build(deps): bump duckduckgo/action-asana-sync from 11 to 17 by dependabot[bot] · Pull Request #3012 · duckduckgo/content-scope-scripts

dependabot · 2026-09-02T10:54:10Z

Bumps duckduckgo/action-asana-sync from 11 to 17.

Release notes

Sourced from duckduckgo/action-asana-sync's releases.

v17

What's Changed

Upgrade Node.js runtime from 20.x to 24.x by @sammacbeth in duckduckgo/action-asana-sync#178

Fix race condition in PR task creation with concurrent runs by @sammacbeth in duckduckgo/action-asana-sync#177

Full Changelog: duckduckgo/action-asana-sync@v16...v17

v16

What's Changed

Retry Asana API calls with backoff on 429 (Too Many Requests) by @sammacbeth in duckduckgo/action-asana-sync#174

Match review subtasks to reviewers from the listing, not per-subtask lookups by @sammacbeth in duckduckgo/action-asana-sync#176

Scope the Github URL/Status custom field lookup to the destination project by @sammacbeth in duckduckgo/action-asana-sync#175

Full Changelog: duckduckgo/action-asana-sync@v15...v16

v15

What's Changed

Fix approval-status writes rejected by Asana with 400 Bad Request by @sammacbeth in duckduckgo/action-asana-sync#172

Enable REVIEW_TASKS_AS_APPROVALS by @sammacbeth in duckduckgo/action-asana-sync#173

Full Changelog: duckduckgo/action-asana-sync@v14...v15

v14

What's Changed

Bump prettier from 2.8.8 to 3.9.6 by @dependabot[bot] in duckduckgo/action-asana-sync#157

Add REVIEW_TASKS_AS_APPROVALS option: review subtasks as Asana approvals by @sammacbeth in duckduckgo/action-asana-sync#168

Full Changelog: duckduckgo/action-asana-sync@v13...v14

v13

What's Changed

Add integration test harness with mocked Asana API by @sammacbeth in duckduckgo/action-asana-sync#161

Remove CodeQL analysis workflow by @sammacbeth in duckduckgo/action-asana-sync#162

Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in duckduckgo/action-asana-sync#150

Bump actions/setup-node from 4.2.0 to 7.0.0 by @dependabot[bot] in duckduckgo/action-asana-sync#159

Migrate ESLint to flat config format and update dependencies by @sammacbeth in duckduckgo/action-asana-sync#163

Upgrade @actions/core dependency to v2.0.3 by @sammacbeth in duckduckgo/action-asana-sync#164

Bump actions/checkout from 4 to 7 by @dependabot[bot] in duckduckgo/action-asana-sync#154

Bump @octokit/webhooks-types from 7.3.1 to 7.6.1 by @dependabot[bot] in duckduckgo/action-asana-sync#156

Upgrade Asana SDK to v3.1.12 with updated API imports by @sammacbeth in duckduckgo/action-asana-sync#165

Paginate through custom fields to support workspaces with >100 fields by @sammacbeth in duckduckgo/action-asana-sync#167

Update js-yaml dependency and test polyfills by @sammacbeth in duckduckgo/action-asana-sync#166

Full Changelog: duckduckgo/action-asana-sync@v12...v13

... (truncated)

Commits

3c20a41 Fix race condition in PR task creation with concurrent runs (#177)
775446e Bump action runtime from node20 to node24 (#178)
b506f5f Scope the Github URL/Status custom field lookup to the destination project (#...
2f3ee2c Match review subtasks to reviewers from the listing, not per-subtask lookups ...
1f5fb5f Retry Asana API calls with backoff on 429 (Too Many Requests) (#174)
718b7c4 Enable REVIEW_TASKS_AS_APPROVALS (#173)
e67e90e Fix approval-status writes rejected by Asana with 400 Bad Request (#172)
1281107 Add REVIEW_TASKS_AS_APPROVALS option: review subtasks as Asana approvals (#168)
935d29b Bump prettier from 2.8.8 to 3.9.6 (#157)
b8d1dde Fix npm audit vulnerabilities via safe dependency bumps (#166)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note

Low Risk
Single CI action version pin bump with identical secrets and inputs; no application code changes.

