Pact Foundation

I noticed that the `@pact-foundation/pact-cli` package is triggering CVEs about `minimatch`. Is there a way that I can assist with some dependency updates, so I don't have to add an `overrides` block to the packages that are referencing it?

hey hey, they should usually be covered by renovate but feel free to drop in a pull request, looks like a few haven’t been merged in a while. assistance is greatly appreciated

<https://github.com/pact-foundation/pact-js-cli|https://github.com/pact-foundation/pact-js-cli>

Would you like PRs that target single dependencies or do you want me to batch a bunch of updates together in one PR?

it will be easier to do them in a single batch, so if that is your preference that is okay. there is a decent test suite that should catch any regressions 

I'm willing to do it either way. :slightly_smiling_face: I just want to play nice.

thanks man, appreciate that. we don’t have auto release on merge to main so i’ll just release a batch anyway. we aren’t strongly opinionated, whatever works for the contributor is okay

btw i did re-enable dependabot security pr’s whilst we were chatting. i thought renovate would have picked them up but I don’t think it covers transient deps. i can see one for minimatch now

Awesome, thanks folks. We’ll get it merged and released asap

<@UELMFD9PG> FYI I recently modified `pact-core` and `pact-js` to use the trusted publishing workflow to avoid having to continually cycle tokens (it also means we can drop the work to create local `.npmrc` filesetc.). I’ll enable it on that repo now, but let’s get this out first and then fix so <@U0AGQFPJ01H> can get the updates

dependabot pull reqs merged, and released now. trusted pub workflow would be a nice addition. cheers Matt. Thanks for raising <@U0AGQFPJ01H>, hopefully your scanner should be clear now

(Oh, I already enabled it on npm it seems - just need to update the workflow files)