[dependabot]

Bumps joi from 17.13.8 to 17.13.9.

Commits

• 5af4530 17.13.9
• a8f1f03 fix: rename to prototype-named keys
• dae9467 fix: reject proto as a messages language
• 595f931 Merge pull request #3163 from hapijs/fix/email-multiple-split-v17
• 807858d fix: linear split for email multiple
• See full diff in compare view

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one): 1

• coderabbit

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: mozilla/fxa
• Branch: main
• File: .coderabbit.yaml
• Commit: 387469d
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 68650bb8-3c6f-436f-aad6-9cc1ceac9bc4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[mozilla-blender]

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

joi 17.13.8 is installed, but no code in the repo calls string().email({ multiple: true }), the only vulnerable path. Every .email() call uses literal options without multiple. Bump to 17.13.9 anyway.

This PR can be reviewed and merged as a normal dependency update.

[mozilla-blender]

Note: This PR has failing CircleCI checks.
BLEnder cannot access CircleCI log output, so it
may not be able to diagnose or fix the failure.
Consider migrating CI to GitHub Actions so BLEnder
can read failure logs directly.

[mozilla-blender]

BLEnder picked up this PR. Workflow run

[mozilla-blender]

BLEnder could not fix this PR automatically. Workflow run

I couldn't reproduce either failure, so I haven't changed anything and haven't written .blender-commit-msg.

Why I couldn't reproduce it:

• There are no CircleCI logs for either check.
• I couldn't install the new joi 17.13.9. The sandbox blocked access to the package registry (registry.yarnpkg.com and registry.npmjs.org), so yarn install stopped at the download step and I couldn't run any tests.

What the lockfile shows:

• The dependency resolution step of yarn install --immutable passed, so yarn.lock matches the package.json changes. That rules out lockfile drift.
• After this bump there are two copies of joi: 17.13.9 for the five packages that were bumped, and 17.13.8 for anything that asks for 17.x.x or ^17.3.0.

A joi patch release is unlikely to break the Playwright functional tests. Those tests also sit behind a manual approval step, so the failure may be unrelated or flaky. test_pull_request is probably just the CircleCI workflow status, failing because the Playwright job failed. That's a guess, though, not a confirmed root cause.

Next steps: a re-run of the Playwright job, or its log output, would show whether this bump is actually the cause.

[mozilla-blender]

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 89%, no advisories).