dependabot[bot] opened a new pull request, #153: URL: https://github.com/apache/fineract-backoffice-ui/pull/153
Bumps [eslint-plugin-sonarjs](https://github.com/SonarSource/SonarJS) from 4.0.2 to 4.2.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/SonarSource/SonarJS/blob/master/docs/RELEASE.md";>eslint-plugin-sonarjs's changelog</a>.</em></p> <blockquote> <h1>Release Guide</h1> <p>SonarJS currently has two distinct release targets:</p> <table> <thead> <tr> <th>Target</th> <th>Artifact</th> <th>Main workflow</th> <th>Notes</th> </tr> </thead> <tbody> <tr> <td>Standard SonarQube analyzer</td> <td>Maven/JAR release artifacts</td> <td><code>.github/workflows/automated-release.yml</code></td> <td>This is the normal SonarJS release flow.</td> </tr> <tr> <td>SQAA (previously A3S)</td> <td>Docker image for <code>LanguageAnalyzerService</code></td> <td><code>.github/workflows/docker-sqaa.yml</code></td> <td>Manual SQAA-only entry point and fallback.</td> </tr> </tbody> </table> <h2>Terminology</h2> <ul> <li><code>SQAA</code> is the current name for what older docs and repository names still call <code>A3S</code>.</li> <li>Some external identifiers still keep the legacy <code>a3s</code> name for compatibility. The important ones are: <ul> <li>the Docker repository path <code>a3s/analysis/javascript</code></li> <li><code>packages/grpc/src/proto/language_analyzer.proto</code> with <code>option java_package = "com.sonarsource.a3s.analyzer.grpc";</code></li> </ul> </li> <li>Do not rename those compatibility-sensitive identifiers as part of a routine release.</li> </ul> <h2>Standard SonarQube Analyzer Release</h2> <p>This is the regular SonarJS analyzer release. It produces the standard SonarQube analyzer artifacts and can also automate the SQAA handoff using the same build number.</p> <h3>Entry points</h3> <ol> <li>Start <code>.github/workflows/automated-release.yml</code>.</li> <li>That workflow orchestrates the release and then calls <code>.github/workflows/release.yml</code> for the actual artifact publication.</li> <li>After the release succeeds, <code>.github/workflows/bump-versions.yml</code> opens the next development iteration PR.</li> </ol> <h3>What <code>.github/workflows/automated-release.yml</code> does</h3> <p>The SonarJS workflow is a thin wrapper around <code>SonarSource/release-github-actions/.github/workflows/automated-release.yml@v1</code> with SonarJS-specific inputs:</p> <ul> <li>project name <code>SonarJS</code></li> <li>plugin name <code>javascript</code></li> <li>Jira project <code>JS</code></li> <li>optional SQC and SQS integration PRs</li> <li>optional SQAA integration, enabled in the SonarJS wrapper and implemented by a custom local workflow</li> <li>SLVS, SLVSCODE, SLE, and SLI integration tickets enabled</li> <li>the generic <code>release-github-actions</code> SQAA integration explicitly disabled, because SonarJS uses <code>analysis/js_ts_image_tag</code> instead of <code>gradle/sonar-plugins.versions.toml</code></li> </ul> <p>The reusable workflow performs the following steps:</p> <ol> <li>Freeze the target branch.</li> <li>Run the releasability checks with <code>SonarSource/gh-action_releasability@v3</code>.</li> <li>Resolve the release version with <code>get-release-version</code>.</li> <li>Resolve the Jira version with <code>get-jira-version</code>.</li> <li>Generate Jira-based release notes with <code>get-jira-release-notes</code> unless explicit notes were provided.</li> <li>Create the REL Jira ticket with <code>create-jira-release-ticket</code>.</li> <li>Publish the GitHub release with <code>publish-github-release</code>.</li> <li>Unfreeze the branch.</li> <li>Release the Jira version, create the next Jira version, and move the REL ticket to <code>Technical Release Done</code>.</li> </ol> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/SonarSource/SonarJS/commits";>compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions";>GitHub Actions</a>, a new releaser for eslint-plugin-sonarjs since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
