chore: combine 3 dependency updates by camcima · Pull Request #42 · camcima/finita

camcima · 2026-07-31T02:38:05Z

Combines every open Dependabot PR into one verified update.

Package	To
`@types/node`	26.0.1	major
`@commitlint/cli`	21.2.1
`@commitlint/config-conventional`	21.2.0
`@vitest/coverage-v8`, `vitest`	3.2.7
`eslint`	10.8.0
`lefthook`	2.1.10
`prettier`	3.9.6
`typescript-eslint`	8.65.0
`actions/setup-node`	v7

typescript unchanged (stays 6.0.3) — repo builds with tsup, and both
tsup@8.5.1 (via rollup-plugin-dts) and typescript-eslint@8.65.0 hard-block
TypeScript 7 today. Dependabot did not propose a TypeScript bump here either.

tests/selector.test.ts was reformatted to match prettier@3.9.6's updated
union-type line-wrapping (real formatting regression from the bump, fixed by
running Prettier, not suppressed).

Verified locally: build, lint (tsc x2 + eslint), format:check, and
test:coverage (369 tests, 46 files) all pass on a clean pnpm install --frozen-lockfile.

Security

pnpm audit --audit-level=high: 13 vulnerabilities (3 low, 2 moderate, 8 high),
down from 17 (3 low, 3 moderate, 11 high) on main. The js-yaml and fast-uri
advisories cleared via the eslint bump. The brace-expansion advisories
(GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg) that make main's OSV-Scanner
check red remain — eslint@10.8.0's own minimatch dependency still
resolves brace-expansion@5.0.6/2.1.1, below the patched 5.0.7/5.0.8.
No overrides or transitive pins were added per policy, so OSV-Scanner is
expected to stay red on this PR.

Closes #36, #40, #41

🤖 Generated Claude Code

Merges the three open Dependabot PRs into one verified update: - @types/node ^25.9.1 -> ^26.0.1 (major, #36) - actions/setup-node v6 -> v7 (#40) - Lockfile-only refresh of @commitlint/cli 21.2.1, @commitlint/config-conventional 21.2.0, @vitest/coverage-v8 3.2.7, eslint 10.8.0, lefthook 2.1.10, prettier 3.9.6, typescript-eslint 8.65.0, vitest 3.2.7 (#41) typescript stays pinned at 6.0.3: tsup's rollup-plugin-dts and typescript-eslint both hard-block TypeScript 7 today. Reformatted tests/selector.test.ts to match prettier 3.9.6's updated union-type line-wrapping. Closes #36, #40, #41 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

codecov · 2026-07-31T02:38:58Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (c2bd2db) to head (49e33ba).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##              main       #42   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           61        61           
  Lines         1801      1801           
  Branches       268       268           
=========================================
  Hits          1801      1801

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Re-resolved pnpm-lock.yaml against the existing package.json specifiers (pnpm update --depth Infinity, then package.json reverted, then pnpm install --lockfile-only) so already-patched transitive versions that satisfy parent packages' semver ranges get picked up. pnpm normally preserves existing lockfile resolutions on install, so these patched versions were available but never selected. No manifest changes, no pnpm.overrides added, no scanner suppressions. pnpm audit --audit-level=high: before: 13 vulnerabilities (8 high, 2 moderate, 3 low) after: 2 vulnerabilities (1 high, 1 low) Cleared: - 7x undici advisories (release-it@20.2.0 -> undici 8.3.0 -> 8.9.0, now >=8.5.0): GHSA-vmh5-mc38-953g, GHSA-38rv-x7px-6hhq, GHSA-vxpw-j846-p89q, GHSA-p88m-4jfj-68fv, GHSA-pr7r-676h-xcf6, GHSA-35p6-xmwp-9g52, GHSA-g8m3-5g58-fq7m - brace-expansion GHSA-3jxr-9vmj-r5cp (both eslint and vitest coverage paths, resolved to 2.1.4 / 5.0.9) - postcss GHSA-r28c-9q8g-f849 (vitest -> vite -> postcss 8.5.15 -> 8.5.25) Remain (semver ceilings a lockfile refresh cannot cross; verified via node_modules package.json dependency ranges): - brace-expansion GHSA-mh99-v99m-4gvg (high): needs >=5.0.8, but @vitest/coverage-v8 -> test-exclude -> glob@10.5.0 pins minimatch@^9.0.4, which pins brace-expansion@^2.0.2 (max 2.x). - esbuild GHSA-g7r4-m6w7-qqqr (low): needs >=0.28.1, but tsup@8.5.1 pins esbuild@^0.27.0 directly and via bundle-require. typescript confirmed to stay at 6.0.3. Verified: pnpm install --frozen-lockfile succeeds, build/lint pass, and all 369 tests (46 files) still pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

camcima · 2026-07-31T09:36:40Z

Transitive dependency refresh (lockfile-only)

Unparked this PR by re-resolving pnpm-lock.yaml against the existing, unchanged package.json specifiers, using the verified recipe:

pnpm update --depth Infinity     # refreshes transitives, also rewrites package.json specifiers
git checkout -- package.json     # revert manifest rewrites — lockfile-only
pnpm install --lockfile-only     # re-resolve lockfile against original specifiers

Most transitive advisories were already patched upstream and satisfied the parent packages' existing semver ranges — they just hadn't been picked up because pnpm install preserves existing lockfile resolutions once a package is first added. This refresh forces re-resolution without touching any manifest ranges.

