[SUPPORT]: Trouble upgrading Octokit with dependabot

[Van-Romel]

What happened?

The reported CVE is blocking the Dependabot upgrade.

Versions

"@octokit/core": "^7.0.2",
"@octokit/rest": "^21.1.1",
"@octokit/request": "^10.0.0",
"@octokit/request-error": "^7.0.0",
"@octokit/plugin-paginate-rest": "^13.0.0",

Relevant log output

Dependabot cannot update @octokit/plugin-paginate-rest to a non-vulnerable version
The latest possible version that can be installed is 2.21.3 because of the following conflicting dependencies:

> @octokit/rest@21.1.1 requires @octokit/plugin-paginate-rest@^11.4.2
> @probot/adapter-azure-functions@1.1.0 requires @octokit/plugin-paginate-rest@^2.6.2 via probot@12.3.3
> probot@13.4.5 requires @octokit/plugin-paginate-rest@11.4.4-cjs.2
> No patched version available for @octokit/plugin-paginate-rest

The earliest fixed version is 9.2.2.

Code of Conduct

• I agree to follow this project's Code of Conduct

[github-actions]

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

[wolfy1339]

Please don't manually mix Probot and Octokit packages together.

You can safely drop all of your defined Octokit dependencies. Probot currently cannot use the most recent versions of Octokit as it is still CJS, however it is utilizing versions that contain the fix.

This is not an Octokit bug, the CVE was fixed and pushed out to other packages.

[wolfy1339]

This is a dependabot bug, since the CVE/GHSA is marked as fixed for the referenced version.
11.4.4-cjs.2 is a safe and fixed version

[Van-Romel]

I got it. Many thanks.

[wolfy1339]

For reference, this is the GHSA dependabot seems to be choking on
GHSA-h5c3-5r3r-rr8q