Overview
Updates the asana sync GitHub Actions workflow to use duckduckgo/action-asana-sync@v17 instead of @v11. Workflow triggers, job conditions, and all with inputs (Asana tokens, project ID, USER_MAP, ASSIGN_PR_AUTHOR) are unchanged.

The newer action versions bring upstream fixes and behavior changes that affect PR→Asana sync reliability—e.g. concurrent-run race fixes, 429 retries, and improved review/custom-field handling—without changing how this repo configures the step.

^{Reviewed by Cursor Bugbot for commit 09f4ed0. Bugbot is set up for automated code reviews on this repo. Configure here.}

Bumps [duckduckgo/action-asana-sync](https://github.com/duckduckgo/action-asana-sync) from 11 to 17. - [Release notes](https://github.com/duckduckgo/action-asana-sync/releases) - [Commits](duckduckgo/action-asana-sync@v11...v17) --- updated-dependencies: - dependency-name: duckduckgo/action-asana-sync dependency-version: '17' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

cursor

Injected PR Evaluation: Web Compatibility & Security

Scope: Single-line bump of duckduckgo/action-asana-sync from @v11 → @v17 in .github/workflows/asana.yml. No changes under injected/, messaging/, special-pages/, or any runtime bundle.

Web Compatibility Assessment

No findings. This PR does not modify browser-injected JavaScript, API overrides, DOM interaction, or platform entry points. There is no user-facing web compatibility surface in the diff.

Security Assessment

No findings for the injected-scripts threat model. The change is confined to a GitHub Actions workflow that syncs PR metadata to Asana using repository secrets (ASANA_ACCESS_TOKEN, GH_RO_PAT, etc.). Existing workflow guards remain intact (skips forks, Dependabot PRs, and cursor/ / claude/ branches). No changes to captured-globals.js, message bridge, origin validation, or page-world code paths.

Note: v11→v17 of action-asana-sync includes substantial internal action changes (approvals, retries, custom fields), but those affect CI/Asana sync behavior only — not code shipped to end users.

Risk Level

Low Risk — CI/workflow-only dependency bump with zero injected-runtime code changes.

Recommendations

Info: Confirm the asana sync workflow succeeds on a real (non-fork, non-Dependabot) PR after merge — standard validation for action version bumps.
No injected-code testing or remote-config rollback considerations apply.

_{Sent by Cursor Automation: Web compat and sec}

cursor

Stale comment

Dependency update review: duckduckgo/action-asana-sync v11 → v17

Verdict: Low risk — safe to merge. No blocking issues found; no companion fix PR is needed.

Scope of this PR

Single-line change in .github/workflows/asana.yml (@v11 → @v17). All existing inputs (ASANA_*, GITHUB_PAT, USER_MAP, ASSIGN_PR_AUTHOR) are unchanged; no new inputs are set.

Changelog impact (v12–v17)

Version Change Impact on this repo

v12 INCLUDE_ASSIGNEES input added (opt-in) None — not configured

v13 Asana SDK → official npm 3.1.12; custom-field pagination; integration test harness Positive — fixes for large workspaces; better upstream test coverage

v14–v15 REVIEW_TASKS_AS_APPROVALS option added; approval 400 fix None — defaults to false unless explicitly set to 'true'

v16 429 retry/backoff; review-subtask matching fix; scoped custom-field lookup Positive — reliability improvements for active sync workflow

v17 Node runtime node20 → node24; race-condition fix in PR task creation Positive — prevents duplicate Asana tasks on concurrent runs

action.yml diff confirms only additive inputs and a runtime bump; no required inputs were removed or renamed.

Test coverage

This repo: No automated tests for the Asana workflow (pre-existing). The workflow is skipped for this Dependabot PR (dependabot[bot] is excluded in asana.yml), so v17 is not exercised here.

Action repo (v13+): Integration tests now cover PR open/update/close, review events, rate-limit backoff, and approvals — a meaningful improvement over v11.

Validation needed after merge: Watch the first non-skipped asana sync run on a real PR to confirm node24 executes cleanly on ubuntu-latest.

Is this dependency still needed?

