chore(deps-dev): bump the all-dependencies group with 4 updates - #89
Closed
dependabot[bot] wants to merge 1 commit into
Closed
chore(deps-dev): bump the all-dependencies group with 4 updates#89dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the all-dependencies group with 4 updates: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [eslint](https://github.com/eslint/eslint), [typescript](https://github.com/microsoft/TypeScript) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint). Updates `@types/node` from 26.1.1 to 26.2.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint` from 10.7.0 to 10.8.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.7.0...v10.8.1) Updates `typescript` from 6.0.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) Updates `typescript-eslint` from 8.66.0 to 8.67.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: eslint dependency-version: 10.8.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: all-dependencies - dependency-name: typescript-eslint dependency-version: 8.67.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
You have reached your Codex usage limits for security reviews. Please try again later. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 185ef346eb
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| "prettier": "^3.4.2", | ||
| "ts-add-js-extension": "^1.6.6", | ||
| "typescript": "^6.0.3", | ||
| "typescript": "^7.0.2", |
There was a problem hiding this comment.
When pnpm check invokes ESLint, it loads typescript-eslint; however, the updated lockfile declares typescript >=4.8.4 <6.1.0 for @typescript-eslint/parser, typescript-estree, and the related 8.67.0 packages, while this line resolves TypeScript 7.0.2. This leaves the lint toolchain using an explicitly unsupported compiler major and can cause peer-strict installations or TypeScript linting in CI to fail; retain TypeScript 6.0.x until a typescript-eslint release declares TypeScript 7 support, or upgrade both to compatible versions.
Useful? React with 👍 / 👎.
Contributor
Author
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/all-dependencies-6bc28699f8
branch
August 24, 2026 22:27
satvik007
pushed a commit
that referenced
this pull request
Aug 25, 2026
…e-age gate, pin lint toolchain (#90) * fix(deps): promote vite to a direct devDependency and clear open advisories pnpm-lock.yaml pinned vite@8.0.0, which is in the vulnerable range of five open advisories (three high): - Arbitrary file read via dev server WebSocket <=8.0.4 (fixed 8.0.5) - `server.fs.deny` bypassed with queries <=8.0.4 (fixed 8.0.5) - Path traversal in optimized deps `.map` <=8.0.4 (fixed 8.0.5) - `server.fs.deny` bypass on Windows alt paths <=8.0.15 (fixed 8.0.16) - launch-editor NTLMv2 disclosure on Windows <=8.0.15 (fixed 8.0.16) None are reachable here: all require a listening Vite dev server, and `vitest run` uses vite only as an in-process transform pipeline. vite is also dev-only and `files` publishes just build/**, so it never reaches consumers. This is noise reduction and hygiene, not an incident. The reason it went stale is structural. Dependabot runs with `dependency-type: direct` and `update-subdependencies: false`, and vite is an auto-installed *peer* of vitest -- so the `all-dependencies: '*'` group never matched it and nothing in the repo would ever have bumped it. `pnpm update vite` and `pnpm dedupe` both no-op on it for the same reason. Declaring it directly is what puts it back under Dependabot's control. Also drops a duplicate brace-expansion@5.0.7 (itself vulnerable to two open DoS advisories, fixed in 5.0.8/5.0.9) that the old rolldown pulled in; only the already-present 5.0.9 copy remains. Resolution delta is limited to vite 8.0.0 -> 8.2.1, rolldown 1.0.0-rc.9 -> 1.2.4, and the removal of brace-expansion@5.0.7 / minimatch@10.2.5 / tslib@2.8.1. 8.2.2 is current but <7 days old, so minimumReleaseAge lands us on 8.2.1, well past every patch above. * chore(ci): align Dependabot with the pnpm release-age gate and pin the lint toolchain Three related fixes to the weekly Dependabot run, which has been failing or landing incomplete PRs. 1. cooldown: default-days: 8 pnpm-workspace.yaml sets minimumReleaseAge: 10080 (7 days), but Dependabot proposes releases the day they ship. Its pnpm job then aborts: Error running package manager command: corepack pnpm update globals@17.11.0 [ERR_PNPM_NO_MATURE_MATCHING_VERSION] Version 17.11.0 (released 5 days ago) of globals does not meet the minimumReleaseAge constraint That killed the npm update job on both 2026-08-10 and 2026-08-17. The failure is not just noisy: it aborts mid-group, so #89 landed with 4 of the ~8 available bumps and nothing indicated the rest were dropped. A cooldown slightly above minimumReleaseAge keeps Dependabot from ever proposing a version pnpm will refuse. 2. ignore typescript major typescript-eslint hard-throws (not warns) on TS >= 7: if (versionMajor >= 7) { throw new Error('typescript-eslint does not support TS 7.0.') } There is no released version that unblocks this -- latest is 8.67.0, there is no 9.x, and they are explicitly targeting TS >= 7.1, skipping 7.0 entirely (typescript-eslint#10940, still open). TS 7.0 is designed by Microsoft to run side-by-side with 6.0 for exactly this reason. Meanwhile TS 7's headline win is compile speed, and `pnpm typecheck` here takes ~5s -- so the upgrade costs us the linter and buys nothing. Ignoring the major stops the weekly red PR; delete the rule when typescript-eslint ships 7.1 support. 3. Exact-pin eslint / prettier / typescript-eslint These carets had drifted badly -- `prettier: ^3.4.2` was resolving to 3.9.6, five minors ahead of what package.json claimed. That invisible drift is the root cause the dependabot-autoformat workflow was written to paper over: an unrelated bump regenerates the lockfile, silently moves prettier, and reformats sources. Pinning makes any change to the formatting toolchain an explicit, reviewable diff. Pinned at the versions already resolved in the lockfile, so this changes no package versions at all -- only the recorded specifiers. The autoformat workflow is kept: an explicit bump of one of these three can still reformat, and Dependabot still won't run project scripts. Its header comment is updated to describe that narrower remaining role.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the all-dependencies group with 4 updates: @types/node, eslint, typescript and typescript-eslint.
Updates
@types/nodefrom 26.1.1 to 26.2.0Commits
Updates
eslintfrom 10.7.0 to 10.8.1Release notes
Sourced from eslint's releases.
... (truncated)
Commits
c049dc310.8.1a3f7826Build: changelog update for 10.8.118eb0a7fix: prevent ASI hazard inno-unused-labelsautofix (#21173)0a14800chore: update github/codeql-action action to v4.37.4 (#21196)7d0cbf8docs: Update README05adcb1test: fix failing ecosystem test foreslint-plugin-unicorn(#21191)5611035test: add error locations info tono-void(#21185)ee47333ci: bump github/codeql-action from 4 to 4.37.3 (#21176)f131c03chore: improve ecosystem test failure reporting (#20937)0a05812docs: add missing backticks tono-duplicate-imports.js(#21183)Updates
typescriptfrom 6.0.3 to 7.0.2Commits
Maintainer changes
This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.
Updates
typescript-eslintfrom 8.66.0 to 8.67.0Release notes
Sourced from typescript-eslint's releases.
Changelog
Sourced from typescript-eslint's changelog.
Commits
20a261fchore(release): publish 8.67.0c245fbbfeat(typescript-eslint): export basic globs for using tseslint (#12105)3b155bbchore: use typescript 7 for typechecking (#12601)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions