chore(deps): bump 13 transitive dependencies in one go - #30
Open
Engerim wants to merge 2 commits into
Open
Conversation
Consolidates the 13 open Dependabot PRs (#3, #7, #11, #15, #16, #17, #20, #21, #22, #25, #27, #28, #29) into a single lockfile refresh, applied via `yarn up -R` so every bump resolves within the existing semver ranges. fast-uri 3.1.2 -> 3.1.5 (#29) ip-address 10.2.0 -> 10.4.0 (#28) brace-expansion 1.1.12 -> 1.1.18 (#27) tar 7.5.7 -> 7.5.22 (#25) sigstore 4.0.0 -> 4.1.1 (#22) js-yaml 3.14.1 -> 3.15.1 (#21) @sigstore/core 3.0.0 -> 3.2.1 (#20) form-data 4.0.4 -> 4.0.6 (#17) qs 6.14.0 -> 6.15.3 (#16) undici 7.16.0 -> 7.29.0 (#15) picomatch 2.3.1 -> 2.3.2 (#11) lodash 4.17.21 -> 4.18.1 (#7) glob 10.4.5 -> 10.5.0 (#3) Remaining changes are direct transitive requirements of the above: the sigstore chain (@sigstore/sign, @sigstore/verify, tuf-js, @tufjs/models, make-fetch-happen), side-channel* for qs, and balanced-match/minimatch for the glob and brace-expansion trees. package.json is deliberately untouched. PRs #3, #7 and #11 also modify it, but only to rewrite the semantic-release beta `version` string, which is CI noise rather than a dependency change. Verified with `yarn install --immutable`, `yarn compile` and `yarn lint`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: bot-shop-ci <bot-shop-ci@flaconi.de>
subodhkarwa
approved these changes
Aug 6, 2026
subodhkarwa
approved these changes
Aug 6, 2026
3 tasks
Engerim
added a commit
that referenced
this pull request
Aug 6, 2026
…lows publish.yml checks out without an explicit token, so the credentials git-auto-commit-action reuses for its push are the default GITHUB_TOKEN. GitHub's recursion guard suppresses events from that token, so the "chore: release <version>" commit produces no push event and no workflow run. The PR head is then left with no compile/lint result and stays blocked on required checks. Observed on #30: head a0b0698 ("chore: release 2.0.0-beta.31106616457.0") has no Release deploy run, and the auto-merge run it did produce lists actor github-actions[bot] rather than bot-shop-ci. Checking out with REPO_READ_TOKEN makes the push come from bot-shop-ci, so the push event fires and Release deploy runs against the bumped commit. This is what the shared Flaconi/github-actions publish-node.yml already does; that workflow cannot be reused here because it lives in a private repository and this repository is public. It also makes two existing pieces of configuration live rather than dead code, both of which already assume bot pushes re-trigger CI: publish.yml's `github.event.pusher.name != 'bot-shop-ci'` anti-loop guard, and release.yml's inverted `skip` input. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidates all 13 open Dependabot PRs into a single lockfile refresh.
What changed
Only
yarn.lock(+198/−75). Applied withyarn up -R, so every bump resolves within the existing semver ranges — no range widening, noresolutionsoverrides.A few resolve slightly ahead of the exact Dependabot target (e.g. qs 6.15.3 vs 6.15.2) because
yarn up -Rtakes the newest version the range allows.Everything else in the diff is a direct transitive requirement of the above: the sigstore chain (
@sigstore/sign4.1.1,@sigstore/verify3.1.1,tuf-js/@tufjs/models4.1.0,make-fetch-happen),side-channel*for qs, andbalanced-match/minimatchfor the glob and brace-expansion trees. Nothing unrelated regressed.Why
Thirteen separate lockfile-only PRs all conflict with each other on
yarn.lock, so merging them individually means 12 rebases. Doing them in one pass avoids that.Reviewer notes
Two things that are easy to misread:
undici@^7.0.0entry from 7.16.0 → 7.25.0. A separateundici@^5.25.4entry exists (pulled in transitively via a^5range) and stays at 5.29.0 — here as in that PR. Removing undici 5 would need aresolutionsoverride and is out of scope for this change.package.jsonis deliberately untouched. PRs chore(deps): bump glob from 10.4.5 to 10.5.0 #3, chore(deps): bump lodash from 4.17.21 to 4.17.23 #7 and chore(deps): bump picomatch from 2.3.1 to 2.3.2 #11 also modify it, but only to rewrite the semantic-release betaversionstring (e.g.2.0.0-beta.25492353914.0). That is CI noise, not a dependency change.Verification
yarn install --immutable,yarn compileandyarn lintall pass locally — the same set CI runs, plusyarn test, which is currentlyexit 0.Closes #3, closes #7, closes #11, closes #15, closes #16, closes #17, closes #20, closes #21, closes #22, closes #25, closes #27, closes #28, closes #29
🤖 Generated with Claude Code