chore(deps): update dependency sfdx-hardis to v8 - #8880
Merged
Conversation
renovate
Bot
requested review from
bdovaz,
echoix and
nvuillam
as code owners
September 2, 2026 10:33
Contributor
✅
|
renovate
Bot
force-pushed
the
renovate/sfdx-hardis-8.x
branch
from
September 3, 2026 00:11
ef0f96a to
9d8433b
Compare
Four fast-uri CVEs (2026-75899/75931/75975/76172) and grpc-go CVE-2026-84304 were published on 2026-09-01/02 and now fail the DEV trivy scan on every PR. Neither has an upgrade path: both fast-uri copies are frozen by upstream npm-shrinkwrap.json files (@salesforce/cli, @salesforce/plugin-code-analyzer) and every grpc-go consumer is already pinned at its newest release, none of which embeds 1.83.1 yet. Also refreshes the stale CVE-2026-18446 rationale.
uv.lock still resolved gitpython to 3.1.58, which four PYSEC advisories (2026-3785/3786/3787/3788, up to CVSS 9.3) were published against, failing the osv-scanner linter on every PR. The requirements files already pin 3.1.60; this aligns the lockfile.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.23.0→8.3.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
hardisgroupcom/sfdx-hardis (sfdx-hardis)
v8.3.0Compare Source
--skipauthwas always sent), saving time on each command and removing the repeated "You are already connected as..." lines. CI/CD and monitoring pipelines keep the check, so the org they target is still set as default org for the sf commands started next. Set SFDX_HARDIS_AUTH_CHECK=trueto also run it locally. The DevHub authentication check of scratch org commands is kept. When the check is skipped, the project configuration is no longer loaded either, saving about 1 more second per command.sf org display/sf config get/sf config setrun in-process: several seconds saved per call. Set SFDX_HARDIS_ENHANCE_PERFORMANCE tofalseto disable.v8.2.0Compare Source
v8.1.0Compare Source
Core
Query failedline with the error message.allowFailure: truethat fails now showswarning(failed, and no longer turns the Deployment Actions comment banner red, since the deployment went on. The action still runs again on the next deployment.Promotion Notesinstead ofRelease Notes, and the mode and merge commit prompts now sayrelease or promotion.Fetching batch X/{{MAX}}log line of paginated SOQL queries showing a raw placeholder instead of the maximum number of batches.sf org display.Dependencies
@actions/github,jsdoc-to-markdown,inquirer,fs-extra,ora,open,sort-array,farmhash,cross-spawn,which,debug,dotenv,form-data, unusedlangchain), replaced by Node.js built-ins and small internal helpers;yarn testnow fails when a dependency is unused or the lock file grows past a ceiling. Node.js 22 or more is required (like the Salesforce CLI).Documentation
uatandmainto enable an integration, and one running everywhere exceptmainto upsert the sample records used to test the agents.v8.0.0Compare Source
Summary
Deployment & CI/CD
dev-sandboxes.--jsonused to fail with no output at all.SFDX_HARDIS_PR_COMMENT_BANNERS=false,SFDX_HARDIS_PR_COMMENT_NAV=falseorSFDX_HARDIS_PR_DESCRIPTION_NAV=falseto opt out of banners and navigation.--checkdeployment nor survive a Quick Deploy. A--checkreports the deletion plan in the Pull Request comment, and fails if Flow Interviews block a deletion.FLOW_DELETE_INTERVIEWSPull Request keyword andflowDeleteInterviewsproperty, to authorize deleting the Flow Interviews that block a Flow deletion.Caution: deleting Flow Interviews is irreversible and destroys in-flight process state.
package-no-overwrite.xml: Fix Reports and Dashboards being overwritten when the target org holds them in another folder than the sources, as their API name is unique in the whole org.ghcr.io/hardisgroupcom/sfdx-hardis-ubuntu-with-agents:latestimage instead of uncommenting npm install lines.ghcr.io/hardisgroupcom/sfdx-hardis, the recommended default, whose publication does not rely on any long-lived token) and mirrored on Docker Hub.Org Monitoring & Grafana
usageCost, and monitoring reports entitlement overage and Agentforce credits in your own currency, next to the percentages.Documentation
Sandbox Refresh
Core
projectNameanddevHubAliaswere written to.sfdx-hardis.ymlas[object Promise]the first time a command asked for them.Technical
not runin the Pull Request comment, and the job fails on the deployment error. TheskipIfErrorproperty is removed, and ignored if still present in your configuration.packageXmlToDeploy,packageXmlToDeleteandpackageXmlToDeletePreDeployare no longer ignored. A bug made the defaultmanifest/andconfig/paths always win, so a project pointing to a custom destructive manifest could delete nothing at all and still exit with success. These properties (and the--packagexmlflag) are now honored, which can deploy and delete a different set of metadata than in your previous runs.--checkno longer validates Flow destructive members against the org. A Flow missing from the target org, a typo included, is reported asFLOW_DELETE_NOOPand passes, because the same destructive changes are replayed along the promotion chain.before-refreshnow lists the ones left to convert and pauses.extract-ziptransitive dependency (GHSA-jmr9-qjv8-65gv, CVE-2026-56876), and MegaLinter to v10..sfdx-hardis.ymlschema fixes, so validation and autocompletion match what the commands accept:commandsPostDeployaccepts theschedule-batchaction type, whoseclassName,cronExpressionandjobNameparameters are now declared.flowDeleteMaxAttemptsandflowDeleteRetryDelayMsproperties (and their env variables) to tune how many times a Flow version deletion is retried when a Flow Interview still blocks it, and how long to wait between attempts.SFDX_HARDIS_DEPLOY_CHECK_IDenv variable to force the Quick Deploy job id instead of reading it from Pull Request comments.sudo, so custom steps added to Azure Pipelines container jobs (which run as a non-root user) can elevate privileges when they need to.bulkDeleteToolingnow always returns{ results: [{ Id, success, errors }] }, and the CSV/XLSX reports of the Bulk API helpers are written in the reports directory like every other report.Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.