[Snyk] Upgrade @octokit/core from 3.6.0 to 6.1.2

[nerdy-tech-com-gitub]

Snyk has created this PR to upgrade @octokit/core from 3.6.0 to 6.1.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

• The recommended version is 33 versions ahead of your current version.

• The recommended version was released on 8 months ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Regular Expression Denial of Service (ReDoS) SNYK-JS-CROSSSPAWN-8303230	169	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHTOREGEXP-7925106	169	Proof of Concept

Release notes

Package name: @octokit/core

• 6.1.2 - 2024-04-09
  

  6.1.2 (2024-04-09)

  Bug Fixes

  • pkg: add default fallback and types export (#673) (af3d390), closes #665 #667
• 6.1.1 - 2024-04-03
  

  6.1.1 (2024-04-03)

  Bug Fixes

  • deps: update dependency @ octokit/types to v13 (ade2813)
• 6.1.0 - 2024-04-03
  

  6.1.0 (2024-04-03)

  Features

  • security: Add provenance (#671) (1c2bd25)
• 6.0.1 - 2024-02-26
  

  6.0.1 (2024-02-26)

  Bug Fixes

  • pkg: add main entry point (#662) (42148fc)
• 6.0.0 - 2024-02-25
  

  6.0.0 (2024-02-25)

  Features

  • package is now ESM (#661) (77f8a61)

  BREAKING CHANGES

  • package is now ESM
• 6.0.0-beta.5 - 2024-02-25
  

  6.0.0-beta.5 (2024-02-25)

  Bug Fixes

  • empty commit to trigger release (4ce6c63)
• 6.0.0-beta.4 - 2024-02-25
  

  6.0.0-beta.4 (2024-02-25)

  Bug Fixes

  • build: correct path (6a4ce19)
• 6.0.0-beta.3 - 2024-02-25
  

  6.0.0-beta.3 (2024-02-25)

  Bug Fixes

  • build: adapt for ESM (1509917)
• 6.0.0-beta.2 - 2024-02-25
• 6.0.0-beta.1 - 2024-02-24
• 5.2.0 - 2024-04-05
  

  5.2.0 (2024-04-05)

  Features

  • security: Add provenance (#671) (0e2915b)
• 5.1.1 - 2024-04-05
  

  5.1.1 (2024-04-05)

  Bug Fixes

  • deps: upgrade @ octokit/types to v13 (260e360)
• 5.1.0 - 2024-01-20
• 5.0.2 - 2023-11-22
• 5.0.1 - 2023-09-23
• 5.0.0 - 2023-07-10
• 5.0.0-beta.5 - 2023-07-07
• 5.0.0-beta.4 - 2023-06-18
• 5.0.0-beta.3 - 2023-06-16
• 5.0.0-beta.2 - 2023-06-03
• 5.0.0-beta.1 - 2023-05-21
• 4.2.4 - 2023-06-16
• 4.2.3 - 2023-06-16
• 4.2.2 - 2023-06-16
• 4.2.1 - 2023-05-18
• 4.2.0 - 2023-01-20
• 4.1.0 - 2022-10-13
• 4.0.5 - 2022-08-15
• 4.0.4 - 2022-07-08
• 4.0.3 - 2022-07-08
• 4.0.2 - 2022-07-07
• 4.0.1 - 2022-07-07
• 4.0.0 - 2022-07-07
• 3.6.0 - 2022-03-13

from @octokit/core GitHub release notes

---

Important

• Warning: This PR contains a major version upgrade, and may be a breaking change.
• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Summary by Sourcery

Build:

• Upgrade @octokit/core dependency from version 3.5.1 to 6.1.2 in package.json.

[sourcery-ai]

Reviewer's Guide by Sourcery

This PR upgrades the @octokit/core dependency from version 3.6.0 to 6.1.2 to address security vulnerabilities. The upgrade includes a major version change (v3 to v6) which introduces breaking changes, most notably the package becoming ESM-only. The update fixes two security issues: a high-severity ReDoS vulnerability in cross-spawn and a medium-severity ReDoS vulnerability in path-to-regexp.

Class diagram for @octokit/core upgrade

classDiagram
    class OctokitCore {
        - version: String
        + constructor()
        + request()
        + authenticate()
    }

    class OctokitCoreV3 {
        - version: "3.6.0"
        + constructor()
        + request()
        + authenticate()
    }

    class OctokitCoreV6 {
        - version: "6.1.2"
        + constructor()
        + request()
        + authenticate()
        + esmOnly: Boolean
    }

    OctokitCore <|-- OctokitCoreV3
    OctokitCore <|-- OctokitCoreV6

    note for OctokitCoreV6 "The package is now ESM-only, which is a breaking change."

Loading

File-Level Changes

Change	Details	Files
Dependency version upgrade in package.json	Updated @octokit/core version constraint from ^3.5.1 to ^6.1.2	packages/artifact/package.json
Breaking changes from @octokit/core major version upgrade	Package is now ESM-only (v6.0.0) Added package provenance support (v6.1.0) Added default fallback and types export (v6.1.2)	packages/artifact/package.json
Security vulnerability fixes	Fixed high-severity ReDoS vulnerability in cross-spawn dependency Fixed medium-severity ReDoS vulnerability in path-to-regexp dependency	packages/artifact/package.json

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time. You can also use
  this command to specify where the summary should be inserted.

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

We have skipped reviewing this pull request. Here's why:

• It seems to have been created by a bot ('[Snyk]' found in title). We assume it knows what it's doing!
• We don't review packaging changes - Let us know if you'd like us to change this.