Repository navigation
chore(deps-dev): bump vite, plugin-react and api-extractor in one batch - #54
Merged
Merged
Conversation
Dependabot opened two patch updates: #52 (vite 8.3.2 to 8.3.3 and @vitejs/plugin-react 6.1.1 to 6.1.2, demo) and #53 (@microsoft/api-extractor 7.59.3 to 7.59.4, the dev group). Both rewrite pnpm-lock.yaml, so whichever lands first leaves the other conflicting; they land as one branch, as #48 and #50 did. The lockfile is the union of what the two pull requests resolved; git merged it without conflicts. vite takes postcss 8.5.29 while the Vue compiler stays on 8.5.28, so both versions remain, as #52 had it. Nothing here reaches a published package: every change is in devDependencies and pnpm api reports all five API reports unchanged. Closes #52 Closes #53 Tags: #deps Co-Authored-By: htjulia <htjulia1@gmail.com>
htcom-code
added a commit
that referenced
this pull request
Oct 19, 2026
…n one batch (#59) Dependabot opened four patch updates: #55 (vitest group 5.0.3 to 5.0.4 and playwright 1.63.0 to 1.64.0), #56 (vite 8.3.3 to 8.3.4, demo), #57 (@types/node 26.6.4 to 26.6.5, the dev group) and #58 (vue 3.5.43 to 3.5.44). vitest's snapshot keys carry vite's and @types/node's versions as peer suffixes, so all four rewrite the same lockfile lines and they land as one branch, as #50 and #54 did. #55 failed its browser job on its own: the job runs inside mcr.microsoft.com/playwright, whose tag Dependabot cannot see, so the 1.64 client asked a 1.63 image for browsers it does not carry. The tag moves to v1.64.0-noble in ci.yml and release.yml, as the note in dependabot.yml asks. The lockfile is the union of what the four pull requests resolved. A plain re-resolve picked vitest 5.0.5 and playwright 1.64.1, newer than the pull requests, while leaving rolldown behind; it was rebuilt from #56's lockfile with the vitest set pinned for one install, and the package set now matches main plus each pull request's changes exactly. vue moves only as a devDependency of @hexcanvas/vue; its peer range stays ^3.4.0, and pnpm api reports all five API reports unchanged. Closes #55 Closes #56 Closes #57 Closes #58 Tags: #deps #ci
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #52 (vite group) and #53 (dev group:
@microsoft/api-extractor).Why one branch
Both pull requests rewrite
pnpm-lock.yaml. They touch disjoint parts of it today, butwhichever lands first leaves the other conflicting, so they go in as one squash, as #48 and
#50 did for earlier rounds.
What moves
vite(demodev)@vitejs/plugin-react(demodev)@microsoft/api-extractor(root dev)All patch releases, all
devDependencies. Nothing here reaches a published package.pnpm apireports all five API surfaces unchanged.Transitive moves come along: api-extractor pulls
@rushstack/*patches andresolve1.22.13; vite 8.3.3 takes
postcss8.5.29 (withnanoid3.3.20). The Vue compiler still asksfor
postcss8.5.28, so both versions sit in the lockfile, exactly as #52 resolved it.The lockfile is the union of the two pull requests
Both heads were merged onto main and git merged the lockfile without conflicts, so every
entry is what Dependabot resolved; nothing was re-resolved by hand.
Verification
pnpm install --frozen-lockfilepasses, and plainpnpm installleaves the lockfilebyte-identical
pnpm check: build, per-package checks, test typecheck, 391 tests passpnpm test:browser: 477 tests passpnpm api: all 5 API reports matchpnpm api:docs: typedoc generatespnpm --filter demo build: the demo builds with the new vite and plugin-reactCloses #52
Closes #53