chore(deps): bump the npm-minor-patch group across 1 directory with 6 updates - #1036
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
xiaolai
enabled auto-merge (squash)
June 27, 2026 01:16
Owner
|
@dependabot recreate |
… updates Bumps the npm-minor-patch group with 6 updates in the /vmark-mcp-server directory: | Package | From | To | | --- | --- | --- | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.27.1` | `1.29.0` | | [ws](https://github.com/websockets/ws) | `8.18.3` | `8.21.0` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.0.16` | `4.1.9` | | [@yao-pkg/pkg](https://github.com/yao-pkg/pkg) | `6.14.1` | `6.20.0` | | [esbuild](https://github.com/evanw/esbuild) | `0.27.2` | `0.28.1` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.0.16` | `4.1.9` | Updates `@modelcontextprotocol/sdk` from 1.27.1 to 1.29.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@v1.27.1...v1.29.0) Updates `ws` from 8.18.3 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.18.3...8.21.0) Updates `@vitest/coverage-v8` from 4.0.16 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/coverage-v8) Updates `@yao-pkg/pkg` from 6.14.1 to 6.20.0 - [Release notes](https://github.com/yao-pkg/pkg/releases) - [Changelog](https://github.com/yao-pkg/pkg/blob/main/CHANGELOG.md) - [Commits](https://github.com/yao-pkg/pkg/commits) Updates `esbuild` from 0.27.2 to 0.28.1 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md) - [Commits](evanw/esbuild@v0.27.2...v0.28.1) Updates `vitest` from 4.0.16 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/vitest) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@yao-pkg/pkg" dependency-version: 6.20.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: esbuild dependency-version: 0.28.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: vitest dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: ws dependency-version: 8.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/vmark-mcp-server/npm-minor-patch-6217382fda
branch
from
June 27, 2026 01:21
055b4ed to
e46bdd8
Compare
xiaolai
added a commit
that referenced
this pull request
Jun 27, 2026
`pnpm update -r` within semver — reproduces the dependabot minor/patch groups #1045 (root), #1036 (mcp), and #1051 (@eslint/js) as one verified change. Full `pnpm check:all` green. - Size growth accepted (approved): mermaid 11.12 → 11.16 (+~800 kB, lazy chunk — never in cold start) and tiptap 3.18 → 3.27 (+18 kB eager). Both size-limit ceilings bumped with documented reasons in .size-limit.cjs. - schema.ts: vscode-languageserver-types reached LSP 3.18, which widened Diagnostic.message to `string | MarkupContent`; flatten MarkupContent to its text via a messageText() helper. Completes #1045 / #1036 / #1051.
Owner
|
Superseded by #1062 — folded into the consolidated dependency PR (minor/patch sweep, verified green). Size growth from mermaid/tiptap accepted with documented size-limit bumps. |
auto-merge was automatically disabled
June 27, 2026 03:08
Pull request was closed
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/vmark-mcp-server/npm-minor-patch-6217382fda
branch
June 27, 2026 03:08
xiaolai
added a commit
that referenced
this pull request
Jun 27, 2026
…h, done correctly) (#1062) * chore(deps): upgrade rust-i18n 3→4, dirs 5→6, toml 0.8→0.9 All three are drop-in for VMark's usage — verified locally with `cargo check` + 728 passing tests: - rust-i18n 4: the 3→4 breaking changes are all trait-level (custom Backend impls + the dropped once_cell re-export). We use only the i18n!