Repository navigation
chore(deps): bump the development-dependencies group across 1 directory with 4 updates - #172
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
6d4818b to
cc8ac05
Compare
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM. This is a routine devDependency bump, and the lockfile matches package.json.
What was reviewed:
- package.json: only the four devDependencies changed (@ types/node, @ yao-pkg/pkg, tsx, vitest). All are still pinned to exact versions, and no runtime dependencies changed.
- pnpm-lock.yaml: the importer specifiers match package.json, and every new package entry is a registry integrity hash. No tarball, git or URL sources were added. The leftover entries (postcss 8.5.28, nanoid 3.3.19, tinyexec 1.3.1) are still referenced elsewhere in the lockfile.
- Transitive churn: the only downgrade is fs-extra (11.3.5 -> 11.3.1), pulled in by unzipper 0.12.5 under pkg, which is build tooling only.
Extended reasoning...
The change touches only package.json devDependencies and the regenerated pnpm-lock.yaml. No source files or runtime dependencies are modified. The supply-chain surface is limited to build and test tooling: pkg and pkg-fetch, which build the CLI binaries, plus vitest and tsx. All lockfile resolutions are registry integrity hashes. No CODEOWNERS file exists, and the timeline has no human reviews or open objections, only a bot comment. Approval rests on the change being a mechanical, internally consistent version bump.
cc8ac05 to
1e703b3
Compare
There was a problem hiding this comment.
LGTM. This is a routine devDependency bump, and the regenerated lockfile matches package.json.
What was reviewed:
- The package.json bumps to @ types/node 26.6.5, @ yao-pkg/pkg 6.23.0, tsx 4.23.15 and vitest 5.0.3 keep the exact-pin style, and the lockfile specifiers and peer strings for vite, vitest and vite-plus all match the new versions.
- All lockfile entries still resolve from the registry with integrity hashes. None points to a tarball URL or a git source.
- fs-extra goes down from 11.3.5 to 11.3.1 under unzipper 0.12.5. That only affects the pkg build tool, so it's dev-only and has no runtime effect.
Extended reasoning...
Only package.json devDependencies and pnpm-lock.yaml change. No source files, runtime dependencies or packageManager settings are touched. This change has no security-sensitive surface beyond the dev toolchain supply chain: every package still comes from the registry with an integrity hash. The repo has no CODEOWNERS file, and the timeline shows no outstanding objection from a human reviewer. The PR was regenerated in a new commit after the earlier bot comment, so the lockfile was checked again here.
1e703b3 to
277d258
Compare
There was a problem hiding this comment.
LGTM. This is a routine devDependency bump, and the lockfile is consistent with package.json.
What was reviewed:
- package.json: the four exact-pinned specifiers (@ types/node 26.6.5, @ yao-pkg/pkg 6.23.0, tsx 4.23.15, vitest 5.0.3) match the importer entries in pnpm-lock.yaml. All vitest, vite, vite-plus, oxfmt and oxlint peer suffixes were updated to the new @ types/node and tsx versions, with no 26.5.1 or 4.23.13 references left.
- The workspace overrides are still honored in the new graph (esbuild 0.28.2, tar 7.5.22, source-map-js 1.2.2). The transitive changes all sit under the dev toolchain (babel, pkg-fetch, bare-*, tar-fs/tar-stream, chai, why-is-node-running 3.x), and no runtime dependency entries changed.
- One thing worth knowing: fs-extra goes down from 11.3.5 to 11.3.1 under unzipper 0.12.5. It's dev-only, and the workspace's trustPolicy and minimumReleaseAge settings may explain it.
Extended reasoning...
The change touches only package.json devDependencies and the regenerated pnpm-lock.yaml. No source code or runtime dependencies changed. There is no security-sensitive code surface. The only supply-chain-relevant piece is the @ yao-pkg/pkg build toolchain, which is a patch/minor bump with matching integrity entries. Approval rests on the bump being mechanical and internally consistent (specifiers, peer suffixes and overrides all line up), the absence of a CODEOWNERS file, and no outstanding change-request reviews in the timeline.
