skilldrop-cli 0.16.30 → 0.16.32

package/packs/dev-team/skills/dependency-upgrade-review/evals/evals.json

@@ -12,6 +12,7 @@
         "Says the green CI does not cover the change: the only test renders Markdown with no raw HTML, and no test imports src/render/comment.js",
         "Accounts for the skipped releases, not only 4.1.0: names the 3.5.0 link-title security fix and the setOptions() deprecation that src/render/note.js still uses",
         "Gives a rollback that pins quillmark back and regenerates package-lock.json (or reverts the PR), and names taking 3.5.x as the way to get the security fix without the breaking changes",
+        "Opens with the verdict and the decisive reasons (the removed renderInline() call and the sanitize default) in plain words before any list, keeps the lockfile changes to a line or a short list rather than a table, and does not describe the session's network or tool access",
         "Does not invent versions, advisory IDs, APIs, files or tests that are not in the supplied input"
       ]
     },
@@ -26,6 +27,7 @@
         "Reports that release.yml still passes the deprecated password input (release.yml line 22) and that verify-metadata now defaults to true, so the next release can fail on an invalid long description",
         "Classes the jumps: checkout-lite v3.1.0 to v3.2.0 as minor, pypi-publish v2 to v3 as major",
         "Gives a rollback (revert the PR or restore the old uses: lines) and notes a revert cannot undo a release already published to PyPI with v3",
+        "Does not report either SHA or the tag move as verified, and does not explain the gap by describing the session's network or tool access; it gives the command and the SHA it must equal instead",
         "Does not invent action versions, SHAs, inputs or workflow steps that are not in the supplied files"
       ]
     },
@@ -40,6 +42,7 @@
         "Flags github.com/lanternhq/clock v1.2.0 as a new indirect module the PR title does not mention",
         "Says the passing CI only covers this if a test exercises the burst-0 Wait path, and lists that as a check rather than assuming it",
         "Gives a rollback command such as go get github.com/lanternhq/ratelimit@v0.8.3 followed by go mod tidy, or reverting the PR",
+        "Stays short, as the user asked for a quick verdict: the verdict and its reasons come first, and there is no package table and no empty section",
         "Does not invent file names, call sites, tests or release versions that are not in the prompt"
       ]
     },
@@ -72,6 +75,36 @@
         "Explains that the green checks never ran the changed code. ci.yml runs on pull_request with `npm ci --ignore-scripts` and never runs scripts/release.mjs. release.yml runs plain `npm ci`, so notary-telemetry's install script would first execute in the production environment, with RELEASE_SIGNING_KEY and NPM_TOKEN in the job and contents: write / id-token: write permissions. Mentions NOTARY_TELEMETRY=0 and/or keeping 1.8.x as mitigations.",
         "Gives a rollback for each PR: revert #412 to restore the c8aee2ae521bdb1ef1b97761673ebbe92c953b0f (v3.2.0) pins; revert #413, or pin release-notary back to 1.8.2 and regenerate package-lock.json. Does not invent versions, flags or APIs that are not in the files, and does not claim to have run npm install, the workflows, or the release script."
       ]
+    },
+    {
+      "id": 6,
+      "held_out": "2026-10-20",
+      "prompt": "Dependabot opened PR #412 on our payments-gateway service bumping github.com/fernwire/httpkit from 1.8.1 to 1.8.4. It's only a patch bump and every check is green, so I'd like to merge it before the release cut this afternoon. Can I merge this dependency upgrade? The PR body is in PR.md, the diff is pr.diff, and I pasted the upstream changelog into vendor-notes/httpkit-CHANGELOG.md. The repo source is checked out here.",
+      "assertions": [
+        "Picks out the v1.8.3 entry in vendor-notes/httpkit-CHANGELOG.md (a version the Dependabot release notes in PR.md leave out): NewClient no longer applies a default 30-second Timeout, and the zero value now means no client-level timeout. It treats this as the key finding even though the bump looks like a patch.",
+        "Points to internal/payments/client.go NewClient, which calls httpkit.NewClient with only WithBaseURL and WithRetries and whose comment says it relies on the 30s default (INC-2291), and to internal/payments/settle.go, which calls Charge with context.Background() and no deadline. So after the upgrade a hung gateway can block the settlement batch indefinitely. It also notes that internal/notify/client.go sets WithTimeout(5*time.Second) explicitly and is unaffected.",
