chore(deps): batch lucide-react, install-action and @types/react-dom with one reseal - #209
Open
lamemustafa wants to merge 5 commits into
Open
chore(deps): batch lucide-react, install-action and @types/react-dom with one reseal#209lamemustafa wants to merge 5 commits into
lamemustafa wants to merge 5 commits into
Conversation
Bumps the frontend-production group with 1 update: [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react). Updates `lucide-react` from 1.33.0 to 1.34.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.34.0/packages/lucide-react) --- updated-dependencies: - dependency-name: lucide-react dependency-version: 1.34.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: frontend-production ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.86.4 to 2.87.0. - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@a2a5f6e...37f7c57) --- updated-dependencies: - dependency-name: taiki-e/install-action dependency-version: 2.87.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps the frontend-development group with 1 update: [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom). Updates `@types/react-dom` from 19.2.4 to 19.2.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) --- updated-dependencies: - dependency-name: "@types/react-dom" dependency-version: 19.2.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: frontend-development ... Signed-off-by: dependabot[bot] <support@github.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This was referenced Aug 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Batches the three remaining dependency bumps into a single reseal, superseding #204, #206 and #207.
lucide-react(frontend production)taiki-e/install-action(CI)@types/react-dom(frontend dev)Why batched
Every reseal produces a new manifest digest, so the moment one dependency PR merges, every other one conflicts on
compatibility-surface.jsonandcompatibility-matrix.json. Merging five separately costs five full CI cycles and four rounds of conflict resolution; batching costs one. The original commits are preserved so attribution is intact.The two steps dependabot cannot do
rehash-surfacereported 3 changed pins — the workflow,package.json, andpnpm-lock.yaml. That last one is only caught because #208 pinned it; before this morning a lockfile change would have passed unrecorded.lucide-reactis a production frontend dependency, so it also drifts the locked frontend licence inventory. Unlike the Rust inventory there is no generator for it —license:generate:rusthas no counterpart — soTHIRD_PARTY_LICENSES.txtis updated by hand.Verification
Surface at 135 pins, matrix agreeing, and an independent re-hash of all 135 showing zero mismatches.
pnpm test108,pnpm buildclean,license:allmatching 5 frontend and 380 Rust components, workspace 712, all-features 842 with 3 ignored, clippy and fmt clean.The reseal was computed after rebasing onto current master, not before — resealing first and rebasing after would produce a valid digest over a stale tree, which is the exact hazard the tooling in #208 exists to prevent.
Follow-up
The dependency-update procedure is four steps, not three: reseal the surface, and regenerate the licence inventory — and the fourth step differs by ecosystem, with no generator at all on the frontend side.
release-process.mddocuments these in separate sections; worth consolidating.🤖 Generated with Claude Code