fix(deps): update dependency probot to v14

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
probot (source)	^12.3.3 → ^14.0.0

---

Release Notes

probot/probot (probot)

v14.3.2

Compare Source

Bug Fixes

• deps: update dependency yaml to v2.8.3 [security] (79b556e)

v14.3.1

Compare Source

Bug Fixes

• cli: turn off strict args parsing to re-allow using receive command with args (#​2304) (67a30d1)

v14.3.0

Compare Source

Bug Fixes

• receive command failing when LOG_LEVEL is set (#​2296) (556ec16)

Features

• replace dotenv with node native parseEnv, when using deno runtime use deno >2.7.0 (#​2265) (c94ac6e)

v14.2.4

Compare Source

Bug Fixes

• integrate static files (#​2272) (39dcfcd)

v14.2.3

Compare Source

Bug Fixes

• deps: update dependency smee-client to v5 (#​2271) (218f292)

v14.2.2

Compare Source

Bug Fixes

• deps: update octokit monorepo (major) (#​2266) (6370407)

v14.2.1

Compare Source

Bug Fixes

• stop server in run if we send SIGINT (#​2251) (02862ce)

v14.2.0

Compare Source

Features

• replace js-yaml with yaml (#​2255) (c9eda35)

v14.1.0

Compare Source

Features

• remove sourcemaps, ensure only erasableSyntaxOnly is enforced (#​2253) (94b8929)

v14.0.6

Compare Source

Bug Fixes

• deps: update dependency pino to v10 (#​2246) (f1ef4d5)

v14.0.5

Compare Source

Bug Fixes

• deps: update dependency pino-http to v11 (#​2249) (594edd4)

v14.0.4

Compare Source

Bug Fixes

• deps: update dependency @​octokit/types to v15 (#​2245) (8018566)

v14.0.3

Compare Source

Bug Fixes

• correct some TypeScript errors (#​2248) (6717c1f)

v14.0.2

Compare Source

Bug Fixes

• deps: update @​probot/octokit-plugin-config (6f2d021)

v14.0.1

Compare Source

Bug Fixes

• add explicit undefined to optional types, and update webhooks types (#​1979) (05179ff)

v14.0.0

Compare Source

• feat!: v14 (#​2152) (97c4057)

BREAKING CHANGES

• Probot is now an ESM only library
• drop Node > 20.17 and Node 21 support
• Switch to GitHub's OpenAPI specification for Webhooks (from @octokit/webhooks v13)
• Remove legacy REST enpoint method access. Users will now have to use the octokit.rest.* methods
• Remove express server from within Probot.
• All properties marked as private in Typescript, including Probot#state, are now private class fields.
• createNodeMiddleware() is now an async function
• @sentry/node needs to be installed separately if needed
• ioredis needs to be installed separately if needed
• The built-in server now listens on localhost by default instead of 0.0.0.0.

Probot v14 Migration Guide

ESM Only Package

Probot is now exclusively an ESM package. Either migrate to ESM (recommended), or use `require(esm).

Migrating to ESM:

1. Update package.json:

{
  "type": "module"
}

2. Replace all CommonJS require() statements with ESM import syntax
3. Update your TypeScript configuration:

{
  "compilerOptions": {
    "module": "node16",
    "moduleResolution": "node16"
  }
}

For require(esm):

• For TypeScript 5.7-5.8: Use "module": "nodenext" and "moduleResolution": "nodenext"
• For TypeScript 5.9+: Use "module": "node20" and "moduleResolution": "node20"

Node.js Version Requirements

• Minimum supported version: Node.js 20.18+ and 22+
• Node.js 21 support has been dropped

Webhook Type Definitions

Replace webhook type imports:

// Before
import { WebhookEvent } from "@​octokit/webhooks-types";

// After
import { WebhookEvent } from "@​octokit/openapi-webhooks-types-migration";

REST API Access Pattern

Legacy endpoint methods have been removed:

app.on("issues.opened", async (context) => {
  // Before
  // const issue = await context.octokit.issues.get(context.issue());

  // After
  const issue = await context.octokit.rest.issues.get(context.issue());
});

Express Server Removal

The built-in Express server has been removed. To use Express:

1. Install Express:

npm install express

2. Update your Probot setup:

import Express from "express";
import { createNodeMiddleware, createProbot } from "probot";

const express = Express();

const app = (probot) => {
  probot.on("push", async () => {
    probot.log.info("Push event received");
  });
};

const middleware = await createNodeMiddleware(app, {
  webhooksPath: "/api/github/webhooks",
  probot: createProbot({
    env: {
      APP_ID,
      PRIVATE_KEY,
      WEBHOOK_SECRET,
    },
  }),
});

express.use(middleware);
express.use(Express.json());
express.get("/custom-route", (req, res) => {
  res.json({ status: "ok" });
});

express.listen(3000, () => {
  console.log(`Server is running at http://localhost:3000`);
});

