Repo sync

Dockerfile

@@ -4,7 +4,7 @@
 
 # Update the base image digest from the gh-base-noble package page:
 # https://github.com/github/gh-base-image/pkgs/container/gh-base-image%2Fgh-base-noble
-FROM ghcr.io/github/gh-base-image/gh-base-noble:20261022-141141-gfa3bc27f7@sha256:c1175f242e207eeaf679305e553b6f1a2f69d06fa7b3840b199c5c33da2de130 AS base
+FROM ghcr.io/github/gh-base-image/gh-base-noble:20261028-150140-g8ff90a672@sha256:2f8cb0ab06a0547bd9d70a81829f680208e7e6852d1e6abc1f68569d414e3d00 AS base
 # Install curl for NodeSource setup.
 # Install git for early-access and translation clones.
 # Ubuntu's nodejs package lags the Node LTS release line.

content/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/configure-for-a-repository.md

@@ -81,6 +81,19 @@ You can require reporters to associate at least one Common Weakness Enumeration
 1. Under **{% data variables.product.UI_advanced_security %}**, to the right of **Private vulnerability reporting**, click **Settings**.
 1. Under **Submission requirements**, enable **Require a CWE assignment**.
 
+## About rate limits for private vulnerability reports
+
+To protect maintainers from spam and abuse, {% data variables.product.github %} limits how many private vulnerability reports your repository receives and each user can submit per 24-hour period. You can set a lower or higher limit for the total number of reports your repository accepts and exempt trusted reporters. Reports that trusted reporters submit to your repository do not count toward your repository's limits or their global report limit. Reports they submit to other repositories remain subject to the limits for those repositories. For details of the limits, see [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/report-privately#rate-limits-for-private-vulnerability-reports).
+
+To set a limit for reports to your repository or exempt trusted reporters:
+
+{% data reusables.repositories.navigate-to-repo %}
+{% data reusables.repositories.sidebar-settings %}
+{% data reusables.repositories.navigate-to-code-security-and-analysis %}
+1. Under **{% data variables.product.UI_advanced_security %}**, to the right of **Private vulnerability reporting**, click **Settings**.
+1. Set a custom limit for reports to your repository.
+1. Add trusted reporters to exempt their reports to your repository from the reporting limits.
+
 ## Configuring notifications for private vulnerability reporting
 
 {% data reusables.security-advisory.private-vulnerability-reporting-configure-notifications %}

content/code-security/how-tos/report-and-fix-vulnerabilities/report-privately.md

@@ -33,3 +33,15 @@ If the repository doesn't have private vulnerability reporting enabled, you need
 {% data reusables.security-advisory.reporting-a-vulnerability-non-admin %}
 
 The next steps depend on the action taken by the repository maintainer. See [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/manage-vulnerability-reports).
+
+## Rate limits for private vulnerability reports
+
+To protect maintainers from spam and abuse, {% data variables.product.github %} limits the number of private vulnerability reports that you can submit:
+
+* You can submit a maximum of 25 reports per 24-hour period across repositories where you are not a trusted reporter.
+* You can submit a maximum of 5 reports to a single repository per 24-hour period.
+* By default, a repository accepts a maximum of 10 reports per 24-hour period from all reporters combined.
+
+Repository maintainers can set a lower or higher total limit for their repository and exempt trusted reporters. Reports to a repository where you are a trusted reporter are exempt from that repository's limits and do not count toward your global 25-report limit. Reports to other repositories still count toward both the global limit and each repository's limits.
+
+If you reach a rate limit, you will see a message when you try to submit a new report on {% data variables.product.github %}. Each 24-hour period starts with the first report that counts toward that limit, and the limit resets in full when the period ends.

content/code-security/reference/supply-chain-security/dependabot-options-reference.md

