Promote staging to master (#1085) by sanason · Pull Request #1087 · 18F/analytics-reporter

sanason · 2026-07-01T18:03:52Z

Pin GitHub action SHA's (Pin GitHub action SHA's #1066)
Bump ip-address in the npm_and_yarn group across 1 directory (Bump ip-address from 9.0.5 to 10.2.0 in the npm_and_yarn group across 1 directory #1065)

Bumps the npm_and_yarn group with 1 update in the / directory: ip-address.

Updates ip-address from 9.0.5 to 10.2.0

Commits

updated-dependencies:

dependency-name: ip-address dependency-version: 10.2.0 dependency-type: indirect ...

Bump the npm_and_yarn group across 1 directory with 2 updates (Bump the npm_and_yarn group across 1 directory with 2 updates #1067)

Bumps the npm_and_yarn group with 2 updates in the / directory: basic-ftp and fast-xml-builder.

Updates basic-ftp from 5.3.0 to 5.3.1

Updates fast-xml-builder from 1.1.5 to 1.2.0

updated-dependencies:

dependency-name: basic-ftp dependency-version: 5.3.1 dependency-type: indirect dependency-group: npm_and_yarn
dependency-name: fast-xml-builder dependency-version: 1.2.0 dependency-type: indirect dependency-group: npm_and_yarn ...

Bump @protobufjs/utf8 in the npm_and_yarn group across 1 directory (Bump @protobufjs/utf8 from 1.1.0 to 1.1.1 in the npm_and_yarn group across 1 directory #1068)

Bumps the npm_and_yarn group with 1 update in the / directory: @protobufjs/utf8.

Updates @protobufjs/utf8 from 1.1.0 to 1.1.1

updated-dependencies:

dependency-name: "@protobufjs/utf8" dependency-version: 1.1.1 dependency-type: indirect dependency-group: npm_and_yarn ...

Bump protobufjs in the npm_and_yarn group across 1 directory (Bump protobufjs from 7.5.5 to 7.5.8 in the npm_and_yarn group across 1 directory #1069)

Bumps the npm_and_yarn group with 1 update in the / directory: protobufjs.

Updates protobufjs from 7.5.5 to 7.5.8

updated-dependencies:

dependency-name: protobufjs dependency-version: 7.5.8 dependency-type: indirect dependency-group: npm_and_yarn ...

Bump @tootallnate/once in the npm_and_yarn group across 1 directory (Bump @tootallnate/once from 2.0.0 to 2.0.1 in the npm_and_yarn group across 1 directory #1070)

Bumps the npm_and_yarn group with 1 update in the / directory: @tootallnate/once.

Updates @tootallnate/once from 2.0.0 to 2.0.1

updated-dependencies:

dependency-name: "@tootallnate/once" dependency-version: 2.0.1 dependency-type: indirect dependency-group: npm_and_yarn ...

Bump ws in the npm_and_yarn group across 1 directory (Bump ws from 8.20.0 to 8.20.1 in the npm_and_yarn group across 1 directory #1071)

Bumps the npm_and_yarn group with 1 update in the / directory: ws.

Updates ws from 8.20.0 to 8.20.1

updated-dependencies:

dependency-name: ws dependency-version: 8.20.1 dependency-type: indirect dependency-group: npm_and_yarn ...

Bump qs in the npm_and_yarn group across 1 directory (Bump qs from 6.15.1 to 6.15.2 in the npm_and_yarn group across 1 directory #1072)

Bumps the npm_and_yarn group with 1 update in the / directory: qs.

Updates qs from 6.15.1 to 6.15.2

updated-dependencies:

dependency-name: qs dependency-version: 6.15.2 dependency-type: indirect dependency-group: npm_and_yarn ...

Bump @grpc/grpc-js in the npm_and_yarn group across 1 directory (Bump @grpc/grpc-js from 1.14.3 to 1.14.4 in the npm_and_yarn group across 1 directory #1074)

Bumps the npm_and_yarn group with 1 update in the / directory: @grpc/grpc-js.

