Skip to content

chore(deps): consolidate dependency bumps (#273, #260, #259, #258, #257, #256, #242) #284

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
sirdeggen wants to merge 8 commits into from
Closed

chore(deps): consolidate dependency bumps (#273, #260, #259, #258, #257, #256, #242) #284

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
4da12d1
chore(deps): bump the bsv-workspace group across 1 directory with 38 …
dependabot[bot] Jul 13, 2026
9c63a4c
build(deps): bump the infra-deps group across 8 directories with 6 up…
dependabot[bot] Jun 29, 2026
708b94b
build(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0
dependabot[bot] Jul 1, 2026
736b60c
build(deps): bump stefanzweifel/git-auto-commit-action
dependabot[bot] Jul 1, 2026
c6d6de2
chore(deps): bump actions/checkout from 6.0.2 to 7.0.0
dependabot[bot] Jul 14, 2026
5be0b3d
build(deps): bump actions/setup-go from 6.4.0 to 6.5.0
dependabot[bot] Jul 1, 2026
34e5744
build(deps): bump actions/setup-python from 6.2.0 to 6.3.0
dependabot[bot] Jul 1, 2026
797e8f9
fix(deps): align pnpm overrides with workspace bumps
sirdeggen Jul 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ jobs:
node-version: [24.x]

steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
fetch-depth: 0

Expand Down Expand Up @@ -137,7 +137,7 @@ jobs:

- name: Upload coverage to Codecov
if: (steps.scope.outputs.sdk == 'true' || steps.scope.outputs.did == 'true') && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
with:
token: ${{ secrets.CODECOV_TOKEN }}
files: ${{ steps.cov.outputs.files }}
Expand All @@ -156,7 +156,7 @@ jobs:
permissions:
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
fetch-depth: 1

Expand All @@ -183,7 +183,7 @@ jobs:
permissions:
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

- uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/codegen.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,13 +12,13 @@ jobs:
permissions:
contents: write
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

# ── Go types (oapi-codegen) ───────────────────────────────────────────
# NOTE: oapi-codegen does not yet support OpenAPI 3.1 nullable syntax
# (type: [string, null]). Steps are continue-on-error until resolved.
# Upstream: https://github.com/oapi-codegen/oapi-codegen/issues/373
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
- uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
with:
go-version: '1.22'
- name: Install oapi-codegen
Expand Down Expand Up @@ -66,7 +66,7 @@ jobs:
-o conformance/generated/messaging/types.gen.d.ts

@sirdeggen sirdeggen Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nit] actions/setup-python is bumped to SHA ece7cb06caefa5fff74198d8649806c4678c61a1 (correct for v6.3.0) but the trailing comment remains only # v6 instead of # v6.3.0. Same pattern as other minor action bumps—low impact, but reduces pin auditability.

Suggestion: Annotate as # v6.3.0 (and setup-go as # v6.5.0) for consistency with the codecov pin style (# v7.0.0).


# ── Python types (datamodel-code-generator / pydantic v2) ────────────
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
with:
python-version: '3.12'
- name: Install datamodel-code-generator
Expand Down Expand Up @@ -117,7 +117,7 @@ jobs:
EOF

# ── Single commit for all generated files ────────────────────────────
- uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7.1.0
- uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
with:
commit_message: "chore(codegen): regenerate types from OpenAPI specs"
file_pattern: "conformance/generated/**"
2 changes: 1 addition & 1 deletion .github/workflows/conformance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ jobs:
ts-runner:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version: '24'
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/docs-deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ jobs:
permissions:
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
fetch-depth: 0

Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/infra-release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ jobs:
matrix: ${{ steps.set.outputs.matrix }}
count: ${{ steps.set.outputs.count }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

- name: Log in to GHCR (for manifest probes)
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
Expand Down Expand Up @@ -89,7 +89,7 @@ jobs:
matrix:
component: ${{ fromJson(needs.discover.outputs.matrix) }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

# Refresh this component's package-lock.json before building. Infra
# components are NOT in the pnpm workspace; their npm lockfiles go stale
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ jobs:
pull-requests: write

steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
fetch-depth: 0

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/wab-marketplace-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ jobs:
id-token: write # OIDC: assume the seller-account publisher role (no static keys)
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

