CHANGE @W-22462053@ Refresh safe minor/patch npm dependencies - #506
Conversation
Monthly dependency refresh across the monorepo, limited to safe minor/patch bumps (no majors).
Bumped: ts-jest 29.4.11->29.4.12; typescript-eslint + @typescript-eslint/{eslint-plugin,parser} 8.64.0->8.67.0; @types/semver 7.7.1->7.8.0; csv-stringify 6.8.1->6.8.3; js-yaml 4.3.0->4.3.1; minimatch 10.2.5->10.2.6; globals 17.7.0->17.11.0; node-stream-zip 1.15.0->1.16.0.
Excluded: @salesforce/core (8.32.x pulls undici@8 requiring Node 22; kept 8.31.2 for Node 20 support); eslint-plugin-jest 29.16.1 (doc-URL-only, would churn goldfiles; kept 29.16.0); eslint8-engine and uibundle-engine (frozen/non-SNAPSHOT); all major upgrades.
Verified on Node 20 + Java 17: build, lint, and full TypeScript suite (1689 passed) all green.
|
Git2Gus App is installed but the |
Apply the same safe minor/patch bumps to the uibundle engine that the other engines received in this PR, so the newly added engine is not left behind in the monthly dependency refresh. Bumped: ts-jest 29.4.11->29.4.12; typescript-eslint 8.64.0->8.67.0. Also bump the package version from 0.1.0 to 0.2.0-SNAPSHOT: it was published at 0.1.0 without being reopened for development, so it lacked the -SNAPSHOT suffix required by the pre-commit version check (which is why it was skipped from the earlier refresh in this PR). Verified on Node 20: build, lint, and full test suite (104 passed) all green.
aruntyagiTutu
left a comment
aruntyagiTutu
left a comment
There was a problem hiding this comment.
Reviewed against the PR guide. This is a well-scoped, well-documented dependency refresh — clear before/after table, explicit rationale for each exclusion (Node 20 compat for @salesforce/core, goldfile churn avoidance for eslint-plugin-jest), and confirmed the diff touches only package.json/package-lock.json (no source/test files). CI is green across all three platforms, validate_packages passes.
One small accuracy nit: the PR description lists code-analyzer-uibundle-engine under "Intentionally excluded" as if untouched, but its package.json did change — it received the same ts-jest (29.4.11→29.4.12) and typescript-eslint (8.64.0→8.67.0) bumps as every other package, and its own version was bumped 0.1.0 → 0.2.0-SNAPSHOT. That version bump looks correct and necessary (the package already published at 0.1.0 on npm, so validate-changed-package-versions.js would reject a changed, non--SNAPSHOT package version), but it's worth calling out explicitly in the description rather than leaving it implied by the "excluded" framing — a future reader diffing the PR body against the actual changes could be confused about why that file changed.
Not blocking — approving.
Apply the same safe minor/patch bumps to ENGINE-TEMPLATE that the engines received in this PR. The template is kept in sync with the real engines every monthly refresh (as done last cycle in #487) so newly scaffolded engines start on current dependencies; it was missed in this PR's initial sweep. Bumped: ts-jest 29.4.11->29.4.12; typescript-eslint 8.64.0->8.67.0. Verified on Node 20: build, lint, and test suite (7 passed) all green.
2 participants
What
Monthly dependency refresh for the
code-analyzer-coremonorepo (Release Activities: W-22462053). Scope is limited to safe minor/patch bumps only — no major upgrades, no frozen dependencies.Bumped
ts-jesttypescript-eslint@typescript-eslint/eslint-plugin+/parser@types/semvercsv-stringifyjs-yamlminimatchglobalsnode-stream-zipIntentionally excluded
@salesforce/core(kept at8.31.2): 8.32.x pulls@jsforce/jsforce-node@3.10.22→undici@8, which requires Node ≥ 22.19. apexguru-engine officially supports Node ≥ 20, so bumping would introduce a Node-22-only transitive dependency. Held back to preserve clean Node 20 support.eslint-plugin-jest(kept at29.16.0): the 29.16.1 patch only changes the version embedded in rule-doc URLs, which would churn ~864 lines of test goldfiles for zero functional benefit. Deferred to keep this a pure dependency refresh.code-analyzer-eslint8-engine(frozen deps),code-analyzer-uibundle-engine(0.1.0, not-SNAPSHOT).ncu --target minor).Validation
Verified locally on Node 20.20.2 + Java 17 (Zulu):
npm run build— clean (exit 0)npm run lint— clean (exit 0)npm run test-typescript— 1689 passed, 0 failed (12 pre-existing skips)-SNAPSHOT& ahead of published; interdependencies correct.No source or test files changed — package.json + package-lock.json only.