Updates @grpc/grpc-js from 1.14.3 to 1.14.4

updated-dependencies:

dependency-name: "@grpc/grpc-js" dependency-version: 1.14.4 dependency-type: indirect dependency-group: npm_and_yarn ...

Bump the npm_and_yarn group across 1 directory with 3 updates (Bump the npm_and_yarn group across 1 directory with 3 updates #1080)

Bumps the npm_and_yarn group with 3 updates in the / directory: form-data, undici and ws.

Updates form-data from 2.5.5 to 2.5.6

Updates undici from 7.25.0 to 7.28.0

Updates ws from 8.20.1 to 8.21.0

updated-dependencies:

dependency-name: form-data dependency-version: 2.5.6 dependency-type: indirect dependency-group: npm_and_yarn
dependency-name: undici dependency-version: 7.28.0 dependency-type: indirect dependency-group: npm_and_yarn
dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect dependency-group: npm_and_yarn ...

Upgrade cucumber to resolve tmp dependency with security problem (Upgrade cucumber version to fix insecure tmp dependency #1079)
Bump @opentelemetry/core in the npm_and_yarn group across 1 directory (Bump @opentelemetry/core from 2.0.1 to 2.8.0 in the npm_and_yarn group across 1 directory #1081)

Bumps the npm_and_yarn group with 1 update in the / directory: @opentelemetry/core.

Updates @opentelemetry/core from 2.0.1 to 2.8.0

updated-dependencies:

dependency-name: "@opentelemetry/core" dependency-version: 2.8.0 dependency-type: indirect dependency-group: npm_and_yarn ...

Update protobufjs to address security warning (Update protobufjs to address security warning #1082)