- name: Require WAB_MP_ROLE_ARN
run: |
Expand Down
2 changes: 1 addition & 1 deletion conformance/runner/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,6 @@
},
"devDependencies": {
"ts-standard": "^12.0.0",
"typescript": "^6.0.3"
"typescript": "^7.0.2"
}
}
2 changes: 1 addition & 1 deletion conformance/runner/ts/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,6 @@
"@jest/globals": "^30.4.1",
"jest": "^30.4.2",
"ts-jest": "^29.4.11",
"typescript": "^6.0.3"
"typescript": "^7.0.2"
}
}
14 changes: 7 additions & 7 deletions docs-site/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,26 +13,26 @@
"@mdx-js/react": "^3.1.0",
"react": "^19.2.7",
"react-dom": "^19.2.7",
"react-router-dom": "^6.28.0"
"react-router-dom": "^7.18.1"

@sirdeggen sirdeggen Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[suggestion] react-router-dom major bump ^6.28.0 → ^7.18.1 for the docs site. v7 keeps a compatibility surface for many v6 DOM APIs, and current imports (Link, NavLink, Outlet, useLocation, RouteObject) are still re-exported, so this is likely fine—but it is still a major framework bump in a static docs SSG path (vite-react-ssg) and should not ride silently inside a deps-consolidation PR without a docs build verification.

Suggestion: Ensure the docs-validate / docs-deploy jobs pass on this branch (they should), and skim for any future-flag or loader-related deprecations if the site later adopts data APIs. No code change required if the existing docs CI is green.

},
"devDependencies": {
"@mdx-js/rollup": "^3.1.0",
"@shikijs/rehype": "^4.2.0",
"@shikijs/rehype": "^4.3.1",
"@types/react": "^19.2.17",
"@types/react-dom": "^19.2.3",
"@vitejs/plugin-react": "^6.0.2",
"@vitejs/plugin-react": "^6.0.3",
"ajv": "^8.17.0",
"ajv-formats": "^3.0.1",
"gray-matter": "^4.0.3",
"mermaid": "^11.0.0",
"mermaid": "^11.16.0",
"pagefind": "^1.1.0",
"rehype-autolink-headings": "^7.0.0",
"rehype-slug": "^6.0.0",
"remark-frontmatter": "^5.0.0",
"remark-gfm": "^4.0.0",
"remark-mdx-frontmatter": "^5.0.0",
"typescript": "^6.0.3",
"vite": "^8.0.16",
"vite-react-ssg": "^0.9.0"
"typescript": "^7.0.2",
"vite": "^8.1.4",
"vite-react-ssg": "^0.9.1"
}
}
8 changes: 4 additions & 4 deletions infra/chaintracks-server/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion infra/chaintracks-server/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@
},
"devDependencies": {
"@types/express": "^5.0.6",
"@types/node": "^26.0.0",
"@types/node": "^26.0.1",
"ts-node": "^10.9.2",
"typescript": "^6.0.3"
},
Expand Down
51 changes: 27 additions & 24 deletions infra/message-box-server/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

10 changes: 5 additions & 5 deletions infra/message-box-server/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,14 +28,14 @@
"@types/jest": "^30.0.0",
"@types/knex": "^0.16.1",
"@types/mock-knex": "^0.4.8",
"@types/node": "^26.0.0",
"@types/node": "^26.0.1",
"@types/prettyjson": "^0.0.33",
"@types/superagent": "^8.1.10",
"@types/supertest": "^7.2.0",
"@types/swagger-jsdoc": "^6.0.4",
"@types/swagger-ui-express": "^4.1.8",
"@types/web-push": "^3.6.4",
"axios": "^1.17.0",
"axios": "^1.18.1",
"axios-mock-adapter": "^2.1.0",
"better-sqlite3": "^12.10.0",
"ejs": "^6.0.1",
Expand Down Expand Up @@ -80,9 +80,9 @@
"body-parser": "^2.2.2",
"dotenv": "^17.4.2",
"express": "^5.2.1",
"firebase-admin": "^14.0.0",
"knex": "^3.2.10",
"mongodb": "^7.2.0",
"firebase-admin": "^14.1.0",
"knex": "^3.3.0",
"mongodb": "^7.4.0",
"mysql2": "^3.22.5",
"pino": "^10.3.1",
"prettyjson": "^1.2.5",
Expand Down
Loading
Loading