chore(deps): rolling dependency update - #235
socket-pr-bot[bot] wants to merge 1 commit into
Conversation
socket-pr-bot
Bot
added
automation
dependencies
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
Bugbot Autofix prepared a fix for the issue found in the latest run.
- ✅ Fixed: Vitest patch dropped after version bump
- Restored the vitest@5.0.1 patchedDependencies entry and lockfile patch hash so install applies patches/fleet/vitest@5.0.1.patch.
Or push these changes by commenting:
@cursor push f3a6f4d0b2
Preview (f3a6f4d0b2)
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -558,6 +558,7 @@
node-gyp@12.4.0: 140ba43d43d74f7d3577feb3f8a6efad544dbb0059784102b144a0e2daa437f9
pony-cause@2.1.11: 39b2eb2567818b7c60126d03e252dbbabd8738082fca850582300d45b0a8cfb8
run-local-ci@0.18.1: a335253820e963c2659ec1b08ee143e865eb39ec80ca7d313fff50c33e157d99
+ vitest@5.0.1: 065993cceebda16dedb4662626ed60c0aeb40f02240c8d0e540b4dc6d9674df2
importers:
@@ -880,7 +881,7 @@
version: 6.0.2
vitest:
specifier: 'catalog:'
- version: 5.0.1(@types/node@26.6.2)(@vitest/coverage-v8@5.0.1)(@vitest/ui@5.0.1)(vite@8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.48.0)(yaml@2.9.1))
+ version: 5.0.1(patch_hash=065993cceebda16dedb4662626ed60c0aeb40f02240c8d0e540b4dc6d9674df2)(@types/node@26.6.2)(@vitest/coverage-v8@5.0.1)(@vitest/ui@5.0.1)(vite@8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.48.0)(yaml@2.9.1))
vitiate:
specifier: 'catalog:'
version: 0.3.1(typescript@7.1.0-dev.20260921.1)(vite@8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.48.0)(yaml@2.9.1))(vitest@5.0.1)
@@ -9506,7 +9507,7 @@
obug: 2.1.4
std-env: 4.2.0
tinyrainbow: 3.1.1
- vitest: 5.0.1(@types/node@26.6.2)(@vitest/coverage-v8@5.0.1)(@vitest/ui@5.0.1)(vite@8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.48.0)(yaml@2.9.1))
+ vitest: 5.0.1(patch_hash=065993cceebda16dedb4662626ed60c0aeb40f02240c8d0e540b4dc6d9674df2)(@types/node@26.6.2)(@vitest/coverage-v8@5.0.1)(@vitest/ui@5.0.1)(vite@8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.48.0)(yaml@2.9.1))
'@vitest/istanbul-lib-coverage@1.0.1': {}
@@ -9537,7 +9538,7 @@
pathe: 2.0.3
sirv: 3.0.2
tinyrainbow: 3.1.1
- vitest: 5.0.1(@types/node@26.6.2)(@vitest/coverage-v8@5.0.1)(@vitest/ui@5.0.1)(vite@8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.48.0)(yaml@2.9.1))
+ vitest: 5.0.1(patch_hash=065993cceebda16dedb4662626ed60c0aeb40f02240c8d0e540b4dc6d9674df2)(@types/node@26.6.2)(@vitest/coverage-v8@5.0.1)(@vitest/ui@5.0.1)(vite@8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.48.0)(yaml@2.9.1))
'@vitest/utils@5.0.1':
dependencies:
@@ -9558,7 +9559,7 @@
magic-string: 1.4.1
valibot: 1.4.2(typescript@7.1.0-dev.20260921.1)
vite: 8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.48.0)(yaml@2.9.1)
- vitest: 5.0.1(@types/node@26.6.2)(@vitest/coverage-v8@5.0.1)(@vitest/ui@5.0.1)(vite@8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.48.0)(yaml@2.9.1))
+ vitest: 5.0.1(patch_hash=065993cceebda16dedb4662626ed60c0aeb40f02240c8d0e540b4dc6d9674df2)(@types/node@26.6.2)(@vitest/coverage-v8@5.0.1)(@vitest/ui@5.0.1)(vite@8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.48.0)(yaml@2.9.1))
transitivePeerDependencies:
- '@swc/helpers'
- typescript
@@ -12099,7 +12100,7 @@
terser: 5.48.0
yaml: 2.9.1
- vitest@5.0.1(@types/node@26.6.2)(@vitest/coverage-v8@5.0.1)(@vitest/ui@5.0.1)(vite@8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.48.0)(yaml@2.9.1)):
+ vitest@5.0.1(patch_hash=065993cceebda16dedb4662626ed60c0aeb40f02240c8d0e540b4dc6d9674df2)(@types/node@26.6.2)(@vitest/coverage-v8@5.0.1)(@vitest/ui@5.0.1)(vite@8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.48.0)(yaml@2.9.1)):
dependencies:
'@types/chai': 5.2.3
'@vitest/mocker': 5.0.1(vite@8.3.0(@types/node@26.6.2)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.48.0)(yaml@2.9.1))
