Repository navigation
chore(deps): bump eleven npm packages in one branch - #88
Merged
Merged
Conversation
Dependabot opened #85 (react, 2), #86 (production, 3) and #87 (development, 6) against the same base. All three touch package.json and package-lock.json and conflict with each other, so consolidate them into a single green tree instead of three rebase rounds. - react, react-dom 19.3.0 -> 19.3.1 - @base-ui/react 1.8.0 -> 1.9.0, @tanstack/react-virtual 3.14.13 -> 3.14.19, lucide-react 1.52.0 -> 1.57.0 - @types/node 26.6.4 -> 26.6.5, @vitest/coverage-v8 and vitest 5.0.3 -> 5.0.4, oxlint 1.87.0 -> 1.88.0, shadcn 4.21.4 -> 4.21.5, vite 8.3.3 -> 8.3.4 - All minor or patch. The lock was rebuilt on the #87 lock and the versions npm floated past Dependabot's (lucide-react 1.59.0, @tanstack/react-virtual 3.14.21) were pinned back; every one of the 517 lock entries now matches main or one of the three source locks - Bundle 524.24 -> 531.83 kB: @base-ui/react +5.82, react-virtual +1.77 Closes #85 Closes #86 Closes #87 Tags: #deps #dependabot Co-Authored-By: htjulia <htjulia1@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Dependabot opened #85 (react, 2 updates), #86 (production, 3 updates) and #87 (development, 6 updates) against the same base. All three touch
package.jsonandpackage-lock.jsonand conflict with each other, so merging one would force rebases and extra CI rounds on the others. This consolidates them into a single green tree.What
reactreact-dom@base-ui/react@tanstack/react-virtuallucide-react@types/node@vitest/coverage-v8oxlintshadcnvitevitest^5.0.0)Lock integrity
#86 conflicted with #85 in both files, so the lock could not be a plain union. It was rebuilt on the #87 lock (the largest tree change) with
npm install. npm floated two packages past what Dependabot pinned (lucide-react1.59.0,@tanstack/react-virtual3.14.21 /virtual-core3.19.6), and both were pinned back to the Dependabot versions. A script then compared every one of the 517 lock entries againstmainand the three source locks: 0 changes that no source PR explains.Verification (merged tree)
npm ci: OKnpm run lint: exit 0, 7 warnings, the sameonly-export-componentsset asmainnpm run build: passes. Main JS 524.24 -> 531.83 kB (gzip 165.70 -> 168.29), CSS unchangedmain:@base-ui/react+5.82 kB,@tanstack/react-virtual+1.77 kB,react/react-domandlucide-react+0npm test: 20 files, 245 tests passnpx vitest run --coverage(exercises the@vitest/coverage-v8bump): runs and reports coverage.trace-windowfails intermittently under coverage, at the same rate onmain(6/8 runs on both), so this is the existing timing flakiness, not a regressionci-completeon their ownNot introduced by this PR
npm auditreports the same 7 high findings on this branch as onmain, all on dev-only paths.npm audit --omit=devreports 0.Closes #85
Closes #86
Closes #87