+        "Explains that the green CI does not test this change: client_test.go injects fakeDoer, so the real httpkit client is never exercised, and ci.yml runs `go test -race -short ./...` without `-tags integration`, so client_integration_test.go (TestChargeHungGatewayTimesOut) did not run on this PR. It runs only nightly or on manual dispatch via integration.yml.",
+        "Gives a verdict of DO NOT MERGE as-is, or MERGE AFTER CHECKS on the specific condition that payments NewClient gains an explicit httpkit.WithTimeout(30*time.Second) (or a per-call context deadline in SettleBatch) and the integration test passes. It is never plain MERGE.",
+        "Lists the go.mod/go.sum changes the PR title does not mention: indirect github.com/fernwire/backoff v0.3.0 -> v0.4.0 and a newly added indirect github.com/fernwire/otelshim v0.1.0. It ties them to the v1.8.2 (backoff, full-jitter) and v1.8.4 (WithTracer) changelog entries rather than calling them unexplained.",
+        "Gives a concrete rollback: revert the merge commit, or `go get github.com/fernwire/httpkit@v1.8.1 && go mod tidy`, which also returns backoff to v0.3.0 and drops otelshim. It notes that adding the explicit WithTimeout is safe to keep on either version.",
+        "Does not claim to have run tests or verified the go.sum hashes or upstream tags. It gives the network or execution steps as commands to run (for example `go mod verify`, `go test -tags integration -run TestChargeHungGatewayTimesOut ./internal/payments/`, or triggering integration.yml via workflow_dispatch).",
+        "Invents no httpkit versions, options or behaviours beyond those in the files (for example no made-up v1.8.5, no claimed retry-on-POST change, no options other than WithBaseURL, WithRetries, WithTimeout and WithTracer)."
+      ]
+    },
+    {
+      "id": 7,
+      "held_out": "2026-10-20",
+      "prompt": "Renovate grouped this week's dev dependency updates into PR #88 for our invoice-widgets package: five npm packages in one go (details in PR.md, diff in pr.diff). After last quarter's incident with a grouped bump I'm nervous about these. Is this Renovate bump safe to merge, or should I split it up? Repo files are here.",
+      "assertions": [
+        "Ends with a verdict of MERGE. It does not downgrade to MERGE AFTER CHECKS or DO NOT MERGE over problems the files do not contain (for example an install script, a registry change, a maintainer change, or a breaking change that affects this repo), and it does not insist on splitting the PR without a concrete reason from the files.",
+        "Checks bundlecrate 6.1.0's new Node >=18.18 minimum against the repo and finds it harmless: .nvmrc is 20.11.1, package.json engines is node >=20, and ci.yml uses node-version-file: .nvmrc.",
+        "Checks the repo's uses of the changed APIs and finds nothing that needs action. vellum-test 2.8.0 deprecates vt.legacyTimers(), but tests/due-date.test.ts uses only vt.fakeTimers/vt.restoreTimers. lintwright 4.3.0's new no-floating-promise rule is only in lintwright:strict, while .lintwright.json extends lintwright:recommended.",
+        "Lists the lockfile changes beyond the five headline bumps: @bundlecrate/resolver-core 1.0.0 added, bundlecrate-legacy-resolver 2.3.4 removed, and the transitive picolabel 0.9.1 -> 0.9.2. It ties each to a changelog entry (bundlecrate 6.1.0 resolver extraction, lintwright 4.3.0 picolabel update).",
+        "States that no lockfile entry in pr.diff has \"hasInstallScript\" and that every resolved URL is on https://registry.npmjs.org/, which matches .npmrc. So there are no new install-time scripts and no registry switch.",
+        "Says CI did exercise the changed code, mapping the packages to jobs in .github/workflows/ci.yml: lintwright -> lint, prettyquill -> format, tsforge-types -> typecheck, vellum-test -> test, bundlecrate -> build-and-smoke (which runs test:dist against the built bundle). It says the pass/fail status comes from PR.md and was not observed directly.",
+        "Gives a rollback: revert the merge commit (restoring package.json and package-lock.json together) and run `npm ci`. It notes these are all devDependencies, so only the bundlecrate-built dist/ could reach users, and that build is covered by the smoke step.",
+        "Does not claim to have verified integrity hashes, provenance or upstream tags offline. It invents no versions, rules or APIs not in the files, and frames anything network-dependent (for example `npm audit signatures`, `npm ci` locally) as an optional command, not a blocker."
+      ]
     }
   ]
 }