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -588,6 +588,7 @@
# This preserves membership and bounds matcher memory for fleet coverage.
# CPU-profiled forks use the configured teardown deadline to flush profiles.
# Ordinary forks retain the upstream 500 ms termination grace.
+ vitest@5.0.1: patches/fleet/vitest@5.0.1.patch
# Indirects the `node-gyp/bin/node-gyp.js` require.resolve so the rolldown
# bundle doesn't statically inline node-gyp; consumer: pacote → run-script
# in the bundled dist tree.You can send follow-ups to the cloud agent here.
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 6e16c13. Configure here.
| # This preserves membership and bounds matcher memory for fleet coverage. | ||
| # CPU-profiled forks use the configured teardown deadline to flush profiles. | ||
| # Ordinary forks retain the upstream 500 ms termination grace. | ||
| vitest@5.0.0: patches/fleet/vitest@5.0.0.patch |
There was a problem hiding this comment.
Vitest patch dropped after version bump
High Severity
Bumping vitest to 5.0.1 removed the patchedDependencies entry. patches/fleet/vitest@5.0.1.patch is present and still applies exclude-first coverage matching plus the CPU-prof teardownTimeout SIGKILL override, but the lockfile installs unpatched vitest@5.0.1. Coverage membership and profiled-fork teardown therefore revert to upstream.
Reviewed by Cursor Bugbot for commit 6e16c13. Configure here.
Rolling dependency update
One long-lived PR, rebuilt from
mainon every run so it staysmergeable. Each run appends its dependency delta below, newest first.
2026-09-29 — run · 32 updated
@babel/parser@inquirer/checkbox@inquirer/confirm@inquirer/input@inquirer/password@inquirer/search@inquirer/select@mdn/browser-compat-data@perryts/perry@sigstore/protobuf-specs@types/node@vitest/coverage-v8@vitest/uiast-v8-to-istanbulata-validatorfallowfast-checkget-east-asian-widthglobalslibnpmpackmagic-stringmarkdownlint-cli2oxlint-tsgolintp-mapregjsparsertypeboxtypescriptvitevitestwebpackyamlzodcommits
Note
Medium Risk
Wide dev/CI toolchain and validation-library bumps (Vite, Vitest, Zod, Webpack) can affect builds and tests; removing the Vitest patch assumes upstream 5.0.1 covers prior fleet coverage behavior.
Overview
This rolling update refreshes fleet-wide catalog pins and matching pnpm overrides in
pnpm-workspace.yamlfor 32 packages, keeping the monorepo on a single resolved tree.Notable toolchain moves include Vitest and
@vitest/*5.0.0 → 5.0.1, Vite 8.2.2 → 8.3.0, a newer TypeScript 7.1 dev build, webpack 5.111.1, and zod 4.6.5. Several override-only bumps align transitives with those pins (e.g. magic-string 1.4.1, postcss 8.5.28, hono 4.13.8, js-yaml / lru-cache), and brace-expansion overrides are corrected to 5.0.12 so they match the catalog and patch key.The
patchedDependenciesentry forvitest@5.0.0is dropped as part of the Vitest bump (no replacement pin is added in this diff).Reviewed by Cursor Bugbot for commit 6e16c13. Configure here.