 2 commits intoSep 17, 2026
Merged
Amir Bredy (ABMFST) merged 2 commits into
Amir Bredy (ABMFST) merged 2 commits into
Conversation
dependabot
Bot
added
dependencies
Bumps [@cyclonedx/cyclonedx-npm](https://github.com/CycloneDX/cyclonedx-node-npm) from 5.0.0 to 6.0.0. - [Release notes](https://github.com/CycloneDX/cyclonedx-node-npm/releases) - [Changelog](https://github.com/CycloneDX/cyclonedx-node-npm/blob/main/HISTORY.md) - [Commits](CycloneDX/cyclonedx-node-npm@v5.0.0...v6.0.0) --- updated-dependencies: - dependency-name: "@cyclonedx/cyclonedx-npm" dependency-version: 6.0.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/cyclonedx/cyclonedx-npm-6.0.0
branch
from
September 17, 2026 18:32
03386df to
446e9b1
Compare
Document the Windows workspace shell-injection fix and require an exact patched generator version in the manifest and all lockfile copies. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2b11c4f8-c7fa-4b14-9833-5d0b1006223b
Amir Bredy (ABMFST)
approved these changes
Sep 17, 2026
Amir Bredy (ABMFST)
left a comment
Amir Bredy (ABMFST)
left a comment
Contributor
There was a problem hiding this comment.
Reviewed the CycloneDX 5.0.0 -> 6.0.0 upgrade, public-registry lock metadata, exact-version regression guard and changelog entries. No runtime dependencies, application behavior, flavor versions or optional binaries changed.
The upstream npm-discovery change preserves npm_execpath behavior used by our npx --no-install release invocation. The exact release SBOM command successfully produced nonempty production component inventories on hosted Windows, Linux, macOS and Node 24. Full audits were zero on all four runners: https://github.com/Azure/ConfigForge/actions/runs/35260066311
All final PR checks passed on c8fb672. No blocking findings in the reviewed diff. macOS security port is #134.
Amir Bredy (ABMFST)
deleted the
dependabot/npm_and_yarn/cyclonedx/cyclonedx-npm-6.0.0
branch
September 17, 2026 18:46
Amir Bredy (ABMFST)
added a commit
that referenced
this pull request
Sep 17, 2026
Port patched CycloneDX 6.0.0 tooling, lockfile metadata, regression coverage and security notes to the author branch without changing release versions. Complete the maintainer-requested remaining security remediation after #133. Temporarily allow only ABMFST to bypass reviews; retain CI and administrator enforcement, then immediately restore the original allowance. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2b11c4f8-c7fa-4b14-9833-5d0b1006223b
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps @cyclonedx/cyclonedx-npm from 5.0.0 to 6.0.0.
Release notes
Sourced from @cyclonedx/cyclonedx-npm's releases.
Changelog
Sourced from @cyclonedx/cyclonedx-npm's changelog.
Commits
e1696066.0.0e26b886chore: prep v6.0.015d3bebBC: rework npm-cli detction (#1489)ee61a44docs7453b18tests: refactor and extend shell-injection cases (#1488)59d1de7docs2c42430fix: properly closing output file (#1484)fb5b526chore(deps): bump softprops/action-gh-release from 2.6.2 to 3.0.1 (#1477)626976echore(deps): bump actions/download-artifact from 7.0.0 to 8.0.1 (#1445)6e88380chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.1 (#1446)