Reporting the same security issue to pnpm vs bun:
pnpm acknowledged it quickly, shipped a fix, backported it, and published an advisory.
bun never acknowledged, silently fixed this and another issue I reported, has not published advisories.
One takes security more seriously.
Also added an `npx gagen --pull-versions` command to sync the version constraints in the TypeScript files with the .yml files after dependabot updates them. More details, including limitations, here: github.com/dsherret/gag...
Or alternatively, use the new `$.all` function.
The latest version of dax (dax.land) can show a scrolling view of the last N lines when executing a command. This is especially useful when running multiple commands in parallel.
It works well with progress bars, selection, and other features that dax provides.
beautiful new docs site at dax.land for @dsherret.bsky.social's dax, one of my very favorite tools. I write nearly all my scripts in TypeScript because of it
Released gagen 0.5, which simplifies the output to match dependabot.
Also, the cross-platform shell has been extracted to a dedicated JSR package jsr.io/@david/shell
Video
Video
What's Changed
feat: store pin comment inline by @dsherret in #37
feat: add npx gagen --pull-versions by @dsherret in #38
Inline pin comments (#37)
The pin lockfile moved from a trailing # gagen:...
I've found maintaining GitHub Actions workflow files is much easier when it's generated from Typescript.
The latest realization is that the output yaml file can act like a lockfile. So I maintain `actions/checkout@v6`, but the generated output gets locked to a hash.