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/.github/workflows/ci.yml

@@ -0,0 +1,39 @@
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d1f0a9c7e5b2846f0c1a7d9e3b5f8c2a6d4e017 # v4.2.2
+      - uses: actions/setup-go@8e2c4a6f0b1d3957a2c8e4f6b0d1a3c5e7f9b204 # v5.1.0
+        with:
+          go-version: "1.23"
+      - run: go vet ./...
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d1f0a9c7e5b2846f0c1a7d9e3b5f8c2a6d4e017 # v4.2.2
+      - uses: actions/setup-go@8e2c4a6f0b1d3957a2c8e4f6b0d1a3c5e7f9b204 # v5.1.0
+        with:
+          go-version: "1.23"
+      # Unit tests only. Integration tests (-tags integration) run nightly in
+      # integration.yml because they need a long timeout.
+      - run: go test -race -short ./...
+
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d1f0a9c7e5b2846f0c1a7d9e3b5f8c2a6d4e017 # v4.2.2
+      - uses: actions/setup-go@8e2c4a6f0b1d3957a2c8e4f6b0d1a3c5e7f9b204 # v5.1.0
+        with:
+          go-version: "1.23"
+      - run: go build ./...

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/.github/workflows/integration.yml

@@ -0,0 +1,20 @@
+name: integration
+
+on:
+  schedule:
+    - cron: "30 2 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  integration:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d1f0a9c7e5b2846f0c1a7d9e3b5f8c2a6d4e017 # v4.2.2
+      - uses: actions/setup-go@8e2c4a6f0b1d3957a2c8e4f6b0d1a3c5e7f9b204 # v5.1.0
+        with:
+          go-version: "1.23"
+      - run: go test -tags integration -timeout 10m ./...

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/PR.md

@@ -0,0 +1,39 @@
+# Bump github.com/fernwire/httpkit from 1.8.1 to 1.8.4 #412
+
+**dependabot** wants to merge 1 commit into `main` from `dependabot/go_modules/github.com/fernwire/httpkit-1.8.4`
+
+Bumps [github.com/fernwire/httpkit](https://github.com/fernwire/httpkit) from 1.8.1 to 1.8.4.
+
+<details>
+<summary>Release notes</summary>
+<p><em>Sourced from <a href="https://github.com/fernwire/httpkit/releases">github.com/fernwire/httpkit's releases</a>.</em></p>
+<blockquote>
+<h2>v1.8.4</h2>
+<ul>
+<li>Add optional OpenTelemetry hooks via <code>WithTracer</code> (backed by the new <code>fernwire/otelshim</code> module). No behaviour change unless the option is passed.</li>
+<li>Fix a data race in connection-pool metrics (#240).</li>
+</ul>
+</blockquote>
+</details>
+<details>
+<summary>Commits</summary>
+<ul>
+<li><code>9c1e4b7</code> release v1.8.4</li>
+<li><code>3fa02d1</code> pool: fix metrics race (#240)</li>
+<li><code>b81d6e0</code> add WithTracer option (#238)</li>
+<li>Additional commits viewable in <a href="https://github.com/fernwire/httpkit/compare/v1.8.1...v1.8.4">compare view</a></li>
+</ul>
+</details>
+<br />
+
+Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself.
+
+---
+
+### Checks
+
+- ci / lint — passed (41s)
+- ci / test — passed (1m 52s)
+- ci / build — passed (38s)
+
+All checks have passed.

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/go.mod

@@ -0,0 +1,17 @@
+module example.internal/payments-gateway
+
+go 1.23
+
+require (
+	github.com/fernwire/httpkit v1.8.4
+	github.com/quillstack/zlogx v0.11.2
+	github.com/stretchr/testify v1.9.0
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/fernwire/backoff v0.4.0 // indirect
+	github.com/fernwire/otelshim v0.1.0 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/internal/notify/client.go