No pnpm.overrides added, no scanner suppressions, no hand-pinned transitives, osv-scanner.toml untouched.

`pnpm audit --audit-level=high`

	Total	High	Moderate	Low
Before	13	8	2	3
After	2	1	0	1

Cleared (11 advisories)

7x undici (via release-it@20.2.0 → undici@8.3.0 → now 8.9.0, ≥8.5.0 required): GHSA-vmh5-mc38-953g, GHSA-38rv-x7px-6hhq, GHSA-vxpw-j846-p89q, GHSA-p88m-4jfj-68fv, GHSA-pr7r-676h-xcf6, GHSA-35p6-xmwp-9g52, GHSA-g8m3-5g58-fq7m
brace-expansion GHSA-3jxr-9vmj-r5cp — both instances (via @eslint/js→eslint→config-array→minimatch and via @vitest/coverage-v8→test-exclude), now resolving to 2.1.4/5.0.9
postcss GHSA-r28c-9q8g-f849 (via vitest→vite), now 8.5.25 (≥8.5.18 required)

Remain (2 advisories — genuine semver ceilings, not fixable by lockfile refresh)

brace-expansion GHSA-mh99-v99m-4gvg (high) — fix requires ≥5.0.8. Path: @vitest/coverage-v8 → test-exclude → glob@10.5.0 → minimatch@^9.0.4 → brace-expansion@^2.0.2. glob@10.5.0's own manifest caps minimatch at ^9.0.4, and minimatch@9.0.9 caps brace-expansion at ^2.0.2 — the fix landed in the 5.x major line, unreachable without glob/minimatch themselves bumping majors.
esbuild GHSA-g7r4-m6w7-qqqr (low) — fix requires ≥0.28.1. Path: tsup@8.5.1 → esbuild@^0.27.0 (direct, and also via bundle-require). tsup@8.5.1's manifest caps esbuild at ^0.27.0, so 0.28.1 is unreachable without a tsup bump.

Both would need a direct-dependency bump (vitest's coverage chain / tsup) to clear — out of scope for this lockfile-only refresh.

Also checked per the parking note, not resolvable here

release-it stays at 20.2.0 as required (not bumped to 21.x). All 7 undici advisories tied to it are already clear via the transitive resolution above, so no major bump was needed for those.
Looked for the tar advisories via release-it-pnpm→changelogithub→changelogen→c12→giget→tar mentioned when this was parked: in the current tree, release-it@20.2.0's only relevant chain is release-it → c12@3.3.3 → giget@2.0.0, and giget@2.0.0 does not depend on tar at all (no tar package appears anywhere in pnpm-lock.yaml or node_modules). No release-it-pnpm, changelogithub, or changelogen packages are present either. pnpm audit shows no tar-related findings before or after. Flagging the discrepancy in case that context was from a different snapshot — happy to double check if there's a reason to expect tar in the tree.

Verification

typescript confirmed to stay at 6.0.3 (pnpm ls typescript)
pnpm install --frozen-lockfile — succeeds
pnpm run build — succeeds (ESM/CJS/DTS all build cleanly)
pnpm run lint — clean (tsc + eslint)
pnpm test — 369/369 tests passing (46 files), same count as before

Commit: 49e33ba — lockfile-only change (package.json untouched, verified via diff and checksum).

Not merging — leaving this for review/merge as usual.

Copilot AI review requested due to automatic review settings July 31, 2026 02:38

Copilot AI reviewed Jul 31, 2026

Navigation Menu

chore: combine 3 dependency updates - #42

chore: combine 3 dependency updates#42
camcima wants to merge 2 commits into
mainfrom
chore/combined-dependency-updates

camcima commented Jul 31, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

codecov Bot commented Jul 31, 2026 •

edited

Loading

Uh oh!

camcima commented Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

camcima commented Jul 31, 2026

Security

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

camcima commented Jul 31, 2026

Transitive dependency refresh (lockfile-only)

pnpm audit --audit-level=high

Cleared (11 advisories)

Remain (2 advisories — genuine semver ceilings, not fixable by lockfile refresh)

Also checked per the parking note, not resolvable here

Verification

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov Bot commented Jul 31, 2026 •

edited

Loading

`pnpm audit --audit-level=high`