Yes. The workflow is the repo's active GitHub ↔ Asana integration. Draft PR #2271 proposes migrating to duckduckgo/native-github-asana-sync, but it is still a draft with a narrower trigger surface and different behavior — not a substitute for this bump today.

Supply chain risk

Factor Assessment

Publisher Internal duckduckgo/ org action

Tag integrity v17 tag points to commit 3c20a41, GitHub-verified signature

Pinning Floating semver tag (@v17), same pattern as current @v11

Blast radius Workflow-only; no application code or build artifacts affected

Secrets Same ASANA_ACCESS_TOKEN, GH_RO_PAT exposure as today

Confirmed: Low supply-chain risk for an internal, signed, org-maintained action.

Uncertain (informational): Pinning to a full commit SHA would harden against tag retagging, but that is a repo-wide policy choice — not a defect in this bump.

Confirmed issues

None.

Uncertain concerns / optional follow-ups

REVIEW_TASKS_AS_APPROVALS — The action repo dogfoods this (REVIEW_TASKS_AS_APPROVALS: 'true' in its own workflow since v15). This repo does not set it, so review subtasks remain plain tasks (current behavior). Enabling it would be a deliberate product decision (requires Asana plan with approvals support), not a prerequisite for this bump.

Post-merge smoke test — Confirm the first real asana sync run succeeds under the node24 runtime.

Fix PR

Not drafted. No code or workflow changes are required beyond this version bump. Checked open PRs — no existing fix PR targets this update (draft #2271 is a separate migration, not a v17 fix).

_{Sent by Cursor Automation: Review dependabot}

jonathanKingston · 2026-09-08T15:35:33Z

·@·d·ependabot r·ebase

Generated by Claude Code

…tion-asana-sync-17

github-actions · 2026-09-08T15:39:55Z

[Beta] Generated file diff

Time updated: Tue, 08 Sep 2026 15:39:55 GMT

cursor

Dependency update review: `duckduckgo/action-asana-sync` v11 → v17

Verdict: Low risk — safe to merge. No blocking issues found; no companion fix PR is needed.

Scope of this PR

Single-line change in .github/workflows/asana.yml (@v11 → @v17). All existing inputs (ASANA_*, GITHUB_PAT, USER_MAP, ASSIGN_PR_AUTHOR) are unchanged; no new inputs are set.

Changelog impact (v12–v17)

Version	Change	Impact on this repo
v12	`INCLUDE_ASSIGNEES` input added (opt-in)	None — not configured
v13	Asana SDK → official npm `3.1.12`; custom-field pagination; integration test harness	Positive — fixes for large workspaces; better upstream test coverage
v14–v15	`REVIEW_TASKS_AS_APPROVALS` option added; approval 400 fix	None — defaults to `false` unless explicitly set to `'true'` (despite the v15 release title, the action still gates on `getInput(...) === 'true'`)
v16	429 retry/backoff; review-subtask matching fix; scoped custom-field lookup	Positive — reliability improvements for active sync workflow
v17	Node runtime `node20` → `node24`; race-condition fix in PR task creation	Positive — especially relevant here because this workflow fires on `synchronize`, `edited`, and `review_requested`, which can produce concurrent runs

action.yml diff (v11 vs v17) confirms only additive inputs and a runtime bump; no required inputs were removed or renamed.

Test coverage

This repo: No automated tests for the Asana workflow (pre-existing). The workflow is skipped for this Dependabot PR (dependabot[bot] is excluded in asana.yml), so v17 is not exercised here.
Action repo (v13+): Integration tests now cover PR open/update/close, review events, rate-limit backoff, approvals, and duplicate-task races — a meaningful improvement over v11.
Sibling repos: duckduckgo/content-blocker-extension and duckduckgo/autoconsent already run @v17 successfully in production.
Validation needed after merge: Watch the first non-skipped asana sync run on a real PR to confirm node24 executes cleanly on ubuntu-latest.

Is this dependency still needed?

Yes. The workflow is this repo's active GitHub ↔ Asana integration. Draft PR #2271 proposes migrating to duckduckgo/native-github-asana-sync, but it is still a draft with a narrower trigger surface and different behavior — not a substitute for this bump today.