HTTP Server no longer listens on 0.0.0.0 by default

The built-in HTTP server will now listen on localhost by default, instead of listening on all available interfaces.
If you wish to change this behaviour, you can use the HOST environment variable, or the --host variable for the probot run command.

env HOST=0.0.0.0 <start script>
probot run --host=0.0.0.0 app.js

Asynchronous Middleware Initialization

createNodeMiddleware() is now asynchronous:

import { createNodeMiddleware } from "probot";
import app from "../app.js";

// Before
// const middleware = createNodeMiddleware(app);

// After
const middleware = await createNodeMiddleware(app);

v13.4.7

Compare Source

Bug Fixes

• update @octokit/webhooks, remove internal rebindLog() function (#​2220) (c4c67c3), closes #​2062

v13.4.6

Compare Source

Bug Fixes

• update @​octokit/auth-app and @​octokit/core to fix logger binding issues (058878b)

v13.4.5

Compare Source

Bug Fixes

• deps: update dependency express to v5 (#​2090) (f6d4c3e)

v13.4.4

Compare Source

Bug Fixes

• deps: update Octokit dependencies that have ReDos vulnerability (816f2f7)

v13.4.3

Compare Source

Bug Fixes

• deps: update dependency @​probot/pino to v3 (#​2140) (7c3a99d)

v13.4.2

Compare Source

Bug Fixes

• memoryleak of octokit hook (#​2129) (2b48a8e)

v13.4.1

Compare Source

Bug Fixes

• ensure that the logger is always bound (#​2119) (cc85a24), closes #​2116

v13.4.0

Compare Source

Features

• allow custom logger for Octokit instances (#​2100) (19954c8)

v13.3.10

Compare Source

Bug Fixes

• deps: use fork of lru-cache to fix type issues (#​2104) (c87926b)

v13.3.9

Compare Source

Bug Fixes

• deps: bump @probot/pino to v2.5.0 (f26cf46), closes #​2102

v13.3.8

Compare Source

Bug Fixes

• deps: bump express to v4.21.0 (#​2085) (4c5310a)

v13.3.7

Compare Source

Bug Fixes

• types: avoid TS2590 errors in Context (#​2073) (23f6eab), closes #​1968

v13.3.6

Compare Source

Bug Fixes

• deps): Revert "fix(deps: update dependency lru-cache to v11" (#​2056) (60ff5b6), closes #​2049

v13.3.5

Compare Source

Bug Fixes

• remove eventsource dependency (#​2052) (caee841)

v13.3.4

Compare Source

Bug Fixes

• ci: Use organization-wide PROBOTBOT_NPM_TOKEN (#​2054) (cc86a53)

v13.3.0

Compare Source

Features

• set x-github-delivery header to event.id for all requests sent from context.octokit in event handlers (#​2027) (12944d5)

v13.2.2

Compare Source

Bug Fixes

• deps: update dependencies pino to v9, pino-http to v10 (#​2007) (ef7b9df)

v13.2.1

Compare Source

Bug Fixes

• probot: passes logger to webhooks (#​2011) (93007b6)

v13.2.0

Compare Source

Features

• security: Configure provenance (#​1997) (3f20320)

v13.1.2

Compare Source

Bug Fixes

• deps: update dependency express to v4.19.2 [security] (b1d3ac3)

v13.1.1

Compare Source

Bug Fixes

• deps: move bottleneck to dependencies (#​1992) (52de532)

v13.1.0

Compare Source

Features

• run: allow passing Octokit and log (#​1984) (d195264)

v13.0.2

Compare Source

Bug Fixes

• deps: update dependency commander to v12 (737835f)

v13.0.1

Compare Source

Bug Fixes

• deps: update dependency pino-http to v9 (#​1953) (5d95b73)

v13.0.0

Compare Source

Features

• v13 (#​1874) (948a1b7), closes #​1643
• Upgrade Octokit libraries to their latest major version

BREAKING CHANGES

• Drop support for NodeJS < 18
• replace node-fetch with the Fetch API
• default webhookPath is now /api/github/webhooks
• probot receive now only supports payloads in JSON format, previously also (unintionally) allowed JS.
• Probot now requires that payloads be passed as string to the .verify(), .verifyAndReceive() methods. Passing objects is no longer supported
• The middleware no longer accepts parsed payloads. You will have to pass it as a string

Note on Vercel deployments:

Set NODEJS_HELPERS environment variable to 0 in order to prevent Vercel from parsing the response body.
See Disable Helpers for detail.

v12.4.0

Compare Source

Features

• set x-github-delivery header to event.id for all requests sent from context.octokit in event handlers (#​2026) (f1985e5)

v12.3.4

Compare Source

Bug Fixes

• probot: passes logger to webhooks (#​2010) (3dcb058)

---

Configuration

📅 Schedule: Branch creation - "before 2am on monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.