@@ -231,6 +231,9 @@ The table below shows the package managers that support `cooldown`. The `default
 
 | Package manager        | Default days supported | SemVer-bump days supported |
 |-----------------------|:----------------------:|:--------------------------:|
+| {% ifversion dependabot-apm-support %} |
+| APM                   | {% octicon "check" aria-label="Supported" %}              | {% octicon "check" aria-label="Supported" %} |
+| {% endif %} |
 | {% ifversion dependabot-bazel-support %} |
 | Bazel               | {% octicon "check" aria-label="Supported" %}              | {% octicon "x" aria-label="Not supported" %} |
 | {% endif %} |
@@ -559,6 +562,9 @@ When either limit is reached, {% data variables.product.prodname_dependabot %} r
 
 Package manager | YAML value      | Supported versions |
 ---------------|------------------|:------------------:|
+| {% ifversion dependabot-apm-support %} |
+| APM           | `apm`            | Not applicable           |
+| {% endif %} |
 | {% ifversion dependabot-bazel-support %} |
 | Bazel         | `bazel`          | v7, v8, v9               |
 | {% endif %} |

contributing/development.md

@@ -8,7 +8,7 @@ This site is powered by Node.js! :sparkles: :turtle: :rocket: :sparkles:
 
 It runs on macOS, Windows, and Linux environments.
 
-You'll need Node.js to run the site. Check the version in `package.json`. To install Node.js, [download the "LTS" installer from nodejs.org](https://nodejs.org). If you're using [`nodenv`](https://github.com/nodenv/nodenv), read the [`nodenv` docs](https://github.com/nodenv/nodenv#readme) for instructions on switching Node.js versions.
+You'll need Node.js to run the site. Check the version in `package.json`. To install Node.js, [download the "LTS" installer from nodejs.org](https://nodejs.org). To use a Node version manager instead, see [Node versions](./node-versions.md#install-nodejs-locally).
 
 Once you've installed Node.js (which includes the popular `npm` package manager), open Terminal and run the following:
 

contributing/node-versions.md

@@ -12,40 +12,23 @@ When updating to a new Node.js version, consider the following files:
 - [ ] The `contributing/development.md` guide
 - [ ] The `contributing/node-versions.md` file
 
-## `nodenv`
+## Install Node.js locally
 
-[nodenv](https://github.com/nodenv/nodenv) is a tool for managing multiple Node.js versions on your local machine. It is **not required** to run this app, but you may already have it installed if you've worked on other projects that use Node.js.
+You don't need a Node version manager, but it makes switching versions easier. We recommend [fnm](https://github.com/Schniz/fnm).
 
-If you're using macOS, run this command to get the latest:
+1. Install fnm. On macOS, run `brew install fnm`. For other systems, see the [fnm installation docs](https://github.com/Schniz/fnm#installation).
+1. Set up your shell. For Zsh, add this line to `~/.zshrc`. For Bash, add it to `~/.bashrc` and change `zsh` to `bash`. For other shells, see [fnm shell setup](https://github.com/Schniz/fnm#shell-setup).
 
-```shell
-brew upgrade nodenv node-build
-```
+   ```shell
+   eval "$(fnm env --use-on-cd --shell zsh)"
+   ```
 
-If you see a warning like this one, run the suggested command:
+1. Open a new terminal. Install the latest major version listed in `engines.node` in `package.json`, make it your default, and switch to it. For example, for Node.js 26:
 
-```shell
-# You should change the ownership of these directories to your user.
-sudo chown -R $(whoami) /usr/local/sbin
-```
+   ```shell
+   fnm install 26
+   fnm default 26
+   fnm use 26
+   ```
 
-If you're using another operating system, or did not use Homebrew to install nodenv, see these [upgrade instructions](https://github.com/nodenv/nodenv#installation).
-
-To install Node.js and make it your default version, run this command:
-
-```shell
-# Set VERSION= based on package.json#engines
-nodenv install $VERSION && nodenv global $VERSION
-```
-
-You may sometimes see a warning when running npm scripts with nodenv:
-
-```shell
-npm WARN lifecycle The node binary used for scripts is [...] but npm is using [...]
-```
-
-This is due to nodenv's overriding behavior. To silence this harmless warning, the [nodenv docs](https://github.com/nodenv/nodenv/wiki/FAQ#npm-warning-about-mismatched-binaries) recommend running the following command from any directory:
-
-```shell
-npm config set scripts-prepend-node-path auto
-```
+1. Run `node --version` to check. If you see a different version, another version manager may be active in your shell. Check your shell profile.