Supply chain risk

Factor	Assessment
Publisher	Internal `duckduckgo/` org action
Tag integrity	`v17` → commit `3c20a41`, GitHub-verified signature (`verified: true`)
Pinning	Floating semver tag (`@v17`), same pattern as current `@v11`
Blast radius	Workflow-only; no application code or build artifacts affected
Secrets	Same `ASANA_ACCESS_TOKEN`, `GH_RO_PAT` exposure as today

Confirmed: Low supply-chain risk for an internal, signed, org-maintained action.

Uncertain (informational): Pinning to a full commit SHA would harden against tag retagging, but that is a repo-wide policy choice — not a defect in this bump.

Confirmed issues

None.

Uncertain concerns / optional follow-ups

REVIEW_TASKS_AS_APPROVALS — Sibling repos (content-blocker-extension, autoconsent) set REVIEW_TASKS_AS_APPROVALS: 'true'. This repo does not, so review subtasks remain plain tasks (current behavior). Enabling it would be a deliberate product decision (requires Asana plan with approvals support), not a prerequisite for this bump.
Post-merge smoke test — Confirm the first real asana sync run succeeds under the node24 runtime.

Fix PR

Not drafted. No code or workflow changes are required beyond this version bump. Checked open PRs — no existing fix PR targets this update (draft #2271 is a separate migration, not a v17 fix).

_{Sent by Cursor Automation: Review dependabot}

dependabot Bot added dependencies Update one or more dependencies version major Increment the major version when merged labels Sep 2, 2026

dependabot Bot requested a review from a team as a code owner September 2, 2026 10:54

dependabot Bot added dependencies Update one or more dependencies version major Increment the major version when merged labels Sep 2, 2026

dependabot Bot mentioned this pull request Sep 2, 2026

build(deps): bump duckduckgo/action-asana-sync from 11 to 16 #2988

Closed

cursor Bot reviewed Sep 2, 2026

View reviewed changes

jonathanKingston enabled auto-merge September 8, 2026 15:35

Merge branch 'main' into dependabot/github_actions/main/duckduckgo/ac…

09f4ed0

…tion-asana-sync-17

cursor Bot reviewed Sep 8, 2026

View reviewed changes

jonathanKingston approved these changes Sep 11, 2026

View reviewed changes

jonathanKingston added this pull request to the merge queue Sep 11, 2026

Merged via the queue into main with commit 24866e2 Sep 11, 2026
41 checks passed

jonathanKingston deleted the dependabot/github_actions/main/duckduckgo/action-asana-sync-17 branch September 11, 2026 11:32

Navigation Menu

build(deps): bump duckduckgo/action-asana-sync from 11 to 17 - #3012

build(deps): bump duckduckgo/action-asana-sync from 11 to 17#3012
jonathanKingston merged 2 commits into
mainfrom
dependabot/github_actions/main/duckduckgo/action-asana-sync-17

dependabot Bot commented on behalf of github Sep 2, 2026 •

edited by cursor Bot

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

jonathanKingston commented Sep 8, 2026

Uh oh!

github-actions Bot commented Sep 8, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 2, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v17

What's Changed

v16

What's Changed

v15

What's Changed

v14

What's Changed

v13

What's Changed

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Injected PR Evaluation: Web Compatibility & Security

Web Compatibility Assessment

Security Assessment

Risk Level

Recommendations

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Dependency update review: duckduckgo/action-asana-sync v11 → v17

Scope of this PR

Changelog impact (v12–v17)

Test coverage

Is this dependency still needed?

Supply chain risk

Confirmed issues

Uncertain concerns / optional follow-ups

Fix PR

Uh oh!

jonathanKingston commented Sep 8, 2026

Uh oh!

github-actions Bot commented Sep 8, 2026

[Beta] Generated file diff

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Dependency update review: duckduckgo/action-asana-sync v11 → v17

Scope of this PR

Changelog impact (v12–v17)

Test coverage

Is this dependency still needed?

Supply chain risk

Confirmed issues

Uncertain concerns / optional follow-ups

Fix PR

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Sep 2, 2026 •

edited by cursor Bot

Loading

cursor Bot left a comment •

edited

Loading

Dependency update review: `duckduckgo/action-asana-sync` v11 → v17

Dependency update review: `duckduckgo/action-asana-sync` v11 → v17