chore(deps-dev): bump the dev-dependencies group with 6 updates - #297
Merged
Merged
Conversation
Rebuilds #294 against beta. That PR was opened against main and its lockfile no longer applies; four of its ten bumps (@octokit/core, globals, js-yaml, tsx) already landed on beta, so only six remain: @types/node ^26.4.1 -> ^26.5.1 @typescript-eslint/eslint-plugin ^8.69.0 -> ^8.70.0 @typescript-eslint/parser ^8.69.0 -> ^8.70.0 typescript-eslint ^8.69.0 -> ^8.70.0 cz-emoji-conventional ^1.1.0 -> ^1.3.0 eslint ^10.9.1 -> ^10.10.0 All dev-only. None is imported from src/, so none reaches the bundle esbuild produces. npm refused to re-resolve the typescript-eslint trio out of the existing lock (ERESOLVE, reporting a peer conflict that does not reproduce in a clean tree), so the twelve @typescript-eslint/* lock entries were dropped and re-resolved rather than regenerating the whole file, which would have floated every other caret range at the same time.
Contributor
🛡️ Security Hardening Pipeline ResultsBranch: Workflow Run: 434 Scan Status
Summaries Collected: 4 Scanner Results🔬 CodeQL SAST (Javascript)Status: Completed Findings Summary
No security findings detected for Javascript. Artifacts: CodeQL Reports (Javascript) 🔗 Dependency ReviewStatus: ✅ No issues found No vulnerable or license-violating dependencies detected in this PR. 🔑 Gitleaks (Secrets)No 🔑 Gitleaks (Secrets) findings summary was produced. 📦 OSV (Dependencies)No 📦 OSV (Dependencies) findings summary was produced. Generated by Argus Generated by Argus |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Rebuilds #294 against
beta. That PR was opened againstmainand itspackage-lock.jsonno longer applies — retargeting it tobetaconflicts.Type of Change
Changes Made
Four of #294's ten bumps already landed on
beta(@octokit/core,globals,js-yaml,tsx). The remaining six:@types/node@typescript-eslint/eslint-plugin@typescript-eslint/parsertypescript-eslintcz-emoji-conventionaleslintAll dev-only, all minor or patch.
dependenciesis empty and esbuild bundles only whatsrc/imports — none of these is imported fromsrc/, so the packaged extension is byte-identical in composition.Lockfile
npmwould not re-resolve thetypescript-eslinttrio out of the existing lock: it reportsERESOLVEclaiming@typescript-eslint/parser@8.70.0conflicts with@typescript-eslint/eslint-plugin@8.70.0's peer on^8.70.0, while actually holdingtypescript-eslintat 8.69.0. The same version set resolves without complaint in a clean tree, so it is the stale lock entries, not an upstream conflict.Rather than delete and regenerate the whole lockfile — which would float every other caret range in the same commit — the twelve
node_modules/@typescript-eslint/*entries were dropped andnpm install --package-lock-onlyre-resolved just those.Resulting lockfile changes, all accounted for:
@typescript-eslint/*family to 8.70.0undici-types8.3.0 → 8.9.0 (from@types/node)@eslint/plugin-kit,file-entry-cache,flat-cache,flatted,keyv(eslint 10.10.0 moved to the newer flat-cache stack)keyvdeduped to a single hoisted 5.6.0, removing four nested copies andjson-bufferNo other package changed version.
Testing
Run with npm 10 to match CI (Node 22):
npm ci— clean, 727 packages. This is the gate that catches an out-of-sync lockfile.npm test— 406 passingnpm run lint— clean at--max-warnings 0, on the new eslint and typescript-eslintnpx tsc --noEmit— cleanThe lint and typecheck runs matter most here: the typescript-eslint bump is the one that could have broken something, and it did not.
Related
Closes #294 once merged. Dependabot targets
betaas of #296, so the next group PR will be built against the right branch.Checklist