chore(deps): bulk update dependencies and refresh lockfile - #167
Conversation
Consolidates pending Dependabot PRs into a single verified update. Root devDependencies: - @types/node ^25.9.1 -> ^26.1.2 - vitest ^4.1.7 -> ^4.1.10 example devDependencies: - autoprefixer ^10.4.8 -> ^10.5.4 - postcss ^8.5.15 -> ^8.5.25 - tailwindcss ^4.3.1 -> ^4.3.3 - vite ^8.0.16 -> ^8.2.0 Transitive (via npm update): postcss 8.5.26, brace-expansion 5.0.9, undici 7.29.0. Resolves 3 high-severity advisories (0 remaining). Regenerate package-lock.json with npm 11 to fix the npm ci sync failure (react@18.3.1 reported missing from lock) that broke every Dependabot PR's CI. Verified locally: lint, typecheck, type-test, test (16/16), build (esm+cjs), docs:build all pass. typescript kept at 5.9.3 (7.0.2 needs a moduleResolution migration, tracked separately).
80b5e2a to
cc6690c
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 80b5e2aefe
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "autoprefixer": "^10.4.8", | ||
| "postcss": "^8.5.15", | ||
| "tailwindcss": "^4.3.1", | ||
| "autoprefixer": "^10.5.4", |
There was a problem hiding this comment.
When the example is installed with Yarn, the updated dependency descriptors are absent from example/yarn.lock, which still records ranges such as autoprefixer@^10.4.8, postcss@^8.5.15, tailwindcss@^4.3.1, and vite@^8.0.16. Yarn must therefore resolve and rewrite the lockfile instead of reproducing its committed resolutions, while an immutable/frozen install fails because, as yarn install --help specifies, it aborts when the lockfile would be modified. Regenerate and commit example/yarn.lock with these version bumps.
Useful? React with 👍 / 👎.
; Conflicts: ; example/package.json ; package-lock.json ; package.json
1 participant
Consolidates the open Dependabot PRs and restores a green CI.
Why
Dependabot's lockfile regeneration dropped
react@18.3.1(overrides + optional peer), sonpm cifailed on every recent Dependabot PR. Separately,mainitself has been red since the React 19 switch (f4f3806): the snippet checker injectedJSX.Element, a namespace React 19 removed. This PR fixes both.Changes
Root devDependencies
@types/node^25.9.1 → ^26.1.2vitest^4.1.7 → ^4.1.10main:@types/react/@types/react-dom19.x, React 19 dev deps,@typescript-eslint8.63,eslint10.6)example devDependencies
autoprefixer^10.4.8 → ^10.5.4postcss^8.5.15 → ^8.5.25tailwindcss^4.3.1 → ^4.3.3vite^8.0.16 → ^8.2.0main:@vitejs/plugin-react^6.0.3)Transitive (via
npm update): postcss 8.5.26, brace-expansion 5.0.9, undici 7.29.0 — resolves 3 high-severity advisories (0 remaining).Fix:
scripts/check-public-doc-snippets.cjsnow emitsimport("react").JSX.Elementinstead of the removed globalJSX.Element, restoringdocs:snippetson React 19.Verification
Local: lint ✓ (33 snippets), typecheck ✓, type-test ✓, test (16/16) ✓, build (esm+cjs) ✓, docs:build ✓.
Notes
typescriptkept at 5.9.3. The 5 → 7 major bump needs amoduleResolution: node10migration; deferred (chore(deps-dev): bump typescript from 5.9.3 to 7.0.2 #152).actions/setup-nodev6 → v7 (chore(deps): bump actions/setup-node from 6 to 7 #157) intentionally excluded: editing the workflow file suppresses pull_request CI; will be handled separately.Closes #166, #165, #164, #162, #161, #160, #159, #158, #156, #154. Supersedes #152.