Gar

report.excludeNetwork is probably the path of least resistance here. We should get that in sooner than later.

This CI check is no longer needed, not even in PRs. At the risk of putting the burden back on a human instead of an automated check, new dependency PRs...

Let's call it a loose definition of 'automatically'. External PRs have an approval gate but it's still part of the PR process that github does automatically.

The every commit for external contributors is a security measure we can't really budge on. If you want to add language that assures folks we are more than happy to...

And on a personal note I want to reassure you your recent activity on a LOT of different repos here has been greatly appreciated. Commit all you want, update your...

the autorelease tags that release-please uses are definitely needed

Fixup only works if you're going to be squashing the PR, unfortunately. Github PR squash-merge doesn't account for them.

Yay the footer worked! I'll have to remember that.

Yeah iirc that `ref: false` was intentional because we don't want to keep the event loop open if the retry isn't needed. We'll need to take a deeper look at...

> Update engines to reflect reality, without changing the major version. Pinning is fine, since we won't update npm itself until we've updated engines and have a newer version ready.