From 7cafd6e1a6253ab9ac9f96f841d7feb019734450 Mon Sep 17 00:00:00 2001 From: wenyutang-ms Date: Thu, 6 Aug 2026 14:14:32 +0800 Subject: [PATCH 1/2] Revert "chore(deps-dev): Bump fast-uri from 3.1.4 to 3.1.5 (#1050)" This reverts commit c3793fe209ae458bc8bba4e0fffb798fe5728716. --- package-lock.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index aa6183e8..a087b369 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1750,9 +1750,9 @@ } }, "node_modules/fast-uri": { - "version": "3.1.5", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz", - "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==", + "version": "3.1.4", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", + "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", "dev": true, "funding": [ { @@ -5464,9 +5464,9 @@ } }, "fast-uri": { - "version": "3.1.5", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz", - "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==", + "version": "3.1.4", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", + "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", "dev": true }, "fastest-levenshtein": { From 2bed245dacb183017cbdbb7f8ecc33e7dc39f53b Mon Sep 17 00:00:00 2001 From: wenyutang-ms Date: Thu, 6 Aug 2026 14:15:35 +0800 Subject: [PATCH 2/2] build: delay Dependabot updates for CFS availability --- .github/dependabot.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f55afd44..8cc8a033 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,7 +5,15 @@ version: 2 updates: - - package-ecosystem: "" # See documentation for possible values + - package-ecosystem: "npm" # See documentation for possible values directory: "/" # Location of package manifests schedule: interval: "daily" + # CI restores packages from the Central Feed Service, which withholds + # upstream versions until they are roughly a week old (measured at ~6.8 + # days; both the packument entry and the tarball return 404 before then). + # Dependabot's built-in cooldown is only 3 days, so bumps otherwise land in + # a window where the feed 404s and the build fails. 10 days leaves margin + # in case the feed's ingestion lag drifts. + cooldown: + default-days: 10