8000 Update ast-grep to 0.50.0 by gominimal-pkgmgr-mgr[bot] · Pull Request #870 · gominimal/pkgs · GitHub
[go: up one dir, main page]

Skip to content

Update ast-grep to 0.50.0 - #870

Merged
bryan-minimal merged 1 commit into
mainfrom
update-ast-grep-0.50.0
Oct 14, 2026
Merged

bryan-minimal merged 1 commit into
mainfrom
update-ast-grep-0.50.0

Conversation

@gominimal-pkgmgr-mgr
Copy link
Copy Markdown
Contributor

Update ast-grep 0.45.3 → 0.50.0

Source: github:ast-grep/ast-grep
Release: https://github.com/ast-grep/ast-grep/releases/tag/0.50.0
Changelog: ast-grep/ast-grep@0.45.3...0.50.0
Released: 4 days ago (2026-10-09)

Pkgscan: clean — diff against the prior version surfaced no newly-introduced suspicious patterns.

Vulnerability impact

Partition analysis at 0.50.0 (uses each advisory's fixed-version, vulnerable-range, affected-ranges, and fix-commit ancestry to decide):

  • 2 cleared — the new version is outside the advisory's affected range, OR the tag's lineage includes a known fix-commit. These will drop off the next scan.

Vulnerabilities fixed (2)

This update clears 2 vulnerabilities affecting 0.45.3:

CVE / GHSA Severity Fixed in
GHSA-xx6h-xcfw-vf5j CRITICAL 0.50.0
GHSA-cmvf-x8f7-rvp6 HIGH 0.50.0

Components changed

CycloneDX component delta (declared materials — the package's own version, not a dependency-tree diff)
Component Old New
~ ast-grep 0.45.3 0.50.0
~ ast-grep-upstream 0.45.3 0.50.0

Changes

Old New
Version 0.45.3 0.50.0
SHA256 0ad252ce2535493e... 530ecaf2d9d048bd...
Size 599 KB
Source https://github.com/ast-grep/ast-grep/archive/refs/tags/0.45.3.tar.gz https://github.com/ast-grep/ast-grep/archive/refs/tags/0.50.0.tar.gz
  • License: MIT (source: GitHub + tarball)

Quality suggestions

  • Missing tests block. This package has no standalone tests, so the buildbot will only verify compilation — not functional correctness. Consider adding a minimal smoke test (e.g., a --version or small round-trip invocation) as part of this PR so future bumps catch regressions. See packages/python/build.ncl for a simple example.

Created by pkgmgr

@gominimal-pkgmgr-mgr
gominimal-pkgmgr-mgr Bot requested a review from a team as a code owner October 14, 2026 05:39
@gominimal-pkgmgr-mgr gominimal-pkgmgr-mgr Bot added the auto-update Opened autonomously by pkgmgr auto-update label Oct 14, 2026
@coderabbitai
coderabbitai Bot commented Oct 14, 2026
Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Repository: gominimal/pkgs/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 8b4bd275-3c8a-4500-9a9b-a1886499eb13

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@bryan-minimal
bryan-minimal added this pull request to the merge queue Oct 14, 2026
Merged via the queue into main with commit 55bb002 Oct 14, 2026
11 checks passed
@bryan-minimal
bryan-minimal deleted the update-ast-grep-0.50.0 branch October 14, 2026 22:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

auto-update Opened autonomously by pkgmgr auto-update

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

0