@@ -0,0 +1,35 @@
+// Package notify sends merchant webhooks.
+package notify
+
+import (
+	"bytes"
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/fernwire/httpkit"
+)
+
+type Sender struct {
+	hc *httpkit.Client
+}
+
+func NewSender() *Sender {
+	return &Sender{hc: httpkit.NewClient(
+		httpkit.WithTimeout(5*time.Second),
+		httpkit.WithRetries(3),
+	)}
+}
+
+func (s *Sender) Send(ctx context.Context, url string, payload []byte) error {
+	req, err := http.NewRequest(http.MethodPost, url, bytes.NewReader(payload))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := s.hc.Do(ctx, req)
+	if err != nil {
+		return err
+	}
+	return resp.Body.Close()
+}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/internal/payments/client.go

@@ -0,0 +1,66 @@
+// Package payments talks to the upstream card-processing gateway.
+package payments
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/fernwire/httpkit"
+)
+
+// doer is the subset of *httpkit.Client we use. Tests substitute a fake.
+type doer interface {
+	Do(ctx context.Context, req *http.Request) (*http.Response, error)
+}
+
+// Client calls the gateway's /v2/charges API.
+type Client struct {
+	http    doer
+	baseURL string
+}
+
+// NewClient builds a gateway client.
+//
+// We deliberately do not set a timeout here: httpkit's default 30s client
+// timeout is what protects the settlement worker from a hung gateway
+// connection (see INC-2291).
+func NewClient(baseURL string) *Client {
+	hc := httpkit.NewClient(
+		httpkit.WithBaseURL(baseURL),
+		httpkit.WithRetries(2),
+	)
+	return &Client{http: hc, baseURL: baseURL}
+}
+
+type ChargeResult struct {
+	ID     string `json:"id"`
+	Status string `json:"status"`
+}
+
+// Charge submits a capture for a previously authorised payment.
+func (c *Client) Charge(ctx context.Context, authID string, amountMinor int64, idemKey string) (*ChargeResult, error) {
+	body := fmt.Sprintf(`{"authorization":%q,"amount":%d}`, authID, amountMinor)
+	req, err := http.NewRequest(http.MethodPost, c.baseURL+"/v2/charges", strings.NewReader(body))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Idempotency-Key", idemKey)
+
+	resp, err := c.http.Do(ctx, req)
+	if err != nil {
+		return nil, fmt.Errorf("gateway charge: %w", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 300 {
+		return nil, fmt.Errorf("gateway charge: status %d", resp.StatusCode)
+	}
+	var out ChargeResult
+	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+		return nil, fmt.Errorf("gateway charge: decode: %w", err)
+	}
+	return &out, nil
+}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/internal/payments/client_integration_test.go

@@ -0,0 +1,38 @@
+//go:build integration
+
+package payments
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestChargeHungGatewayTimesOut guards INC-2291: a gateway that accepts the
+// connection and never responds must not block the settlement worker forever.
+func TestChargeHungGatewayTimesOut(t *testing.T) {
+	block := make(chan struct{})
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		<-block
+	}))
+	defer srv.Close()
+	defer close(block)
+
+	c := NewClient(srv.URL)
+	done := make(chan error, 1)
+	go func() {
+		_, err := c.Charge(context.Background(), "auth_1", 100, "idem-hang")
+		done <- err
+	}()
+
+	select {
+	case err := <-done:
+		require.Error(t, err)
+	case <-time.After(2 * time.Minute):
+		t.Fatal("Charge did not time out against a hung gateway")
+	}
+}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/internal/payments/client_test.go

@@ -0,0 +1,53 @@
+package payments
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+type fakeDoer struct {
+	status int
+	body   string
+	err    error
+	got    *http.Request
+}
+
+func (f *fakeDoer) Do(_ context.Context, req *http.Request) (*http.Response, error) {
+	f.got = req
+	if f.err != nil {
+		return nil, f.err
+	}
+	return &http.Response{
+		StatusCode: f.status,
+		Body:       io.NopCloser(strings.NewReader(f.body)),
+	}, nil
+}
+
+func TestChargeOK(t *testing.T) {
+	fd := &fakeDoer{status: 201, body: `{"id":"ch_1","status":"captured"}`}
+	c := &Client{http: fd, baseURL: "https://gw.test"}
+	res, err := c.Charge(context.Background(), "auth_1", 1250, "idem-1")
+	require.NoError(t, err)
+	require.Equal(t, "ch_1", res.ID)
+	require.Equal(t, "idem-1", fd.got.Header.Get("Idempotency-Key"))
+}
+
+func TestChargeGatewayError(t *testing.T) {
+	fd := &fakeDoer{err: errors.New("boom")}
+	c := &Client{http: fd, baseURL: "https://gw.test"}
+	_, err := c.Charge(context.Background(), "auth_1", 1250, "idem-1")
+	require.Error(t, err)
+}
+
+func TestChargeNon2xx(t *testing.T) {
+	fd := &fakeDoer{status: 502, body: ``}
+	c := &Client{http: fd, baseURL: "https://gw.test"}
+	_, err := c.Charge(context.Background(), "auth_1", 1250, "idem-1")
+	require.ErrorContains(t, err, "status 502")
+}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/internal/payments/settle.go

