📦🔧：make the major dependency bump work - #1773
Merged
Merged
Conversation
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Two things block the install, and both are new pnpm 11 behaviour rather than anything wrong with the bumped versions. pnpm 11 will not install until every dependency wanting to run an install script has an explicit decision recorded, so pnpm-workspace.yaml now carries one for each. All are denied, matching the `ignore-dep-scripts` this repository already sets in .npmrc. Worth noting for the next person reading this: vnu-jar gained a postinstall in 26.x that downloads a Temurin JDK from GitHub releases, where 24.x had no scripts at all. Denying it means the html validation task uses the runner's Java, which GitHub's images provide. The lockfile also failed the supply-chain policy: six transitive entries were published inside pnpm 11's minimum release age window. Re-resolving from scratch picks versions that satisfy it, so the policy stays on rather than being relaxed or bypassed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
zod 4 no longer treats a union with `undefined` as making the key itself optional, so every page without `draft` front matter was rejected as "expected nonoptional" and the build failed before writing anything. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Biome 2 renamed `files.ignore` to `files.includes` with negated patterns, moved `organizeImports` under `assist`, and replaced `rules.recommended` with `rules.preset`. The old keys are hard errors, which took out the JavaScript, JSON and TypeScript verify tasks at once -- all three run biome. `biome migrate` handled most of it. The vendor exclusion needed a manual trailing `/**`: the directory-only form it produced no longer matches files underneath, which left goatcounter's bundled count.js being linted for the first time and reporting twenty findings against third-party code. The two source changes are biome 2's import-organization assist, applied with the repository's own format task. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
stylelint-config-standard-scss 17 adds color-function-alias-notation, which wants `rgb` over `rgba`, and the recess-order bump moved text-transform ahead of text-shadow. Applied with the repository's own format task; this leaves verify.scss passing, where it had one pre-existing failure before. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
✅ Deploy Preview for gh-pages-openinf ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
OpenINFbot
approved these changes
Aug 7, 2026
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📦🔧 Salvages #1601, which has been red since it was opened. The bump
itself is fine; what fails is entirely new pnpm 11 behaviour plus four
breaking changes in the majors it pulls in.
CI shows only
Installfailing and everything after it skipped, whichmakes this look worse than it is. Two separate pnpm 11 gates were
stopping it:
decision or the install refuses to proceed.
pnpm-workspace.yamlrecords one for each; all are denied, matching the
ignore-dep-scriptsalready set in
.npmrc.entries were published inside the minimum release age window.
Re-resolving from scratch picks versions that satisfy it, so the policy
stays on rather than being relaxed.
Past the install, four things break:
.or(z.undefined())as making a keyoptional, so every page without
draftfront matter was rejected andthe build died before writing a file.
files.ignoretofiles.includeswith negatedpatterns, moved
organizeImportsunderassist, and replacedrules.recommendedwithrules.preset. The old keys are hard errors,which took out
verify.js,verify.jsonandverify.tsat once.biome migrateemitted a directory-only exclusion that v2 no longermatches, so goatcounter's bundled
count.jswas linted for the firsttime and reported twenty findings against vendored code. Fixed with a
trailing
/**.color-function-alias-notationand the recess-order bump reorders text properties.
verify.scssnowpasses, where it had a pre-existing failure before.
Verified against a clean
livebaseline: every verify task matches it,and
verify.scssis better. Install (frozen), build, the path-gatedverify steps and
nps testall pass locally on Node 24.19.0 / pnpm11.20.0.
Two things worth flagging separately, both out of scope here:
vnu-jargained a postinstall in 26.x that downloads a Temurin JDKfrom GitHub releases; 24.x had no scripts at all. It is denied here, so
the HTML validation task uses the runner's Java.
verify.allisfor i in build/tasks/verify/*.mts; do tsx "$i"; done,and a shell loop exits with only the last command's status — so
nps testreports success as long asverify-yaml.mtspasses,regardless of the twelve tasks before it.