Conversation
Regenerate all npm lockfiles to the latest versions within the existing semver ranges (node 24 / npm 11, lockfileVersion 2) across the root, dash-renderer, the three component packages, and dash-component-plugins. No direct dependency crosses a major boundary. This supersedes the stale, failing dependabot PRs, which had bundled breaking majors (eslint 9, typescript 6, webpack-cli 7, react-window 2, Babel 8). - renderer: pin transitive types-ramda to 0.29.2 via a scoped override. @types/ramda 0.29.1 pulls types-ramda, which within its range jumped to 0.29.10 and tightened keys() to `extends object`, breaking the type check with 37 tsc errors. Also bump webpack-cli to ^7 to match the component packages (verified building). - dash-table: webpack-dev-server 5.2.4 -> 5.2.6 (security, closes #3868). - dependabot.yml: ignore the majors that break the build so stale red PRs stop reopening: typescript >=6, @babel/* >=8, babel-loader >=10, react-window >=2 (dcc), @types/ramda >=0.30 (renderer). Verified on node 24: renderer build/eslint/prettier/karma (85), dash-core-components build/es-check/eslint/jest (85), dash-table and dash-html-components build/es-check/eslint, dash-component-plugins build. Supersedes #3868, #3869, #3890, #3904, #3905, #3906, #3910, #3917-#3920.
Contributor
Dash performance benchmarks
growth = late-third / early-third per-op time; ~1 is flat, a large value means the per-op cost scales with accumulated state. machine scale vs baseline: 0.80x - divided out of the baseline ratios so they compare like for like (the absolute warn/fail ceilings are left un-scaled); calibrated on |
Two CI failures from the first pass: - dash-renderer, dash-html-components and dash-component-plugins have no .npmrc, so CI installs them with plain `npm ci` (no legacy-peer-deps). Their locks were generated with --legacy-peer-deps, which relaxed peer resolution and picked an inconsistent ajv, so plain `npm ci` rejected them (ajv 6.15.0 vs 8.20.0). Regenerated those three without the flag. Root, dash-core-components and dash-table keep --legacy-peer-deps to match their own .npmrc. - dash-table: d3-format 3.1.0 -> 3.1.2 changed significant-digit formatting and broke a js-unit test (expected '0.0', got '0'). Pinned d3-format to 3.1.0 (it is not in the table's dependabot allow list, so it was never meant to move here). Verified with plain `npm ci` on renderer/html/plugins, legacy `npm ci` on root/dcc/table, renderer karma 85/85, and table karma 786/786.
|
camdecoster
reviewed
Sep 17, 2026
camdecoster
left a comment
camdecoster
left a comment
Contributor
There was a problem hiding this comment.
This all seems fine. I just had one question before approving.
| "typescript": "^5.8.3", | ||
| "webpack": "^5.104.1", | ||
| "webpack-cli": "^5.1.4", | ||
| "webpack-cli": "^7.0.3", |
Contributor
There was a problem hiding this comment.
This is a major update, contradicting the PR description. Was this intentional?
Contributor
Author
There was a problem hiding this comment.
. Also bumped webpack-cli ^5 -> ^7 to match the component packages (verified building).
I think it's fine, the other packages were already on 7, this one had drifted.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
A single consolidated dependency-update PR to replace the batch of stale, failing dependabot PRs. All six npm lockfiles are regenerated to the latest versions within the existing semver ranges (node 24 / npm 11, preserving
lockfileVersion 2): root,dash/dash-renderer,components/dash-core-components,components/dash-table,components/dash-html-components, and@plotly/dash-component-plugins.No direct dependency crosses a major boundary. The open dependabot PRs fail because they bundle breaking majors (eslint 9, typescript 6/7, webpack-cli 7, react-window 2, Babel 8). Per a conservative policy, this PR takes every safe minor/patch/security bump and holds the breakers.
Notable changes
@types/ramda@0.29.1transitively pullstypes-ramda, which within its range jumped 0.29.2 -> 0.29.10 and tightenedkeys()'s generic toextends object, breakingkeys<string>(...)insrc/actions/callbacks.tswith 37tscerrors. Pinnedtypes-ramdato 0.29.2 via a scopedoverridesentry (dev-only typings, no source change). Also bumpedwebpack-cli^5->^7to match the component packages (verified building).webpack-dev-server5.2.4 -> 5.2.6 (security, closes Bump webpack-dev-server from 5.2.4 to 5.2.6 in /components/dash-table in the npm-dependencies-security group across 1 directory #3868).ignoreentries so the majors that break the build stop reopening red PRs:typescript >=6,@babel/* >=8,babel-loader >=10(all npm dirs),react-window >=2(dcc),@types/ramda >=0.30(renderer, to stay in sync with the override). eslint/prettier/@typescript-eslint were already locked by the existing allow-lists.Verification (all on node 24, CI's version)
Known held vulnerabilities
Two dev/build-only advisories remain, fixable only by breaking majors, so held under the conservative policy:
elliptic(vianode-polyfill-webpack-plugin, browser crypto polyfill; needs the plugin's v4 major)serialize-javascript(viamochatest runner; needs mocha 12)Supersedes
Stale dependabot PRs: #3868, #3869, #3890, #3904, #3905, #3906, #3910, #3917, #3918, #3919, #3920. These should be closed once this merges.
Follow-ups (not in this PR)
@plotly/dash-component-pluginshas nodependabot.ymlentry (its 4 stale PRs Bump @babel/core, @babel/preset-env, @babel/preset-react and babel-loader in /@plotly/dash-component-plugins #3917-Bump webpack from 5.99.6 to 5.109.2 in /@plotly/dash-component-plugins #3920 predate the current allow-lists). Its lock is refreshed here, but it has no ongoing dependabot coverage; adding a restricted entry is a separate decision.@plotly/eslint-config-dash, test-component packages, etc.) are likewise not covered by dependabot. No open PRs today; noting the gap.