chore(deps): batch the second Dependabot wave, realigning @types/jsdom with its runtime - #1268
Merged
Merged
Conversation
Bumps the npm-minor-patch group with 3 updates: [@testing-library/jest-dom](https://github.com/testing-library/jest-dom), [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) and [tsx](https://github.com/privatenumber/tsx). Updates `@testing-library/jest-dom` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/testing-library/jest-dom/releases) - [Changelog](https://github.com/testing-library/jest-dom/blob/main/CHANGELOG.md) - [Commits](testing-library/jest-dom@v7.0.0...v7.0.1) Updates `knip` from 6.32.0 to 6.32.1 - [Release notes](https://github.com/webpro-nl/knip/releases) - [Commits](https://github.com/webpro-nl/knip/commits/knip@6.32.1/packages/knip) Updates `tsx` from 4.23.11 to 4.23.12 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.11...v4.23.12) --- updated-dependencies: - dependency-name: "@testing-library/jest-dom" dependency-version: 7.0.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: knip dependency-version: 6.32.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: tsx dependency-version: 4.23.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@types/jsdom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jsdom) from 28.0.3 to 30.0.0. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jsdom) --- updated-dependencies: - dependency-name: "@types/jsdom" dependency-version: 30.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
…th 2 updates Bumps the actions-minor-patch group with 2 updates in the / directory: [taiki-e/install-action](https://github.com/taiki-e/install-action) and [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action). Updates `taiki-e/install-action` from 2.85.10 to 2.85.11 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@6c6fd71...7f4eb89) Updates `anthropics/claude-code-action` from 1.0.187 to 1.0.190 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@1623c36...5ef2e55) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.190 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch - dependency-name: taiki-e/install-action dependency-version: 2.85.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…s-minor-patch-d5013271e5' into chore/dependabot-batch-2-20260813
…dom-30.0.0' into chore/dependabot-batch-2-20260813
…r-patch-4063261c47' into chore/dependabot-batch-2-20260813 # Conflicts: # pnpm-lock.yaml
bet4it
pushed a commit
to bet4it/vmark
that referenced
this pull request
Aug 19, 2026
Ships the DMG notarization fix (xiaolai#1271): tauri-action signed the disk image but never notarized it, so Gatekeeper refused the download with "Unnotarized Developer ID" before the stapled app inside was ever assessed. Also carries this cycle's dependency updates (xiaolai#1262, xiaolai#1268, xiaolai#1269) and the pnpm workspace consolidation (xiaolai#1266). All five version sources plus the derived src-tauri/Cargo.lock move together per .claude/rules/40-version-bump.md.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The second Dependabot wave, batched into one CI cycle like #1262. These three were opened this morning, before #1262 and #1266 landed.
taiki-e/install-actionv2.85.10→v2.85.11,anthropics/claude-code-actionv1 — SHA-pinned, within major, comment tags updated@testing-library/jest-dom7.0.0→7.0.1,knip6.32.0→6.32.1,tsx4.23.11→4.23.12server/content@types/jsdom28.0.3→30.0.0#1265 is the config fix paying off
That major bump is a correction, not a risk.
server/contentrunsjsdomat^30.0.1while its types were pinned at^28.0.3— two majors behind the runtime they describe. They were stranded there because the only Dependabot entry that could move them was the broken/server/contentone: #1189 tried exactly this bump and was closed unmerged withERR_PNPM_OUTDATED_LOCKFILE.This PR arrives from the root
/entry carryingserver/content/package.jsonandpnpm-lock.yamltogether — the thing #1262 predicted would start working. Types and runtime now agree.Conflict resolution
#1264 and #1265 both touch
pnpm-lock.yaml, so they conflict with each other regardless of merge order, and #1264 was alreadyDIRTYagainst main. Rather than hand-editing a generated file, the manifests were merged (all four bumps land cleanly inpackage.json/server/content/package.json) and the lockfile was regenerated from them withpnpm install --lockfile-only.Verified the regeneration kept every intent rather than dropping a side:
Workspace importers are intact —
.,server/mcp,server/content,website— so #1266's change is preserved, and the diff against main touches only the eight files these three PRs intend.Verification
pnpm typecheck— clean.pnpm check:static— green: 38 gate files, 836 tests, plus the file-size, shell-slots, bespoke-button, deleted-name, keybinding-drift, knip and debt-register gates.lint:tauri-versions— 10@tauri-appspackages still matchsrc-tauri/Cargo.lock.