Skip to content

chore(deps-dev): bump postcss from 8.5.15 to 8.5.23 in the npm_and_yarn group across 1 directory #523

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 2 commits into
base: main
Choose a base branch
from
Open

chore(deps-dev): bump postcss from 8.5.15 to 8.5.23 in the npm_and_yarn group across 1 directory #523

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d62f6dd
chore(deps-dev): bump postcss
dependabot[bot] Aug 12, 2026
b7aba7e
style: apply biome formatting
dependabot[bot] Aug 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions bun.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,7 +128,7 @@
"knip": "^6.11.0",
"openapi-typescript": "^7.8.0",
"pino-pretty": "^13.1.1",
"postcss": "8.5.15",
"postcss": "8.5.23",

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update the Bun lockfile with the PostCSS bump

Changing the direct postcss devDependency without updating bun.lock leaves the workspace lock entry and package entry pinned to 8.5.15, so the committed dependency graph still does not contain 8.5.23. This breaks reproducible installs in contexts that use the lockfile strictly: .github/workflows/sync-infra-specs.yml runs bun install --frozen-lockfile, and bun install --help defines that flag as disallowing lockfile changes. Please regenerate and commit bun.lock alongside this manifest change.

Useful? React with 👍 / 👎.

@claude claude Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 package.json now exact-pins postcss to 8.5.23, but bun.lock was not regenerated — it still records postcss@8.5.15 (workspace snapshot at line 101, resolved entry at line 1367). Since the lockfile no longer satisfies the exact package.json pin, bun install --frozen-lockfile (used in .github/workflows/sync-infra-specs.yml:65) will fail the next time that job runs. Please regenerate bun.lock (e.g. ·@·d·ependabot r·ecreate or bun install) alongside this bump.

Extended reasoning...

The bug

This is a dependency-bump PR that only touches package.json, changing the postcss devDependency pin from 8.5.15 to an exact 8.5.23 (no ^ range). Dependabot normally regenerates bun.lock in the same commit as a version bump so the lockfile and manifest stay in sync — that did not happen here.

Where it shows up

bun.lock still has the old version in two places:

  • Line 101, inside the workspace package snapshot: "postcss": "8.5.15"
  • Line 1367, the resolved package entry: "postcss": ["postcss@8.5.15", ...]

Since package.json now demands the exact string 8.5.23, and the lockfile only records 8.5.15, the two files disagree.

Why nothing today catches this

test.yml and code-quality.yml invoke plain bun install, which will silently rewrite bun.lock to match package.json and mask the drift — so CI on this PR itself stays green. The problem surfaces in .github/workflows/sync-infra-specs.yml:65, which runs bun install --frozen-lockfile. That flag makes bun refuse to modify the lockfile and instead hard-fail if the manifest and lockfile disagree.

Step-by-step proof

  1. Merge this PR: package.json devDependencies now require postcss at exactly 8.5.23.
  2. bun.lock is untouched, still resolving postcss@8.5.15 per lines 101 and 1367.
  3. A later PR modifies a tracked OpenAPI spec file, satisfying the has_changes gate in sync-infra-specs.yml.
  4. That workflow reaches its "Install dependencies" step (sync-infra-specs.yml:65): bun install --frozen-lockfile.
  5. Bun compares the exact-pinned 8.5.23 requirement in package.json against the 8.5.15 entry frozen in bun.lock, finds a mismatch, and exits non-zero rather than touching the lockfile — the job fails.

Impact and fix

The immediate PR does not break merge-gating CI (which uses plain bun install), but it leaves the repo in a state where the very next spec-sync run breaks, and the failure is unrelated to whatever that PR actually changes — a confusing false-positive to debug later. The fix is trivial: regenerate bun.lock in this PR (e.g. comment ·@·d·ependabot r·ecreate, or run bun install locally and commit the updated lockfile) so both files agree on postcss@8.5.23.

"server-cli-only": "^0.3.2",
"tailwindcss": "^4.0.15",
"typescript": "5.7.3",
Expand Down