data/features/dependabot-apm-support.yml

@@ -0,0 +1,6 @@
+# Reference: https://github.com/github/releases/issues/11469
+# APM (Agent Package Manager) support for Dependabot
+versions:
+  fpt: '*'
+  ghec: '*'
+  ghes: '>= 3.24'

data/reusables/dependabot/dependabot-updates-supported-versioning-tags.md

@@ -24,6 +24,9 @@ The `dependabot.yml` file doesn't control the versioning tags that you can use,
 | Docker              | `docker`       | `alpha`, `beta`, `rc`, `dev`, `preview`, `pre`, `nightly`, `snapshot`, `canary`, `unstable` (heuristic detection) | `nginx@1.25.0-rc1`, `node@20.0.0-alpha.1`, `redis@7.0.0-nightly`, `alpine@3.18.0-dev`, `ubuntu@22.04-preview` |
 | git submodule       | `gitsubmodule` | None—pins to commit SHAs or git tags (no versioning scheme) | `my-lib@abc1234`, `shared-utils@v1.2.0` |
 | Go modules          | `gomod`        | `alpha`, `beta`, `rc` (SemVer prerelease after `-`) | `github.com/go-chi/chi@v5.0.0-rc1`, `google.golang.org/grpc@v1.60.0-beta.1`, `github.com/octo-org/octo-module@v0.17.0-alpha.1` |
+| {% ifversion dependabot-apm-support %} |
+| APM                 | `apm`          | Any SemVer prerelease identifier (commonly `alpha`, `beta`, `rc`) | `microsoft/edge-ai#v1.1.0-rc.1`, `octo-org/octo-skills/skills/review#review-v2.0.0-beta.1` |
+| {% endif %} |
 | {% ifversion dependabot-bazel-support %} |
 | Bazel               | `bazel`        | Any SemVer prerelease identifier (commonly `alpha`, `beta`, `rc`) | `rules_go@0.46.0-rc1`, `rules_rust@0.40.0-beta`, `bazel_skylib@1.5.0-alpha` |
 | {% endif %} |
@@ -75,6 +78,9 @@ The following details describe how {% data variables.product.prodname_dependabot
 * **Elm:** Enforces strict SemVer (`MAJOR.MINOR.PATCH` integers only). The Elm package registry does not allow publishing prerelease versions. {% data variables.product.prodname_dependabot %} compares versions numerically.
 * **Go modules:** Follows SemVer with a mandatory `v` prefix. Pseudo-versions (`v0.0.0-YYYYMMDDHHMMSS-commithash`) represent unreleased commits and are always treated as prerelease. The `+incompatible` suffix marks modules at major version 2+ without a `go.mod` file and does not affect version ordering.
 * **git submodule:** {% data variables.product.prodname_dependabot %} tracks the latest commit on the configured branch. There is no version comparison—updates always move the pinned SHA forward. If the submodule tracks a tag, {% data variables.product.prodname_dependabot %} follows the tag's commit.
+{% ifversion dependabot-apm-support %}
+* **APM:** Resolves dependency versions from git tags. Both plain tags (`v1.4.0`) and package-scoped tags (`review-v1.4.0`, `review--v1.4.0`, `review_v1.4.0`) are recognized. The prefix of a package-scoped tag must match the package name, which is the repository name or the last component of a virtual package path. Build metadata (`+...`) is ignored for version precedence. Commit SHA pins only move to annotated, non-prerelease release tags.
+{% endif %}
 {% ifversion dependabot-bazel-support %}
 * **Bazel:** Follows SemVer prerelease conventions. The Bazel Central Registry (BCR) `.bcr.N` suffix is stripped before comparison and does not affect prerelease detection.
 {% endif %}

data/reusables/dependabot/supported-package-managers.md

@@ -2,6 +2,9 @@
 
 Package manager | YAML value      | Supported versions | Version updates | Security updates | Private repositories | Private registries | Vendoring |
 ---------------|------------------|------------------|:---:|:---:|:---:|:---:|:---:|
+| {% ifversion dependabot-apm-support %} |
+[APM](#apm) | `apm` | Not applicable | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} (git only) | Not applicable |
+| {% endif %} |
 | {% ifversion dependabot-bazel-support %} |
 Bazel | `bazel`         | v7, v8, v9              | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} |
 | {% endif %} |
@@ -70,6 +73,37 @@ uv        | `uv`            | v0.11            | {% octicon "check" aria-label="
 
 For further information about ecosystem support for {% data variables.product.prodname_dependabot_security_updates %}, see also [AUTOTITLE](/code-security/reference/supply-chain-security/dependency-graph-supported-package-ecosystems).
 
+{% ifversion dependabot-apm-support %}
+
+### APM
+
+{% data variables.product.prodname_dependabot %} can update git dependencies declared in `apm.yml` manifest files for APM (Agent Package Manager). Entries under both `dependencies.apm` and `devDependencies.apm` are updated. For more information about APM, see [`microsoft/apm` repository](https://github.com/microsoft/apm) in the `microsoft/apm` repository.
+
+How {% data variables.product.prodname_dependabot %} updates a dependency depends on how the dependency is pinned.
+
+| Pin type | Example | Behavior |
+|---|---|---|
+| SemVer tag | `octo-org/octo-skills#v1.0.0` | Updated to the latest SemVer tag. Both plain tags (`v1.4.0`) and package-scoped tags are supported. A package-scoped tag must start with the package name, which is the repository name or the last component of a virtual package path. For example, `octo-org/octo-skills/skills/review#review-v1.4.0`. |
+| Commit SHA | `octo-org/octo-skills#<40-character SHA>` | Updated to the commit of the latest annotated, non-prerelease release tag. The tag name is added as a comment, for example `# v1.4.0`. |
+| Branch | `octo-org/octo-skills#main` | Updated to the latest commit on the branch. Only `apm.lock.yaml` changes, because the manifest still names the branch. Requires an existing `apm.lock.yaml` file. |
+
+If your repository contains an `apm.lock.yaml` file, {% data variables.product.prodname_dependabot %} regenerates it by running `apm lock`. {% data variables.product.prodname_dependabot %} doesn't create a lockfile if one doesn't exist.
+
+{% data variables.product.prodname_dependabot %} doesn't update the following entries:
+
+* Object-form entries (`git:`, `registry:`, `id:`, or `path:` maps) and `mcp:` entries
+* Entries without a ref, such as `octo-org/octo-skills`
+* Local path entries, such as `./my-package`
+* Entries hosted on Azure DevOps
+* Entries that use an `http://` or `git://` clone URL
+* Entries written as YAML block scalars (`>` or `|`) or as quoted strings that use escape sequences
+* Abbreviated commit SHAs
+* Shorthand entries, such as `octo-org/octo-skills#v1.2.0`, when the manifest sets `registries.default`. Entries that use an explicit clone URL are still updated.
+
+Private registry support uses git registries. You can configure access for private git repositories by specifying a git registry in your `dependabot.yml` file. See [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-access-to-private-registries#git).
+
+{% endif %}
+
 ### Bun
 
 {% data variables.product.prodname_dependabot %} supports the current default text-based `bun.lock` file, but not the legacy binary `bun.lockb` file. The `bun.lock` file is supported in version 1.1.39 and above. For more information, see [Lockfile](https://bun.sh/docs/install/lockfile) in the Bun documentation.