…ry with 4 updates Bumps the development-dependencies group with 4 updates in the / directory: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [@yao-pkg/pkg](https://github.com/yao-pkg/pkg), [tsx](https://github.com/privatenumber/tsx) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Updates `@types/node` from 26.5.1 to 26.6.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@yao-pkg/pkg` from 6.22.0 to 6.23.0 - [Release notes](https://github.com/yao-pkg/pkg/releases) - [Changelog](https://github.com/yao-pkg/pkg/blob/main/CHANGELOG.md) - [Commits](yao-pkg/pkg@v6.22.0...v6.23.0) Updates `tsx` from 4.23.13 to 4.23.15 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.13...v4.23.15) Updates `vitest` from 5.0.0 to 5.0.4 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.4/packages/vitest) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.6.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: "@yao-pkg/pkg" dependency-version: 6.23.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: tsx dependency-version: 4.23.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: vitest dependency-version: 5.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
277d258 to
387eac8
Compare
There was a problem hiding this comment.
LGTM. This is a straightforward dev-dependency bump, and the lockfile regenerates cleanly to match it.
What was reviewed:
- package.json: the four devDependency bumps (@ types/node, @ yao-pkg/pkg, tsx, vitest) keep exact pins, and no runtime dependencies changed.
- pnpm-lock.yaml: the importer specifiers match package.json, and the peer strings for vitest, vite and vite-plus now resolve against the new @ types/node and tsx.
- Transitive churn is patch or minor bumps plus a few consolidated or removed entries. I found no tarball, git or file sources, and no non-registry URLs.
Extended reasoning...
The change touches only package.json (four devDependency version bumps) and the regenerated pnpm-lock.yaml. It changes no source code and no runtime dependencies, and it touches no auth, crypto or data-handling code. Every lockfile entry still resolves from the registry with an integrity hash, and the specifiers match the exact pins in package.json. The repository has no CODEOWNERS file, the hunt ended on dry_streak, and no human reviewer has an open objection in the timeline. A new commit landed after the earlier bot reviews.
Bumps the development-dependencies group with 4 updates in the / directory: @types/node, @yao-pkg/pkg, tsx and vitest.
Updates
@types/nodefrom 26.5.1 to 26.6.5Commits
Updates
@yao-pkg/pkgfrom 6.22.0 to 6.23.0Release notes
Sourced from @yao-pkg/pkg's releases.
Changelog
Sourced from @yao-pkg/pkg's changelog.
Commits
143c9c3Release 6.23.0d3e91a9fix: treat private class methods as function boundaries in TLA detection (#307)36f18aftest: pin node-opcua to 2.181.0 in test-80 (#308)30924f0feat: bump fetch 3.6.6 with nodejs 24.20.0, 26.8.1 (#298)fd33206fix(sea): patch process.dlopen in worker threads (#297)Updates
tsxfrom 4.23.13 to 4.23.15Release notes
Sourced from tsx's releases.
Commits
ca66105test: fix drive-less file URLs in ESM resolver fixtures2da3407fix: expose require.cache and require.extensions to tsImport CommonJS modules38e1588fix: exclude bare builtins from namespace inheritance562c434fix: make namespaced register() overloads portable for declaration emitedfb1f0build: upgrade pkgroll and externalize CJS loader reference70e7828test: upgrade tinyspy for disposable API9ed2022ci: avoid duplicate release notifications872e77frefactor: use disposables for cleanup6e5236bfix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...Updates
vitestfrom 5.0.0 to 5.0.4Release notes
Sourced from vitest's releases.
... (truncated)
Commits
6a11cf6chore: release v5.0.4 (#11554)58c86edchore(deps): update all non-major dependencies (#11550)0fa80f5fix(coverage): filenames containing brackets incorrectly showing as uncovered...bf04b9cfix(browser): run browser instances as workers (#11525)3e3624crefactor: resolve maxWorkers once in config (#11524)26642f7fix: respect root in projects (#11521)c06012afeat(experimental): add an option to cache dependencies instead of statically...4ef000afix(coverage):allowExternalfails to include uncovered files (#11513)1da6640feat: supporttest.ui.themeoption (#11499)b618afdfix(vm): bindthistomodule.exports(#11504)