/t! macros and set_locale, which are unchanged. MSRV 1.80 is satisfied. - dirs 6: home_dir() is unchanged (our only call); we never use config_dir, so its macOS churn is irrelevant. - toml 0.9: we parse into toml::Table (not Value, sidestepping the FromStr-now-parses-values break) and use to_string_pretty (signature unchanged). Resolves to 0.9.10 — the +spec-1.1.0 suffix is build metadata on the published 0.9.10, not a separate preview track. Completes the intent of dependabot #1044 / #1042 / #1043, which failed as blind bumps, done correctly with verification. * chore(deps): upgrade JS majors — i18next 26, lucide-react 1, zod 4 (mcp), react-i18next 16.6 Done correctly with the code migrations dependabot's blind bumps couldn't do. Verified with the full `pnpm check:all` (tsc, lint, sidecar + content-server tests, build, coverage, size). - i18next 25 → 26: `initImmediate` was removed; renamed back to `initAsync` (same semantics). src/i18n.ts updated. react-i18next bumped 16.5 → 16.6 (peer `>= 25.10.9` admits i18next 26). - lucide-react 0.562 → 1.x: v1 removed all brand icons. AboutSettings imported the now-removed `Github`, so it ships the GitHub mark as a local inline SVG (GithubMark.tsx) matching the lucide render contract. All other 74 icons resolve unchanged. Settings-page size limit nudged 94 → 95 kB for the SVG. - zod 3 → 4 (vmark-mcp-server): single-arg `z.record()` was removed; cli.ts now passes an explicit key schema (`z.record(z.string(), z.unknown())`). The MCP SDK 1.27.1 peers `^3.25 || ^4.0`, so zod 4 is accepted. Completes the intent of dependabot #1052 / #1046 / #1037 / #1047. * chore(deps): dev-tooling majors (vite-plugin-react 5, react-hooks 7, globals 17) + cargo minor/patch group Verified with full `pnpm check:all` (lint, build, coverage, sidecar, content-server, size) + `cargo check` + 728 Rust tests. - @vitejs/plugin-react 4 → 5, globals 16 → 17: drop-in (dev/build only, no bundle impact). Replaces #1048, #1054. - eslint-plugin-react-hooks 5 → 7: v7 folded the React Compiler rule set into `recommended`, flagging 67 pre-existing sites (set-state-in-effect, refs, manual-memoization, immutability). Adopting those is a deliberate codebase refactor, not a version bump — so they're deferred in eslint.config.js (documented) to preserve the prior enforcement level, and exhaustive-deps is pinned to its historical `warn`. Replaces #1050. - cargo minor/patch updates within semver (`cargo update`): reproduces the cargo-minor-patch group (#1040), which failed as a blind bump against a stale base. Compiles clean + all Rust tests pass. Note: the root npm minor/patch group (#1045) is intentionally NOT swept in here — it carries a mermaid 11.12→11.16 (+~800 kB lazy chunk) and tiptap 3.18→3.27 growth that trips the size gate and warrants a separate, conscious decision rather than an automatic limit bump. Left to dependabot. * chore(deps): npm minor/patch sweep (root + mcp + content-server) `pnpm update -r` within semver — reproduces the dependabot minor/patch groups #1045 (root), #1036 (mcp), and #1051 (@eslint/js) as one verified change. Full `pnpm check:all` green. - Size growth accepted (approved): mermaid 11.12 → 11.16 (+~800 kB, lazy chunk — never in cold start) and tiptap 3.18 → 3.27 (+18 kB eager). Both size-limit ceilings bumped with documented reasons in .size-limit.cjs. - schema.ts: vscode-languageserver-types reached LSP 3.18, which widened Diagnostic.message to `string | MarkupContent`; flatten MarkupContent to its text via a messageText() helper. Completes #1045 / #1036 / #1051. * docs(eslint): link react-hooks-7 rule deferral to tracking issue #1063 * fix(deps): reconcile pnpm-lock with dompurify override so --frozen-lockfile passes The minor/patch sweep left pnpm-lock.yaml frozen-inconsistent: the direct dompurify dep (^3.4.11) and the pnpm.overrides entry (>=3.3.2) disagreed in a way non-frozen install tolerates but CI's --frozen-lockfile rejects (ERR_PNPM_OUTDATED_LOCKFILE). Plain pnpm install reconciles it. check:all green. * fix(knip): re-add mermaid + vitepress to website ignore lists The minor/patch sweep shifted node_modules hoisting enough that knip (on a clean --frozen-lockfile install, as CI runs) can no longer statically trace the website's mermaid usage (rendered via vitepress's component system) or resolve the `vitepress` binary — flagging both as error-level (Unused devDependencies / Unlisted binaries). Both are genuinely used; the earlier gate-fix removed these ignore entries as "stale," but they're load-bearing across hoisting states. Verified with a clean install + full check:all.
xiaolai
added a commit
that referenced
this pull request
Aug 12, 2026
…h, done correctly) (#1062) * chore(deps): upgrade rust-i18n 3→4, dirs 5→6, toml 0.8→0.9 All three are drop-in for VMark's usage — verified locally with `cargo check` + 728 passing tests: - rust-i18n 4: the 3→4 breaking changes are all trait-level (custom Backend impls + the dropped once_cell re-export). We use only the i18n!/t! macros and set_locale, which are unchanged. MSRV 1.80 is satisfied. - dirs 6: home_dir() is unchanged (our only call); we never use config_dir, so its macOS churn is irrelevant. - toml 0.9: we parse into toml::Table (not Value, sidestepping the FromStr-now-parses-values break) and use to_string_pretty (signature unchanged). Resolves to 0.9.10 — the +spec-1.1.0 suffix is build metadata on the published 0.9.10, not a separate preview track. Completes the intent of dependabot #1044 / #1042 / #1043, which failed as blind bumps, done correctly with verification. * chore(deps): upgrade JS majors — i18next 26, lucide-react 1, zod 4 (mcp), react-i18next 16.6 Done correctly with the code migrations dependabot's blind bumps couldn't do. Verified with the full `pnpm check:all` (tsc, lint, sidecar + content-server tests, build, coverage, size). - i18next 25 → 26: `initImmediate` was removed; renamed back to `initAsync` (same semantics). src/i18n.ts updated. react-i18next bumped 16.5 → 16.6 (peer `>= 25.10.9` admits i18next 26). - lucide-react 0.562 → 1.x: v1 removed all brand icons. AboutSettings imported the now-removed `Github`, so it ships the GitHub mark as a local inline SVG (GithubMark.tsx) matching the lucide render contract. All other 74 icons resolve unchanged. Settings-page size limit nudged 94 → 95 kB for the SVG. - zod 3 → 4 (vmark-mcp-server): single-arg `z.record()` was removed; cli.ts now passes an explicit key schema (`z.record(z.string(), z.unknown())`). The MCP SDK 1.27.1 peers `^3.25 || ^4.0`, so zod 4 is accepted. Completes the intent of dependabot #1052 / #1046 / #1037 / #1047. * chore(deps): dev-tooling majors (vite-plugin-react 5, react-hooks 7, globals 17) + cargo minor/patch group Verified with full `pnpm check:all` (lint, build, coverage, sidecar, content-server, size) + `cargo check` + 728 Rust tests. - @vitejs/plugin-react 4 → 5, globals 16 → 17: drop-in (dev/build only, no bundle impact). Replaces #1048, #1054. - eslint-plugin-react-hooks 5 → 7: v7 folded the React Compiler rule set into `recommended`, flagging 67 pre-existing sites (set-state-in-effect, refs, manual-memoization, immutability). Adopting those is a deliberate codebase refactor, not a version bump — so they're deferred in eslint.config.js (documented) to preserve the prior enforcement level, and exhaustive-deps is pinned to its historical `warn`. Replaces #1050. - cargo minor/patch updates within semver (`cargo update`): reproduces the cargo-minor-patch group (#1040), which failed as a blind bump against a stale base. Compiles clean + all Rust tests pass. Note: the root npm minor/patch group (#1045) is intentionally NOT swept in here — it carries a mermaid 11.12→11.16 (+~800 kB lazy chunk) and tiptap 3.18→3.27 growth that trips the size gate and warrants a separate, conscious decision rather than an automatic limit bump. Left to dependabot. * chore(deps): npm minor/patch sweep (root + mcp + content-server) `pnpm update -r` within semver — reproduces the dependabot minor/patch groups #1045 (root), #1036 (mcp), and #1051 (@eslint/js) as one verified change. Full `pnpm check:all` green. - Size growth accepted (approved): mermaid 11.12 → 11.16 (+~800 kB, lazy chunk — never in cold start) and tiptap 3.18 → 3.27 (+18 kB eager). Both size-limit ceilings bumped with documented reasons in .size-limit.cjs. - schema.ts: vscode-languageserver-types reached LSP 3.18, which widened Diagnostic.message to `string | MarkupContent`; flatten MarkupContent to its text via a messageText() helper. Completes #1045 / #1036 / #1051. * docs(eslint): link react-hooks-7 rule deferral to tracking issue #1063 * fix(deps): reconcile pnpm-lock with dompurify override so --frozen-lockfile passes The minor/patch sweep left pnpm-lock.yaml frozen-inconsistent: the direct dompurify dep (^3.4.11) and the pnpm.overrides entry (>=3.3.2) disagreed in a way non-frozen install tolerates but CI's --frozen-lockfile rejects (ERR_PNPM_OUTDATED_LOCKFILE). Plain pnpm install reconciles it. check:all green. * fix(knip): re-add mermaid + vitepress to website ignore lists The minor/patch sweep shifted node_modules hoisting enough that knip (on a clean --frozen-lockfile install, as CI runs) can no longer statically trace the website's mermaid usage (rendered via vitepress's component system) or resolve the `vitepress` binary — flagging both as error-level (Unused devDependencies / Unlisted binaries). Both are genuinely used; the earlier gate-fix removed these ignore entries as "stale," but they're load-bearing across hoisting states. Verified with a clean install + full check:all.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm-minor-patch group with 6 updates in the /vmark-mcp-server directory:
1.27.11.29.08.18.38.21.04.0.164.1.96.14.16.20.00.27.20.28.14.0.164.1.9Updates
@modelcontextprotocol/sdkfrom 1.27.1 to 1.29.0Release notes
Sourced from @modelcontextprotocol/sdk's releases.
Commits
e12cbd7chore: bump version to 1.29.0 (#1820)3913fd4fix(stdio): always set windowsHide on Windows, not just in Electron (#1640)5608e78[v1.x backport] Allow servers / clients to advertise extensions in the capabi...7213816v1.x #1623 follow up -add missing types to package.json (#1773)364f38cv1.x npm audit fix (#1780)c95cc09Add typings exports (#1623)ddadaa6[v1.x] fix: add missing size field to ResourceSchema (#1575)2a15851[v1.x] fix: disallow null (infinite) requested TTL (#1339)13e30f1fix: treat v1.x as primary branch for npm latest tag (backport #1577) (#1749)a056569chore: bump version to 1.28.0 (#1746)Updates
wsfrom 8.18.3 to 8.21.0Release notes
Sourced from ws's releases.
... (truncated)
Commits
bca91ad[dist] 8.21.02b2abd4[security] Limit retained message parts78eabe2[security] Add latest vulnerability to SECURITY.md5d9b316[dist] 8.20.1c0327ec[security] Fix uninitialized memory disclosure inwebsocket.close()ce2a3d6[ci] Test on node 2658e45b8[ci] Do not test on node 255f26c24[ci] Run the lint step on node 248439255[dist] 8.20.0d3503c1[minor] Export thePerMessageDeflateclass and header utilsUpdates
@vitest/coverage-v8from 4.0.16 to 4.1.9Release notes
Sourced from @vitest/coverage-v8's releases.
... (truncated)
Commits
a7a61e7chore: release v4.1.9 (#10598)e61f2ddchore: release v4.1.8e4067b3fix(browser): disable clientcdpAPI whenallowWrite/allowExec: false[ba...a09d472chore: release v4.1.7a8fd24cchore: release v4.1.6e399846chore: release v4.1.5ac04bacchore: release v4.1.42dc0d62chore: release v4.1.3fc6f482chore: release v4.1.21f2d318chore: release v4.1.1Updates
@yao-pkg/pkgfrom 6.14.1 to 6.20.0Release notes
Sourced from @yao-pkg/pkg's releases.
... (truncated)
Changelog
Sourced from @yao-pkg/pkg's changelog.
... (truncated)
Commits
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@yao-pkg/pkgsince your current version.Updates
esbuildfrom 0.27.2 to 0.28.1Release notes
Sourced from esbuild's releases.
... (truncated)
Changelog
Sourced from esbuild's changelog.
Commits
bb9db84publish 0.28.1 to npm9ff053esecurity: add integrity checks to the Deno API0a9bf21enforce non-negative size in gzip parsere2a1a71security: forbid\\in local dev server requests83a2cbffix #4482: don't inlineusingdeclarations308ad74fix #4471: renaming of nestedvardeclarationsf013f5ffix some typosaafd6e4chore: fix some minor issues in comments (#4462)15300c3follow up: cjs evaluation fixes1bda0c3fix #4461, fix #4467: esm evaluation fixesUpdates
vitestfrom 4.0.16 to 4.1.9Release notes
Sourced from vitest's releases.
... (truncated)
Commits
a7a61e7chore: release v4.1.9 (#10598)934b0f5fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...7fb2965fix(browser): wait for orchestrator readiness before resolving browser sessio...a518019fix: fiximportOriginalwith optimizer and query import [backport to v4] (#...e61f2ddchore: release v4.1.8e4067b3fix(browser): disable clientcdpAPI whenallowWrite/allowExec: false[ba...a09d472chore: release v4.1.7a8fd24cchore: release v4.1.618af98cfix(browser): simplify orchestrator otel carrier (#10285)3188260feat(browser): provide project reference inToMatchScreenshotResolvePath(#...