chore(deps-dev): sweep 33 dev dependencies, unblock two gates - #597
Merged
Merged
Conversation
Takes over Dependabot #589 (and its predecessor #583), both of which fail CI for reasons Dependabot cannot fix itself. The lockfile change is Dependabot's own, reconciled onto the PrimeVue pin from #588; the two fixes beside it are what make it land. rollup-plugin-dts 6.4.1 -> 6.5.1 trips the dependency-review license gate. The package is LGPL-3.0-only and has been since 6.1.0, so this is not new exposure: the gate only evaluates dependencies a PR changes, and no PR had touched it since the gate was added, so it sat in the tree unseen. Carved out by purl alongside the existing sharp entry. The reasoning is the sharp one and if anything stronger: it is a build-time devDependency that reads .d.ts files and emits a bundled .d.ts, its own code is never emitted, and the published tarball carries generated type text rather than plugin code. The exclusion it is carved out of guards against LGPL JS a consumer bundles statically, which a type bundler run only in this repo's build is not. prettier 3.8.5 -> 3.9.6 reformats 17 files, mostly collapsing leading-pipe unions in conditional types. Applied wholesale via `pnpm format`. One hunk needed a hand: in directive.ts prettier pulled `return` up onto the `if` line, which left the Case B comment block hanging off the Case A return even though it documents the REGISTER_OWNER_MARKER assignment below it. Re-anchored above that assignment; no behavior change. Verified separately: every bumped version is at least 8 days old, so none trips the 24h `minimumReleaseAge` floor; all licenses are MIT/Apache-2.0 apart from the rollup-plugin-dts case above; the PrimeVue exact pins survive the reconcile; the h3-next alias and zod are untouched. The bench-arena competitor bumps are safe to land unrefreshed because results.json records the libVersions it measured, so the published data stays self-describing until the next monthly refresh re-measures. pnpm check green: 16 floors honoured, 6 overrides deduped, 4654 passed / 46 skipped. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PnAVwFjpvKQNppAMkSvoiH
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Takes over #589 (and its predecessor #583). Both fail CI for two reasons Dependabot cannot fix on its own, so the bump needs a human branch to land. The lockfile change here is Dependabot's own, reconciled onto the PrimeVue pin from #588.
Closes #589
The two blockers
1.
rollup-plugin-dts6.4.1 → 6.5.1 trips the license gate. It isLGPL-3.0-only, which is not ondependency-review.yml'sallow-licenses.The important part: this is not new exposure. Every release since 6.1.0 (Oct 2023) has been LGPL, including the 6.4.1 already in the tree. The gate only evaluates dependencies a PR changes, and nothing had touched this package since the gate was added, so it sat there unseen. The first bump was always going to surface it.
Carved out by purl next to the existing
sharpentry, with the reasoning written inline. That reasoning is thesharpone and if anything stronger: it is a build-time devDependency that reads.d.tsfiles and emits a bundled.d.ts, its own code is never emitted, and the published tarball carries generated type text rather than plugin code. The exclusion it is carved out of guards against LGPL JS a consumer bundles statically, which a type bundler that runs only in this repo's build is not.This is the one judgment call in the PR. The alternative is holding
rollup-plugin-dtsat 6.4.1, which only defers the question: the package is already LGPL in the tree today, and every future bump hits the same wall.2.
prettier3.8.5 → 3.9.6 reformats 17 files. Mostly collapsing leading-pipe unions in conditional types. Applied wholesale viapnpm format.One hunk needed a hand. In
directive.ts, prettier pulledreturnup onto theifline, which left the Case B comment block hanging off the Case A return even though it documents theREGISTER_OWNER_MARKERassignment below it:Re-anchored above the assignment it describes. No behavior change.
What I verified beyond CI
eslint10.10.0 at 8 days; nothing trips the 24hminimumReleaseAgefloorrollup-plugin-dtscase above4.5.5/2.0.3exact specifiers survive the reconcileh3-nextalias,zodpnpm update --recursive)@vue/language-server+@vue/typescript-pluginbumped in lockstep withvue-tsc3.3.11, still workspace-resolvableresults.jsonrecords thelibVersionsit measured, so published data stays self-describing until the next monthly refreshVerification
pnpm checkgreen:PASS: 16 floor(s) honoured, 6 override(s) deduped, 4654 passed / 46 skipped, coverage run 4696 passed / 4 skippedpnpm check:bundled-typesgreen (run because this touchessrc/runtime/types/*): both the v4/default and v3-only consumer fixtures compile against the bundled.d.tsThe pre-commit hook was bypassed because it shells into the Docker dev container, which was not running; its one check is the site typecheck, which
pnpm checkhad already run green on the host.🤖 Generated with Claude Code
https://claude.ai/code/session_01PnAVwFjpvKQNppAMkSvoiH