TypeError: Cannot read properties of undefined (reading 'createReview')

I am still in the process of further investigating what could have changed, but I thought I am going to post here in case anyone else has an idea.

As far as we know, nothing changed in the configuration of the token itself or the secret, but suddenly (around 12-24h ago) the setup that we had successfully working for months started failing with:

dependency type: production
security critical: false
config: production:semver:patch
production:semver:patch detected, will auto-merge
Error: Cannot read properties of undefined (reading 'createReview')
TypeError: Cannot read properties of undefined (reading 'createReview')
    at approve ([file:///action/lib/api.js:2:23](https://github.com/ahmadnassri/action-dependabot-auto-merge/blob/master/action/lib/api.js#L2))
    at default (file:///action/lib/index.js:31:11)
    at file:///action/index.js:[53](https://github.com/1debit/dependabot-test/actions/runs/3527941119/jobs/5919738455#step:4:54):7
    at ModuleJob.run (node:internal/modules/esm/module_job:194:25)

The line in question is this:

  await octokit.pulls.createReview({

Which appears to mean that octokit.pulls is undefined, but also that it does not appear to be a permission issue as such with the token since it got that far.

At first I thought that something might have changed on the latest 2.6.1 release from earlier today, but I confirmed that the issue is also still happening with 2.6.0 which as I said before we’ve been using fine for months.

I am also sending this to Github support, but I was wondering whether anyone else has seen this and if yes, whether they found a solution for it.

Thanks in advance.

[leezumstein]

Fairly certain you need to use octokit.rest.<api method> now with the latest version, why it’s throwing an undefined error.

I can open a PR in a bit to update this.

[maciejmakowski]

@mknepprath looking at your PR (https://github.com/mknepprath/mknepprath-next/pull/976), you probably want to go back to @2 now again, otherwise you’ll get stuck on 2.6.2 or will have to continue to update it manually, unlike with @2 where you get update automatically.

Alternatively, you can also set up Dependabot to update your Github Actions too.