build(deps-dev): bump brace-expansion from 5.0.7 to 5.0.12 #2517

	# Based on https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/automating-dependabot-with-github-actions#enable-auto-merge-on-a-pull-request
Check warning on line 1 in .github/workflows/dependabot-automerge.yml View workflow run for this annotation GitHub Actions / Dependabot auto-merge Workflow execution policy warning (evaluate mode) On November 2, 2026, GitHub will restrict `pull_request_target` on public repositories by default. To continue allowing the event trigger, configure an Actions policy. Learn more: https://gh.io/securely-using-pull_request_target#default-policy-for-pull_request_target
	name: Dependabot auto-merge
	on: pull_request_target

	permissions:
	pull-requests: write
	contents: write

	jobs:
	dependabot:
	runs-on: ubuntu-latest
	if: ${{ github.actor == 'dependabot[bot]' }}
	steps:
	- name: Dependabot metadata
	id: metadata
	uses: dependabot/fetch-metadata@v3.1.0
	with:
	github-token: "${{ secrets.GITHUB_TOKEN }}"
	- name: Enable auto-merge for Dependabot PRs
	# Automatically merge semver-patch and semver-minor PRs
	if: "${{ steps.metadata.outputs.update-type ==
	'version-update:semver-minor' \|\|
	steps.metadata.outputs.update-type ==
	'version-update:semver-patch' }}"
	run: gh pr merge --auto --squash "$PR_URL"
	env:
	PR_URL: ${{github.event.pull_request.html_url}}
	GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

Navigation Menu