Repository navigation
chore(windows): bump github.com/microsoft/vcpkg from master to 2026.10.16 - #2773
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github.com/microsoft/vcpkg](https://github.com/microsoft/vcpkg) from master to 2026.10.16. This release includes the previously tagged commit. - [Release notes](https://github.com/microsoft/vcpkg/releases) - [Commits](microsoft/vcpkg@817892b...9eec002) --- updated-dependencies: - dependency-name: github.com/microsoft/vcpkg dependency-version: 2026.10.16 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Closing: this is a downgrade. Our baseline (817892b) is a vcpkg master commit pinned for brotli 1.2.1 (CVE-2026-111497). The 2026.10.16 tag (9eec002) is 140 commits behind it and still ships brotli 1.2.0, so merging would bring the vulnerability back. Dependabot only tracks vcpkg release tags; the next one will include brotli 1.2.1 and be a real upgrade. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
) Dependabot rewrites `vcpkg.json` with expanded arrays and no final newline, so every baseline bump fails Prettier and EditorConfig (see #2773). - Write `vcpkg.json` exactly as Dependabot does, so its PRs only change the `builtin-baseline` line. - Exclude `vcpkg.json` from super-linter. `vcpkg install` still rejects an invalid manifest.
Bumps github.com/microsoft/vcpkg from master to 2026.10.16. This release includes the previously tagged commit.
Release notes
Sourced from github.com/microsoft/vcpkg's releases.
... (truncated)
Commits
9eec002[thorvg] Update to 1.1.3 (#54460)7d1c862[harfbuzz] Update to 14.6.0 (#54441)deb0f6a[luajit] Update to 2026-10-14 (#54440)d208d23[libiconv] Fix build for MinGW targets. (#54406)6719fd4[mingw triplets] Kept PATH out of the package ABIs (#54462)3dc1631[slick-stream-buffer-multiplexer] Update to 2.2.0 (#54446)5d1a46f[slick-perfmon] Update to 0.3.0 (#54445)f989ee2[cudnn-frontend] update to 1.31.0 (#54404)7d5f3c6[reproc] Update to 14.2.8 (#54426)a35a4bc[expat] Update to 2.9.0 (#54434)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)