Bumps the npm_and_yarn group with 1 update in the / directory: [ip-address](https://github.com/beaugunderson/ip-address). Updates `ip-address` from 9.0.5 to 10.2.0 - [Commits](https://github.com/beaugunderson/ip-address/commits) --- updated-dependencies: - dependency-name: ip-address dependency-version: 10.2.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the npm_and_yarn group with 2 updates in the / directory: [basic-ftp](https://github.com/patrickjuchli/basic-ftp) and [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder). Updates `basic-ftp` from 5.3.0 to 5.3.1 - [Release notes](https://github.com/patrickjuchli/basic-ftp/releases) - [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md) - [Commits](patrickjuchli/basic-ftp@v5.3.0...v5.3.1) Updates `fast-xml-builder` from 1.1.5 to 1.2.0 - [Changelog](https://github.com/NaturalIntelligence/fast-xml-builder/blob/main/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-builder@v1.1.5...v1.2.0) --- updated-dependencies: - dependency-name: basic-ftp dependency-version: 5.3.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-xml-builder dependency-version: 1.2.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…1068) Bumps the npm_and_yarn group with 1 update in the / directory: [@protobufjs/utf8](https://github.com/dcodeIO/protobuf.js). Updates `@protobufjs/utf8` from 1.1.0 to 1.1.1 - [Release notes](https://github.com/dcodeIO/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-cli-v1.1.0...protobufjs-cli-v1.1.1) --- updated-dependencies: - dependency-name: "@protobufjs/utf8" dependency-version: 1.1.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the npm_and_yarn group with 1 update in the / directory: [protobufjs](https://github.com/protobufjs/protobuf.js). Updates `protobufjs` from 7.5.5 to 7.5.8 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.5.8/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-v7.5.5...protobufjs-v7.5.8) --- updated-dependencies: - dependency-name: protobufjs dependency-version: 7.5.8 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…1070) Bumps the npm_and_yarn group with 1 update in the / directory: [@tootallnate/once](https://github.com/TooTallNate/once). Updates `@tootallnate/once` from 2.0.0 to 2.0.1 - [Release notes](https://github.com/TooTallNate/once/releases) - [Changelog](https://github.com/TooTallNate/once/blob/v2.0.1/CHANGELOG.md) - [Commits](TooTallNate/once@2.0.0...v2.0.1) --- updated-dependencies: - dependency-name: "@tootallnate/once" dependency-version: 2.0.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the npm_and_yarn group with 1 update in the / directory: [ws](https://github.com/websockets/ws). Updates `ws` from 8.20.0 to 8.20.1 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.20.0...8.20.1) --- updated-dependencies: - dependency-name: ws dependency-version: 8.20.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs). Updates `qs` from 6.15.1 to 6.15.2 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.1...v6.15.2) --- updated-dependencies: - dependency-name: qs dependency-version: 6.15.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the npm_and_yarn group with 1 update in the / directory: [@grpc/grpc-js](https://github.com/grpc/grpc-node). Updates `@grpc/grpc-js` from 1.14.3 to 1.14.4 - [Release notes](https://github.com/grpc/grpc-node/releases) - [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.14.3...@grpc/grpc-js@1.14.4) --- updated-dependencies: - dependency-name: "@grpc/grpc-js" dependency-version: 1.14.4 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the npm_and_yarn group with 3 updates in the / directory: [form-data](https://github.com/form-data/form-data), [undici](https://github.com/nodejs/undici) and [ws](https://github.com/websockets/ws). Updates `form-data` from 2.5.5 to 2.5.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v2.5.5...v2.5.6) Updates `undici` from 7.25.0 to 7.28.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.25.0...v7.28.0) Updates `ws` from 8.20.1 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.20.1...8.21.0) --- updated-dependencies: - dependency-name: form-data dependency-version: 2.5.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.28.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…#1081) Bumps the npm_and_yarn group with 1 update in the / directory: [@opentelemetry/core](https://github.com/open-telemetry/opentelemetry-js). Updates `@opentelemetry/core` from 2.0.1 to 2.8.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.0.1...v2.8.0) --- updated-dependencies: - dependency-name: "@opentelemetry/core" dependency-version: 2.8.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Pin GitHub action SHA's (#1066) * Bump ip-address in the npm_and_yarn group across 1 directory (#1065) Bumps the npm_and_yarn group with 1 update in the / directory: [ip-address](https://github.com/beaugunderson/ip-address). Updates `ip-address` from 9.0.5 to 10.2.0 - [Commits](https://github.com/beaugunderson/ip-address/commits) --- updated-dependencies: - dependency-name: ip-address dependency-version: 10.2.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump the npm_and_yarn group across 1 directory with 2 updates (#1067) Bumps the npm_and_yarn group with 2 updates in the / directory: [basic-ftp](https://github.com/patrickjuchli/basic-ftp) and [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder). Updates `basic-ftp` from 5.3.0 to 5.3.1 - [Release notes](https://github.com/patrickjuchli/basic-ftp/releases) - [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md) - [Commits](patrickjuchli/basic-ftp@v5.3.0...v5.3.1) Updates `fast-xml-builder` from 1.1.5 to 1.2.0 - [Changelog](https://github.com/NaturalIntelligence/fast-xml-builder/blob/main/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-builder@v1.1.5...v1.2.0) --- updated-dependencies: - dependency-name: basic-ftp dependency-version: 5.3.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-xml-builder dependency-version: 1.2.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump @protobufjs/utf8 in the npm_and_yarn group across 1 directory (#1068) Bumps the npm_and_yarn group with 1 update in the / directory: [@protobufjs/utf8](https://github.com/dcodeIO/protobuf.js). Updates `@protobufjs/utf8` from 1.1.0 to 1.1.1 - [Release notes](https://github.com/dcodeIO/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-cli-v1.1.0...protobufjs-cli-v1.1.1) --- updated-dependencies: - dependency-name: "@protobufjs/utf8" dependency-version: 1.1.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump protobufjs in the npm_and_yarn group across 1 directory (#1069) Bumps the npm_and_yarn group with 1 update in the / directory: [protobufjs](https://github.com/protobufjs/protobuf.js). Updates `protobufjs` from 7.5.5 to 7.5.8 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.5.8/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-v7.5.5...protobufjs-v7.5.8) --- updated-dependencies: - dependency-name: protobufjs dependency-version: 7.5.8 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump @tootallnate/once in the npm_and_yarn group across 1 directory (#1070) Bumps the npm_and_yarn group with 1 update in the / directory: [@tootallnate/once](https://github.com/TooTallNate/once). Updates `@tootallnate/once` from 2.0.0 to 2.0.1 - [Release notes](https://github.com/TooTallNate/once/releases) - [Changelog](https://github.com/TooTallNate/once/blob/v2.0.1/CHANGELOG.md) - [Commits](TooTallNate/once@2.0.0...v2.0.1) --- updated-dependencies: - dependency-name: "@tootallnate/once" dependency-version: 2.0.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump ws in the npm_and_yarn group across 1 directory (#1071) Bumps the npm_and_yarn group with 1 update in the / directory: [ws](https://github.com/websockets/ws). Updates `ws` from 8.20.0 to 8.20.1 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.20.0...8.20.1) --- updated-dependencies: - dependency-name: ws dependency-version: 8.20.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump qs in the npm_and_yarn group across 1 directory (#1072) Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs). Updates `qs` from 6.15.1 to 6.15.2 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.1...v6.15.2) --- updated-dependencies: - dependency-name: qs dependency-version: 6.15.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump @grpc/grpc-js in the npm_and_yarn group across 1 directory (#1074) Bumps the npm_and_yarn group with 1 update in the / directory: [@grpc/grpc-js](https://github.com/grpc/grpc-node). Updates `@grpc/grpc-js` from 1.14.3 to 1.14.4 - [Release notes](https://github.com/grpc/grpc-node/releases) - [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.14.3...@grpc/grpc-js@1.14.4) --- updated-dependencies: - dependency-name: "@grpc/grpc-js" dependency-version: 1.14.4 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump the npm_and_yarn group across 1 directory with 3 updates (#1080) Bumps the npm_and_yarn group with 3 updates in the / directory: [form-data](https://github.com/form-data/form-data), [undici](https://github.com/nodejs/undici) and [ws](https://github.com/websockets/ws). Updates `form-data` from 2.5.5 to 2.5.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v2.5.5...v2.5.6) Updates `undici` from 7.25.0 to 7.28.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.25.0...v7.28.0) Updates `ws` from 8.20.1 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.20.1...8.21.0) --- updated-dependencies: - dependency-name: form-data dependency-version: 2.5.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.28.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Upgrade cucumber to resolve tmp dependency with security problem (#1079) * Bump @opentelemetry/core in the npm_and_yarn group across 1 directory (#1081) Bumps the npm_and_yarn group with 1 update in the / directory: [@opentelemetry/core](https://github.com/open-telemetry/opentelemetry-js). Updates `@opentelemetry/core` from 2.0.1 to 2.8.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.0.1...v2.8.0) --- updated-dependencies: - dependency-name: "@opentelemetry/core" dependency-version: 2.8.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Update protobufjs to address security warning (#1082) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Merge to staging

