Repository navigation
chore: bump the development-tooling group across 1 directory with 5 updates - #70
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
I reviewed this PR and didn't find any bugs. It includes a major vitest bump (4.1.11 to 5.0.1), so someone should still confirm that CI passes and decide whether to accept the upgrade.
What was reviewed:
- package.json and package-lock.json match: all five pins resolve to the new versions, typescript stays at 7.0.2, and the overrides block is unchanged.
- vitest.config.ts and vitest.mcp.config.ts only use
defineConfigwithinclude,excludeandtestTimeout, so the config is unlikely to break. CI runs on Node 24, which vitest 5 supports. - vitest 5 needs Node
^22.12.0 || ^24.0.0 || >=26.0.0, but package.json still declares>=22. Local runs on Node 22.0 to 22.11, 23 or 25 would fall outside what vitest supports.
Extended reasoning...
The PR only changes devDependencies in package.json and package-lock.json (@ types/node, prettier, tsx, vite, vitest) and touches no security-sensitive code. Lockfile entries point to registry.npmjs.org with integrity hashes. The vitest major bump moves several transitive packages to new majors (magic-string 0.30 to 1.4, tinybench 2 to 6) and drops the separate @ vitest/* 4.x packages. A major change to the test runner is better confirmed by CI and a human than approved automatically.
d9da30a to
eb04dd1
Compare
There was a problem hiding this comment.
I reviewed this PR and didn't find any bugs in the diff. It includes a major Vitest bump (4 to 5), and the existing overrides now pin versions below the new transitive ranges, so a human should check both before merging.
What was reviewed:
- Overrides vs. new ranges in package-lock.json:
magic-string1.4.1 (pulled in by vitest 5 and @ vitest/mocker 5) asks for@ jridgewell/sourcemap-codec ^1.6.0, but the override forces 1.5.5.vite8.3.0 asks forpostcss ^8.5.28, but the override forces 8.5.25. npm will install the pinned versions anyway, so it's worth deciding whether those pins are still wanted or should move up. - Vitest 5 compatibility:
vitest.config.tsonly setstest.exclude, and the tests only importdescribe/it/test/expect/afterEach. CI'snpm teston Node 24 will run this suite. - Engines: vitest 5 requires Node
^22.12.0 || ^24.0.0 || >=26.0.0, which is narrower than this package's>=22.
Extended reasoning...
This Dependabot PR only touches dev tooling in package.json and package-lock.json: @ types/node, prettier, tsx, vite, and a major vitest 4.1.12 to 5.0.1 bump. No runtime or security-sensitive code changes. I deferred because the major vitest bump pulls in magic-string 1.x and vite 8.3.0. Their declared ranges for sourcemap-codec and postcss now sit above the versions the root overrides block forces. Recent commits pinned vite and vitest for security advisories, so a maintainer should decide whether the overrides still make sense.
eb04dd1 to
3eb5d28
Compare
…pdates Bumps the development-tooling group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.0` | `26.6.3` | | [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.9` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.13` | `4.23.15` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.4` | `8.3.1` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.12` | `5.0.2` | Updates `@types/node` from 26.4.0 to 26.6.3 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `prettier` from 3.9.6 to 3.9.9 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.6...3.9.9) Updates `tsx` from 4.23.13 to 4.23.15 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.13...v4.23.15) Updates `vite` from 8.2.4 to 8.3.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.1/packages/vite) Updates `vitest` from 4.1.12 to 5.0.2 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.2/packages/vitest) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.6.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-tooling - dependency-name: prettier dependency-version: 3.9.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-tooling - dependency-name: tsx dependency-version: 4.23.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-tooling - dependency-name: vite dependency-version: 8.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-tooling - dependency-name: vitest dependency-version: 5.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: development-tooling ... Signed-off-by: dependabot[bot] <support@github.com>
3eb5d28 to
4e070a8
Compare
| "vite": "8.3.1", | ||
| "vitest": "5.0.2" |
There was a problem hiding this comment.
🔴 Test runs may break, because the existing override now pins a dependency below what the new vitest's magic-string requires. vitest 5.0.2 pulls in magic-string 1.4.2, which declares @ jridgewell/sourcemap-codec ^1.6.0. The unchanged override at package.json:31 still forces 1.5.5, and the lockfile resolves 1.5.5 (package-lock.json:474-475). Fix: make every overridden version satisfy what its dependents now declare. Either raise the @ jridgewell/sourcemap-codec override to a 1.6.x release, or document why 1.5.5 must stay and confirm magic-string 1.x runs on it. The postcss 8.5.25 pin is also below vite 8.3.1's ^8.5.28, but base vite already wanted ^8.5.26.
Why this was flagged
On the base branch, magic-string 0.30.21 declared @ jridgewell/sourcemap-codec ^1.5.5, so the 1.5.5 override was inside its range. After this bump, package-lock.json shows magic-string 1.4.2 declaring ^1.6.0 (diff of node_modules/magic-string). The override at package.json:31 still forces 1.5.5 (package-lock.json:475), and npm installs it without complaint because overrides skip range checks. vitest 5.0.2 and @ vitest/mocker 5.0.2 both depend on magic-string ^1.2.3, and the repo's test and test:mcp scripts run vitest run. If magic-string 1.x uses any sourcemap-codec export or behaviour added in 1.6.0, encoding sourcemaps during vitest transforms or mocking fails at runtime. That would break npm test in CI (validate.yml, Node 24), where base does not break. I could not check magic-string 1.4.2's imports from this checkout. No comment or doc in the repo says why the override pins this exact version.
Verification: The overrides block at package.json:30-33 still contains "@ jridgewell/sourcemap-codec": "1.5.5", installed at package-lock.json:474-475. node_modules/magic-string moves to "version": "1.4.2", which declares "^1.6.0". On the base branch the pinned 1.5.5 was inside magic-string's range. npm overrides skip the range check, so installs succeed without a warning.
Bumps the development-tooling group with 5 updates in the / directory:
26.4.026.6.33.9.63.9.94.23.134.23.158.2.48.3.14.1.125.0.2Updates
@types/nodefrom 26.4.0 to 26.6.3Commits
Updates
prettierfrom 3.9.6 to 3.9.9Release notes
Sourced from prettier's releases.
Changelog
Sourced from prettier's changelog.
... (truncated)
Commits
cdd17f2Release 3.9.9dc7b896DisablesingleDollarTextMathinmdast-util-math(#20140)f9be58fGit blame ignore 3.9.888470cbBump Prettier dependency to 3.9.89559cabClean changelog_unreleased4fc8ee8Update dependents count4f2ab67Release 3.9.83d82af8Update Regex related dependencies (#20082)5ec8db1[3.9.x] Markdown: Don't let Liquid objects interrupt paragraphs (#20087)5b142edRelease Release@prettier/plugin-hermes@0.2.3,@prettier/plugin-oxc@0.2.3, an...Updates
tsxfrom 4.23.13 to 4.23.15Release notes
Sourced from tsx's releases.
Commits
ca66105test: fix drive-less file URLs in ESM resolver fixtures2da3407fix: expose require.cache and require.extensions to tsImport CommonJS modules38e1588fix: exclude bare builtins from namespace inheritance562c434fix: make namespaced register() overloads portable for declaration emitedfb1f0build: upgrade pkgroll and externalize CJS loader reference70e7828test: upgrade tinyspy for disposable API9ed2022ci: avoid duplicate release notifications872e77frefactor: use disposables for cleanup6e5236bfix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...Updates
vitefrom 8.2.4 to 8.3.1Release notes
Sourced from vite's releases.
... (truncated)
Changelog
Sourced from vite's changelog.
... (truncated)
Commits
39ddf7crelease: v8.3.1 (#23573)f68c0d5fix: handleserver.ws: falsein mergeConfig (#23511)6f831f9fix(server): avoid reinitializing watcher when adding file after server close...04fc30afix(sourcemap): skip URL source roots when injecting sources content (#23519)5f89433fix(optimizer): resolve pending discovered dep processing on close before ini...63567c7chore(optimizer): add debug log when waiting for dep before init (#23566)e8990c4fix(deps): update all non-major dependencies (#23537)af7cdf6refactor: replacefindwithsome(#23554)39330f4fix(optimizer): don't skip imports whose binding starts with type (#23540)9abd99brefactor: remove duplicate configurations (#23532)Updates
vitestfrom 4.1.12 to 5.0.2Release notes
Sourced from vitest's releases.
... (truncated)
Commits
428e2e5chore: release v5.0.2 (#11357)0b79231fix: bindprocessin case global is overwritten (#11343)597df56docs: correct stale config defaults (#11354)ea1c44fdocs:sequence.setupFilesdefault is'list'(#11351)0fd6b97fix(detect-async-leaks): ignoreprocess.stdiohandles (#11333)4e91e56fix(reporters):hanging-processto use ESM entrypoint (#11316)1a57929docs(browser): fix locators.exact default (#11338)5b95efbfix(reporter):agentto respect--silent(#11271)f58a209docs: correct benchmark.exclude and watch defaults (#11268)d1c3eccfix(jsdom): fixRequestwithBlobbody on jsdom 28+ (#11295)