@@ -0,0 +1,30 @@
+package payments
+
+import (
+	"context"
+
+	"github.com/quillstack/zlogx"
+)
+
+// Pending is a capture waiting to be settled.
+type Pending struct {
+	AuthID      string
+	AmountMinor int64
+	IdemKey     string
+}
+
+// SettleBatch is run by the nightly settlement worker. It processes captures
+// one at a time, in order; a single stuck call blocks the rest of the batch.
+func SettleBatch(c *Client, batch []Pending, log *zlogx.Logger) (settled int) {
+	for _, p := range batch {
+		// No per-call deadline: we rely on the client's own timeout.
+		res, err := c.Charge(context.Background(), p.AuthID, p.AmountMinor, p.IdemKey)
+		if err != nil {
+			log.Warn("settle failed", "auth", p.AuthID, "err", err)
+			continue
+		}
+		log.Info("settled", "auth", p.AuthID, "charge", res.ID)
+		settled++
+	}
+	return settled
+}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/pr.diff

@@ -0,0 +1,42 @@
+diff --git a/go.mod b/go.mod
+index 4be19a2..d07c3e1 100644
+--- a/go.mod
++++ b/go.mod
+@@ -3,14 +3,15 @@ module example.internal/payments-gateway
+ go 1.23
+
+ require (
+-	github.com/fernwire/httpkit v1.8.1
++	github.com/fernwire/httpkit v1.8.4
+ 	github.com/quillstack/zlogx v0.11.2
+ 	github.com/stretchr/testify v1.9.0
+ )
+
+ require (
+ 	github.com/davecgh/go-spew v1.1.1 // indirect
+-	github.com/fernwire/backoff v0.3.0 // indirect
++	github.com/fernwire/backoff v0.4.0 // indirect
++	github.com/fernwire/otelshim v0.1.0 // indirect
+ 	github.com/pmezard/go-difflib v1.0.0 // indirect
+ 	gopkg.in/yaml.v3 v3.0.1 // indirect
+ )
+diff --git a/go.sum b/go.sum
+index 7a10c3f..e41b9d8 100644
+--- a/go.sum
++++ b/go.sum
+@@ -1,10 +1,12 @@
+ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+ github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+-github.com/fernwire/backoff v0.3.0 h1:Qm3kT0n1Zr8vYx2LdP4eWc7sHf9aJbN6uE5tGiKoR1s=
+-github.com/fernwire/backoff v0.3.0/go.mod h1:Hc2pW8yTn5sLq0FvB3xJdM7eKa4rZu9gYiN1oPtE6Xw=
+-github.com/fernwire/httpkit v1.8.1 h1:Tz4xR9cWm1bPq7Ls2nVe8KdJ3hYf0aGu6oNiE5rBtXk=
+-github.com/fernwire/httpkit v1.8.1/go.mod h1:Lw6pD2sNx9bRe4Ty1qZa7HmKc3jUf8vGo0iEnB5tYsQ=
++github.com/fernwire/backoff v0.4.0 h1:Bv7nQ2xKp4cLz9Ws1mTe6RdH0yJa3fGu8oNiE5rCtWk=
++github.com/fernwire/backoff v0.4.0/go.mod h1:Hc2pW8yTn5sLq0FvB3xJdM7eKa4rZu9gYiN1oPtE6Xw=
++github.com/fernwire/httpkit v1.8.4 h1:Kp9sT3vWn2cRq6Lx1mBe7JdH4yGf0aZu5oNiE8rAtYk=
++github.com/fernwire/httpkit v1.8.4/go.mod h1:Rm3dF8sNx1bWe6Ty2qZa9HkKc4jUf7vGo0iEnB5tXsP=
++github.com/fernwire/otelshim v0.1.0 h1:Wd2mR7xKq5cLp8Vs3nTe1RfH6yJb0aGu4oNiE9rDtUk=
++github.com/fernwire/otelshim v0.1.0/go.mod h1:Ty5nB3sMx7bQe2Rw8qZa4HjKc1jUf6vGo9iEnC0tWsL=
+ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+ github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+ github.com/quillstack/zlogx v0.11.2 h1:Jn8cV4xTq1bLm7Rs2pWe5KdF3hYg0aHu9oNiE6rBtZk=

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/vendor-notes/httpkit-CHANGELOG.md

@@ -0,0 +1,43 @@
+# Changelog — github.com/fernwire/httpkit
+
+Excerpt copied from the upstream repository's CHANGELOG.md at tag v1.8.4.
+
+## v1.8.4 — 2026-10-02
+
+### Added
+- `WithTracer(t otelshim.Tracer)` option for OpenTelemetry spans. Pulls in
+  `github.com/fernwire/otelshim` as a dependency. No behaviour change unless
+  the option is passed. (#238)
+
+### Fixed
+- Data race in connection-pool metrics when `Stats()` is called concurrently
+  with in-flight requests. (#240)
+
+## v1.8.3 — 2026-09-18
+
+### Changed
+- `NewClient` no longer applies a default 30-second `Timeout`. The zero value
+  now means **no client-level timeout**, matching `net/http.Client`. Callers
+  that relied on the old default should pass `WithTimeout(30 * time.Second)`
+  explicitly. Deadlines carried by the request `context.Context` are still
+  honoured. (#231)
+
+  We are shipping this in a patch release because the old default silently
+  cut off long-polling and streaming callers, which we consider a bug.
+
+### Fixed
+- `Response.Body` is now always closed when `Do` returns an error after
+  reading headers. (#229)
+
+## v1.8.2 — 2026-08-30
+
+### Changed
+- Retry backoff is now computed by `github.com/fernwire/backoff` v0.4.0
+  (previously v0.3.0). Jitter is full-jitter instead of equal-jitter; the
+  maximum delay per attempt is unchanged at 2s. `WithRetries(n)` semantics
+  are unchanged. (#224)
+
+## v1.8.1 — 2026-08-04
+
+### Fixed
+- `WithBaseURL` now tolerates a trailing slash. (#219)

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/7/.github/workflows/ci.yml

@@ -0,0 +1,67 @@
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d1f0a9c7e5b2846f0c1a7d9e3b5f8c2a6d4e017 # v4.2.2
+      - uses: actions/setup-node@6b2e8d0f4a1c3957e2a8c4f6b0d9a1c3e5f7b8d2 # v4.1.0
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - run: npm run lint
+
+  format:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d1f0a9c7e5b2846f0c1a7d9e3b5f8c2a6d4e017 # v4.2.2
+      - uses: actions/setup-node@6b2e8d0f4a1c3957e2a8c4f6b0d9a1c3e5f7b8d2 # v4.1.0
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - run: npm run format:check
+
+  typecheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d1f0a9c7e5b2846f0c1a7d9e3b5f8c2a6d4e017 # v4.2.2
+      - uses: actions/setup-node@6b2e8d0f4a1c3957e2a8c4f6b0d9a1c3e5f7b8d2 # v4.1.0
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - run: npm run typecheck
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d1f0a9c7e5b2846f0c1a7d9e3b5f8c2a6d4e017 # v4.2.2
+      - uses: actions/setup-node@6b2e8d0f4a1c3957e2a8c4f6b0d9a1c3e5f7b8d2 # v4.1.0
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - run: npm test
+
+  build-and-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d1f0a9c7e5b2846f0c1a7d9e3b5f8c2a6d4e017 # v4.2.2
+      - uses: actions/setup-node@6b2e8d0f4a1c3957e2a8c4f6b0d9a1c3e5f7b8d2 # v4.1.0
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+      # Runs the test suite against the built dist/ bundle, not src/.
+      - run: npm run test:dist

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/7/.lintwright.json

@@ -0,0 +1,7 @@
+{
+  "extends": ["lintwright:recommended"],
+  "ignore": ["dist/", "coverage/"],
+  "rules": {
+    "no-console": "error"
+  }
+}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/7/.nvmrc

@@ -0,0 +1 @@
+20.11.1