[dependabot]

Bumps the github-actions group with 1 update: MishaKav/pytest-coverage-comment.

Updates MishaKav/pytest-coverage-comment from 1.12.3 to 1.13.0

Release notes

Sourced from MishaKav/pytest-coverage-comment's releases.

v1.13.0

What's Changed

• new annotate-missing-lines option: adds GitHub annotations on lines added in the pull request or push that aren't covered by tests (missing lines and partial branches), shown right below the code in the "Files changed" tab. Works with txt, xml and json coverage on pull_request, pull_request_target and push events. Combine it with hide-comment: true to get annotations without a PR comment, fixes #321
• new annotation-type option to set the annotation level: notice, warning (default) or error
• coverage-path-prefix is now stripped only from the start of a changed file's path (previously the first match anywhere in the path was removed)

Full Changelog: MishaKav/pytest-coverage-comment@v1.12.5...v1.13.0

v1.12.5

What's Changed

• escape report values in the coverage table and keep them out of markdown parsing, so a crafted coverage report can't inject HTML, markdown, links or a fake badge into the comment
• url-encode file paths in coverage table links, don't link paths with .., support windows \ paths, and strip the workspace prefix from missing-line links
• fix a crash when a coverage report has a top-level folder named like an Object member (e.g. constructor)

Full Changelog: MishaKav/pytest-coverage-comment@v1.12.4...v1.12.5

v1.12.4

What's Changed

• bump dev dependencies: vitest 5.0.5, @vitest/coverage-v8 5.0.5, @types/node 26.6.5, eslint 10.13.0, typescript-eslint 8.72.0, prettier 3.9.10, vite 8.3.5
• bump undici from 6.29.0 to 6.29.1 (fixes two high severity vulnerabilities)

Full Changelog: MishaKav/pytest-coverage-comment@v1.12.3...v1.12.4

Changelog

Sourced from MishaKav/pytest-coverage-comment's changelog.

Changelog of the Pytest Coverage Comment

Pytest Coverage Comment 1.13.0

Release Date: 2026-10-26

Changes

• new annotate-missing-lines option: adds GitHub annotations on lines added in the pull request or push that aren't covered by tests (missing lines and partial branches), shown right below the code in the "Files changed" tab. Works with txt, xml and json coverage on pull_request, pull_request_target and push events. Combine it with hide-comment: true to get annotations without a PR comment, fixes #321
• new annotation-type option to set the annotation level: notice, warning (default) or error
• coverage-path-prefix is now stripped only from the start of a changed file's path (previously the first match anywhere in the path was removed)

Pytest Coverage Comment 1.12.5

Release Date: 2026-10-24

Changes

• escape report values in the coverage table and keep them out of markdown parsing, so a crafted coverage report can't inject HTML, markdown, links or a fake badge into the comment
• url-encode file paths in coverage table links, don't link paths with .., support windows \ paths, and strip the workspace prefix from missing-line links
• fix a crash when a coverage report has a top-level folder named like an Object member (e.g. constructor)

Pytest Coverage Comment 1.12.4

Release Date: 2026-10-24

Changes

• bump dev dependencies: vitest 5.0.5, @vitest/coverage-v8 5.0.5, @types/node 26.6.5, eslint 10.13.0, typescript-eslint 8.72.0, prettier 3.9.10, vite 8.3.5
• bump undici from 6.29.0 to 6.29.1 (fixes two high severity vulnerabilities)

Pytest Coverage Comment 1.12.3

Release Date: 2026-10-03

Changes

• bump dev dependencies: vitest 5.0.3, @vitest/coverage-v8 5.0.3, @types/node 26.6.4, eslint 10.12.0, typescript-eslint 8.71.0, prettier 3.9.9 (#309)
• bump undici from 6.28.0 to 6.29.0 (#309)
• bump brace-expansion from 5.0.8 to 5.0.12 (fixes four security vulnerabilities) (#309)

Pytest Coverage Comment 1.12.2

Release Date: 2026-09-01

Changes

• bump dev dependencies: @types/node 26.4.0, @vercel/ncc 0.45.0, @vitest/coverage-v8 4.1.11, vitest 4.1.11, eslint 10.9.1, typescript-eslint 8.68.0 (#302)

Pytest Coverage Comment 1.12.1

... (truncated)

Commits

• 9516bf7 feat: add annotate-missing-lines option (v1.13.0) (2/2) (#323)
• 344cdca feat: build annotations for uncovered added lines (1/2) (#322)
• 93af7d8 fix: harden coverage table links (v1.12.5) (#318)
• 9984fd6 refactor: share the file link and parent segment helpers (#319)
• dddcc48 fix: escape report values in the coverage table (#316)
• 1c5817d refactor: move html escaping and path encoding helpers to utils (#315)
• e636ecf chore(deps): bump dev dependencies and undici (v1.12.4) (#314)
• c74c83c Bump vite from 8.3.2 to 8.3.5 (#311)
• 947ed4e chore: add OSS Scanner Dockerfile and threat model, security contact email (#...
• c772f8e docs: refresh stale facts in CLAUDE.md (#310)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions