chore(deps): clear the entire dependabot backlog (majors + minor/patch, done correctly) - #1062
Merged
Merged
Conversation
All three are drop-in for VMark's usage — verified locally with `cargo check` + 728 passing tests: - rust-i18n 4: the 3→4 breaking changes are all trait-level (custom Backend impls + the dropped once_cell re-export). We use only the i18n!/t! macros and set_locale, which are unchanged. MSRV 1.80 is satisfied. - dirs 6: home_dir() is unchanged (our only call); we never use config_dir, so its macOS churn is irrelevant. - toml 0.9: we parse into toml::Table (not Value, sidestepping the FromStr-now-parses-values break) and use to_string_pretty (signature unchanged). Resolves to 0.9.10 — the +spec-1.1.0 suffix is build metadata on the published 0.9.10, not a separate preview track. Completes the intent of dependabot #1044 / #1042 / #1043, which failed as blind bumps, done correctly with verification.
…cp), react-i18next 16.6 Done correctly with the code migrations dependabot's blind bumps couldn't do. Verified with the full `pnpm check:all` (tsc, lint, sidecar + content-server tests, build, coverage, size). - i18next 25 → 26: `initImmediate` was removed; renamed back to `initAsync` (same semantics). src/i18n.ts updated. react-i18next bumped 16.5 → 16.6 (peer `>= 25.10.9` admits i18next 26). - lucide-react 0.562 → 1.x: v1 removed all brand icons. AboutSettings imported the now-removed `Github`, so it ships the GitHub mark as a local inline SVG (GithubMark.tsx) matching the lucide render contract. All other 74 icons resolve unchanged. Settings-page size limit nudged 94 → 95 kB for the SVG. - zod 3 → 4 (vmark-mcp-server): single-arg `z.record()` was removed; cli.ts now passes an explicit key schema (`z.record(z.string(), z.unknown())`). The MCP SDK 1.27.1 peers `^3.25 || ^4.0`, so zod 4 is accepted. Completes the intent of dependabot #1052 / #1046 / #1037 / #1047.
xiaolai
enabled auto-merge (squash)
June 27, 2026 01:53
This was referenced Jun 27, 2026
…globals 17) + cargo minor/patch group Verified with full `pnpm check:all` (lint, build, coverage, sidecar, content-server, size) + `cargo check` + 728 Rust tests. - @vitejs/plugin-react 4 → 5, globals 16 → 17: drop-in (dev/build only, no bundle impact). Replaces #1048, #1054. - eslint-plugin-react-hooks 5 → 7: v7 folded the React Compiler rule set into `recommended`, flagging 67 pre-existing sites (set-state-in-effect, refs, manual-memoization, immutability). Adopting those is a deliberate codebase refactor, not a version bump — so they're deferred in eslint.config.js (documented) to preserve the prior enforcement level, and exhaustive-deps is pinned to its historical `warn`. Replaces #1050. - cargo minor/patch updates within semver (`cargo update`): reproduces the cargo-minor-patch group (#1040), which failed as a blind bump against a stale base. Compiles clean + all Rust tests pass. Note: the root npm minor/patch group (#1045) is intentionally NOT swept in here — it carries a mermaid 11.12→11.16 (+~800 kB lazy chunk) and tiptap 3.18→3.27 growth that trips the size gate and warrants a separate, conscious decision rather than an automatic limit bump. Left to dependabot.
This was referenced Jun 27, 2026
`pnpm update -r` within semver — reproduces the dependabot minor/patch groups #1045 (root), #1036 (mcp), and #1051 (@eslint/js) as one verified change. Full `pnpm check:all` green. - Size growth accepted (approved): mermaid 11.12 → 11.16 (+~800 kB, lazy chunk — never in cold start) and tiptap 3.18 → 3.27 (+18 kB eager). Both size-limit ceilings bumped with documented reasons in .size-limit.cjs. - schema.ts: vscode-languageserver-types reached LSP 3.18, which widened Diagnostic.message to `string | MarkupContent`; flatten MarkupContent to its text via a messageText() helper. Completes #1045 / #1036 / #1051.
This was referenced Jun 27, 2026
xiaolai
changed the title
…ckfile passes The minor/patch sweep left pnpm-lock.yaml frozen-inconsistent: the direct dompurify dep (^3.4.11) and the pnpm.overrides entry (>=3.3.2) disagreed in a way non-frozen install tolerates but CI's --frozen-lockfile rejects (ERR_PNPM_OUTDATED_LOCKFILE). Plain pnpm install reconciles it. check:all green.
The minor/patch sweep shifted node_modules hoisting enough that knip (on a clean --frozen-lockfile install, as CI runs) can no longer statically trace the website's mermaid usage (rendered via vitepress's component system) or resolve the `vitepress` binary — flagging both as error-level (Unused devDependencies / Unlisted binaries). Both are genuinely used; the earlier gate-fix removed these ignore entries as "stale," but they're load-bearing across hoisting states. Verified with a clean install + full check:all.
xiaolai
added a commit
that referenced
this pull request
Aug 12, 2026
…h, done correctly) (#1062) * chore(deps): upgrade rust-i18n 3→4, dirs 5→6, toml 0.8→0.9 All three are drop-in for VMark's usage — verified locally with `cargo check` + 728 passing tests: - rust-i18n 4: the 3→4 breaking changes are all trait-level (custom Backend impls + the dropped once_cell re-export). We use only the i18n!/t! macros and set_locale, which are unchanged. MSRV 1.80 is satisfied. - dirs 6: home_dir() is unchanged (our only call); we never use config_dir, so its macOS churn is irrelevant. - toml 0.9: we parse into toml::Table (not Value, sidestepping the FromStr-now-parses-values break) and use to_string_pretty (signature unchanged). Resolves to 0.9.10 — the +spec-1.1.0 suffix is build metadata on the published 0.9.10, not a separate preview track. Completes the intent of dependabot #1044 / #1042 / #1043, which failed as blind bumps, done correctly with verification. * chore(deps): upgrade JS majors — i18next 26, lucide-react 1, zod 4 (mcp), react-i18next 16.6 Done correctly with the code migrations dependabot's blind bumps couldn't do. Verified with the full `pnpm check:all` (tsc, lint, sidecar + content-server tests, build, coverage, size). - i18next 25 → 26: `initImmediate` was removed; renamed back to `initAsync` (same semantics). src/i18n.ts updated. react-i18next bumped 16.5 → 16.6 (peer `>= 25.10.9` admits i18next 26). - lucide-react 0.562 → 1.x: v1 removed all brand icons. AboutSettings imported the now-removed `Github`, so it ships the GitHub mark as a local inline SVG (GithubMark.tsx) matching the lucide render contract. All other 74 icons resolve unchanged. Settings-page size limit nudged 94 → 95 kB for the SVG. - zod 3 → 4 (vmark-mcp-server): single-arg `z.record()` was removed; cli.ts now passes an explicit key schema (`z.record(z.string(), z.unknown())`). The MCP SDK 1.27.1 peers `^3.25 || ^4.0`, so zod 4 is accepted. Completes the intent of dependabot #1052 / #1046 / #1037 / #1047. * chore(deps): dev-tooling majors (vite-plugin-react 5, react-hooks 7, globals 17) + cargo minor/patch group Verified with full `pnpm check:all` (lint, build, coverage, sidecar, content-server, size) + `cargo check` + 728 Rust tests. - @vitejs/plugin-react 4 → 5, globals 16 → 17: drop-in (dev/build only, no bundle impact). Replaces #1048, #1054. - eslint-plugin-react-hooks 5 → 7: v7 folded the React Compiler rule set into `recommended`, flagging 67 pre-existing sites (set-state-in-effect, refs, manual-memoization, immutability). Adopting those is a deliberate codebase refactor, not a version bump — so they're deferred in eslint.config.js (documented) to preserve the prior enforcement level, and exhaustive-deps is pinned to its historical `warn`. Replaces #1050. - cargo minor/patch updates within semver (`cargo update`): reproduces the cargo-minor-patch group (#1040), which failed as a blind bump against a stale base. Compiles clean + all Rust tests pass. Note: the root npm minor/patch group (#1045) is intentionally NOT swept in here — it carries a mermaid 11.12→11.16 (+~800 kB lazy chunk) and tiptap 3.18→3.27 growth that trips the size gate and warrants a separate, conscious decision rather than an automatic limit bump. Left to dependabot. * chore(deps): npm minor/patch sweep (root + mcp + content-server) `pnpm update -r` within semver — reproduces the dependabot minor/patch groups #1045 (root), #1036 (mcp), and #1051 (@eslint/js) as one verified change. Full `pnpm check:all` green. - Size growth accepted (approved): mermaid 11.12 → 11.16 (+~800 kB, lazy chunk — never in cold start) and tiptap 3.18 → 3.27 (+18 kB eager). Both size-limit ceilings bumped with documented reasons in .size-limit.cjs. - schema.ts: vscode-languageserver-types reached LSP 3.18, which widened Diagnostic.message to `string | MarkupContent`; flatten MarkupContent to its text via a messageText() helper. Completes #1045 / #1036 / #1051. * docs(eslint): link react-hooks-7 rule deferral to tracking issue #1063 * fix(deps): reconcile pnpm-lock with dompurify override so --frozen-lockfile passes The minor/patch sweep left pnpm-lock.yaml frozen-inconsistent: the direct dompurify dep (^3.4.11) and the pnpm.overrides entry (>=3.3.2) disagreed in a way non-frozen install tolerates but CI's --frozen-lockfile rejects (ERR_PNPM_OUTDATED_LOCKFILE). Plain pnpm install reconciles it. check:all green. * fix(knip): re-add mermaid + vitepress to website ignore lists The minor/patch sweep shifted node_modules hoisting enough that knip (on a clean --frozen-lockfile install, as CI runs) can no longer statically trace the website's mermaid usage (rendered via vitepress's component system) or resolve the `vitepress` binary — flagging both as error-level (Unused devDependencies / Unlisted binaries). Both are genuinely used; the earlier gate-fix removed these ignore entries as "stale," but they're load-bearing across hoisting states. Verified with a clean install + full check:all.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidates the entire dependabot backlog into one verified PR — each upgrade done correctly with the code migration dependabot's blind bumps couldn't do. Verified locally: full
pnpm check:all+cargo check+ 728 Rust tests, all green.Majors
initImmediate→initAsyncGithubMark.tsxz.record()key schemaMinor/patch
schema.ts: LSP 3.18 widenedDiagnostic.messagetostring | MarkupContent→ flatten helper.Declined
Closes #1037 #1040 #1042 #1043 #1044 #1045 #1046 #1047 #1048 #1050 #1051 #1052 #1053 #1054 #1036