The merge commit d1d6371 (Merge pull request #1089 from 18F/develop) re-resolved package-lock.json incorrectly, reintroducing a root dependencies entry "newrelic": "14.1.1" that commit 0acdcc7 had removed on develop. This realigns the lockfile with develop; the legitimate optionalDependencies.newrelic entry is retained.

sanason and others added 15 commits May 11, 2026 16:41

Pin GitHub action SHA's (#1066)

bf09ba3

Upgrade cucumber to resolve tmp dependency with security problem (#1079)

a287fdd

Update protobufjs to address security warning (#1082)

5d20ad6

Merge branch 'staging' into develop

c41ee75

sanason changed the title ~~Merge to staging (#1085)~~ Merge to production (#1085) Jul 1, 2026

sanason added 3 commits July 1, 2026 14:18

Forgot to update lock file (#1088)

0acdcc7

Merge pull request #1089 from 18F/develop

d1d6371

Merge to staging

sanason changed the title ~~Merge to production (#1085)~~ Promote staging to master (#1085) Jul 1, 2026

sanason merged commit fddcb12 into master Jul 1, 2026
22 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Promote staging to master (#1085)#1087

Promote staging to master (#1085)#1087
sanason merged 18 commits into
masterfrom
staging

sanason commented Jul 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

sanason commented Jul 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant