chore(deps-dev): bump the development group across 1 directory with 3 updates - #264
Closed
dependabot[bot] wants to merge 1 commit into
Closed
chore(deps-dev): bump the development group across 1 directory with 3 updates#264dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
AKogut
added a commit
that referenced
this pull request
Aug 18, 2026
…266) `pnpm audit --prod --audit-level high` currently fails on `main`. That is worth stating plainly first, because it also explains something that looked like noise: the audit check is red on almost every open dependabot pull request, **including #258, which bumps `pnpm/action-setup`** — a GitHub Action that cannot affect a dependency tree at all. The branches were not broken. The base was. ## The three | Package | Found | Fixed in | Arrives through | | --- | --- | --- | --- | | `js-yaml` | 3.15.0 | ≥3.15.1 | `@istanbuljs/load-nyc-config`, via jest's coverage chain | | `nanoid` | 3.3.16 | ≥3.3.18 | `postcss` — whose existing override had drifted behind its own advisory | | `deepmerge-ts` | 7.1.5 | ≥8.0.0 | `@prisma/config`, and Prisma 7 is the only release carrying the fixed one | None is reachable by a direct bump, which is what the comment in `audit.yml` already anticipated: *"advisories reachable through a transitive pin that only a resolution override can clear."* ## Why the overrides are scoped `js-yaml` also ships a 4.x line. A bare `"js-yaml": "^3.15.1"` override would drag every 4.x consumer backwards to fix a 3.x problem — so it is pinned under the one parent that pulls the vulnerable copy. Same reasoning for `deepmerge-ts`: version 8 is wanted under Prisma, not everywhere. `postcss` was already overridden; that entry had simply fallen behind. Raising it also cleared `nanoid`, since that is where it came from. ## The part I did not assume Forcing a **major** of `deepmerge-ts` underneath Prisma 6 is exactly the kind of change that type-checks and then falls over at runtime, so it was run rather than reasoned about: the full suite against a live Postgres, every database-backed test included. ``` Tasks: 28 successful, 28 total ``` Plus build, typecheck and lint: 47/47. ## Result Five findings become one: ``` before 1 low | 1 moderate | 3 high after 1 low ``` The remainder is an esbuild development-server file-read on Windows — below the `--audit-level high` gate the workflow enforces, and reported by the second, non-failing audit step that already exists for exactly this. ## What this unblocks #261 (zod 4) and #263 (prisma 7) fail on their own merits and still need work. The rest — #258, #262, #264, #265 — were failing only on this, and should go green on a rebase.
Owner
|
@dependabot rebase |
… updates Bumps the development group with 3 updates in the / directory: [eslint](https://github.com/eslint/eslint), [turbo](https://github.com/vercel/turborepo) and [tsx](https://github.com/privatenumber/tsx). Updates `eslint` from 10.8.0 to 10.8.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.8.0...v10.8.1) Updates `turbo` from 2.10.8 to 2.10.10 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.10.8...v2.10.10) Updates `tsx` from 4.23.1 to 4.23.12 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.1...v4.23.12) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.8.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development - dependency-name: tsx dependency-version: 4.23.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development - dependency-name: turbo dependency-version: 2.10.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/development-e94f210b06
branch
from
August 18, 2026 08:15
dd07ff4 to
bd0a1fa
Compare
Owner
|
Superseded by #272 — same tsx / eslint / turbo versions, applied on top of the audit fix that this branch had conflicted with. |
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/development-e94f210b06
branch
August 18, 2026 08:16
AKogut
added a commit
that referenced
this pull request
Aug 18, 2026
Replaces #262 and #264. Both went `DIRTY` when #266 touched `package.json` and the lockfile, and dependabot did not pick them back up after being asked. Their checks kept running against the old base, so they kept failing on the advisory `main` no longer has — which would have looked like the bumps' fault indefinitely. Same versions, applied on the fixed base: | | from | to | | --- | --- | --- | | `eslint-plugin-simple-import-sort` | 12.1.1 | 14.0.0 | | `tsx` | 4.19.2 | 4.23.12 | | `eslint` | 10.8.0 | 10.8.1 | | `turbo` | 2.10.8 | 2.10.10 | `simple-import-sort` crossing **two majors** is the one that deserved checking rather than a shrug — it decides whether every import block in the repo still lints, and lint is a required check. It does, unchanged. ``` Tasks: 62 successful, 62 total ``` Build, typecheck, lint and the full test suite against a live Postgres.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the development group with 3 updates in the / directory: eslint, turbo and tsx.
Updates
eslintfrom 10.8.0 to 10.8.1Release notes
Sourced from eslint's releases.
Commits
c049dc310.8.1a3f7826Build: changelog update for 10.8.118eb0a7fix: prevent ASI hazard inno-unused-labelsautofix (#21173)0a14800chore: update github/codeql-action action to v4.37.4 (#21196)7d0cbf8docs: Update README05adcb1test: fix failing ecosystem test foreslint-plugin-unicorn(#21191)5611035test: add error locations info tono-void(#21185)ee47333ci: bump github/codeql-action from 4 to 4.37.3 (#21176)f131c03chore: improve ecosystem test failure reporting (#20937)0a05812docs: add missing backticks tono-duplicate-imports.js(#21183)Updates
turbofrom 2.10.8 to 2.10.10Release notes
Sourced from turbo's releases.
... (truncated)
Commits
d009da0publish 2.10.10 to registryea08facfix(bun): Preserve overrides objects, trustedDependencies, workspace bins and...65aa565chore: Release Turbo repository packages 0.0.1-canary.24 (#13739)1da105ffix: Scope musl library dependency installation (#13738)31b0c4ffeat: Support cross-toolchain repository affectedness (#13737)c4ac03bfeat: Add daily performance agent (#13729)e0aee94chore: Update with-rsbuild example (#13730)0bfd752chore: Update non-monorepo example (#13727)caddaa9fix: Expose Slack delivery diagnostics (#13733)6a46551chore: Enforce draft pull requests (#13726)Updates
tsxfrom 4.23.1 to 4.23.12Release notes
Sourced from tsx's releases.
... (truncated)
Commits
ed9d330fix: shimimport.metawhen tokens are split by comments or newlines (#829)651f5betest: cover CommonJS TypeScript import.meta pathsbd3bc64test: cover CommonJS loader source fallback55cbecefix: preserve async ESM require fallback6c5ba85docs: document CommonJS default interopec1bcd5fix: support nyc coverage discovery (#710)b6e5b48docs: clarify CommonJS default imports2f55884fix: map Node test locationsde935d5docs: document Node source-map stack formattingb94f46ffix: support data URLs in tsImport