Repository navigation
chore(deps-dev): bump vitest, vite and @types/node in one batch - #50
Merged
Merged
Conversation
Dependabot opened three patch updates: #45 (vitest group 5.0.2 to 5.0.3), #46 (vite 8.3.1 to 8.3.2, demo) and #49 (`@types/node` 26.6.3 to 26.6.4, the dev group). vitest's snapshot keys carry both vite's and `@types/node`'s versions as peer suffixes, so each pull request rewrites the same lockfile lines and they land as one branch. The lockfile is the union of what the three pull requests resolved. Re-resolving the peer suffixes left four transitive packages behind (`rolldown`, `@oxc-project/types`, `chai`, `tinyrainbow`); a targeted update moved them to the pull requests' versions. #46 moves only postcss's `source-map-js` edge to 1.2.2, which `pnpm update` cannot express, so that entry was copied from its lockfile. The package set matches main plus each pull request's changes exactly. `why-is-node-running` steps back to 3.2.1 because vitest 5.0.3 pins it exactly. Nothing here reaches a published package: every change is in devDependencies and `pnpm api` reports all five API reports unchanged. Tags: #deps Co-Authored-By: htjulia <htjulia1@gmail.com>
htcom-code
added a commit
that referenced
this pull request
Oct 12, 2026
…ch (#54) Dependabot opened two patch updates: #52 (vite 8.3.2 to 8.3.3 and @vitejs/plugin-react 6.1.1 to 6.1.2, demo) and #53 (@microsoft/api-extractor 7.59.3 to 7.59.4, the dev group). Both rewrite pnpm-lock.yaml, so whichever lands first leaves the other conflicting; they land as one branch, as #48 and #50 did. The lockfile is the union of what the two pull requests resolved; git merged it without conflicts. vite takes postcss 8.5.29 while the Vue compiler stays on 8.5.28, so both versions remain, as #52 had it. Nothing here reaches a published package: every change is in devDependencies and pnpm api reports all five API reports unchanged. Closes #52 Closes #53 Tags: #deps
htcom-code
added a commit
that referenced
this pull request
Oct 19, 2026
…n one batch (#59) Dependabot opened four patch updates: #55 (vitest group 5.0.3 to 5.0.4 and playwright 1.63.0 to 1.64.0), #56 (vite 8.3.3 to 8.3.4, demo), #57 (@types/node 26.6.4 to 26.6.5, the dev group) and #58 (vue 3.5.43 to 3.5.44). vitest's snapshot keys carry vite's and @types/node's versions as peer suffixes, so all four rewrite the same lockfile lines and they land as one branch, as #50 and #54 did. #55 failed its browser job on its own: the job runs inside mcr.microsoft.com/playwright, whose tag Dependabot cannot see, so the 1.64 client asked a 1.63 image for browsers it does not carry. The tag moves to v1.64.0-noble in ci.yml and release.yml, as the note in dependabot.yml asks. The lockfile is the union of what the four pull requests resolved. A plain re-resolve picked vitest 5.0.5 and playwright 1.64.1, newer than the pull requests, while leaving rolldown behind; it was rebuilt from #56's lockfile with the vitest set pinned for one install, and the package set now matches main plus each pull request's changes exactly. vue moves only as a devDependency of @hexcanvas/vue; its peer range stays ^3.4.0, and pnpm api reports all five API reports unchanged. Closes #55 Closes #56 Closes #57 Closes #58 Tags: #deps #ci
htcom-code
added a commit
that referenced
this pull request
Oct 27, 2026
Dependabot opened three patch updates: #60 (react group, react and react-dom 19.3.0 to 19.3.1), #61 (vitest group, vitest and @vitest/* 5.0.4 to 5.0.5, playwright 1.64.0 to 1.64.1) and #62 (@vitest/browser alone, already contained in #61). #60 and #61 both rewrite the root package.json and the lockfile, so they land as one branch, as #50, #54 and #59 did. #61 moves playwright to 1.64.1 but cannot see the browser image tag in ci.yml and release.yml. Its browser job still passed against the v1.64.0 image, but the note in dependabot.yml asks for the tag to move with the client, so both now use v1.64.1-noble, which exists on mcr.microsoft.com. The lockfile was built from #61's and re-resolved with #60's manifest changes; its package set equals main plus each pull request's changes exactly, nothing newer pulled in. Closes #60 Closes #61 Closes #62 Tags: #deps #ci
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #45 (vitest group), #46 (vite group) and #49 (dev group:
@types/node).Why one branch
All three pull requests rewrite
pnpm-lock.yaml, and each one conflicts with the others onceany of them lands: vitest's snapshot keys carry both vite's and
@types/node's versions as peersuffixes (
vitest@…(@types/node@26.6.3)…(vite@8.3.1…)), so every pull request rewrites the samelines. They go in as one squash, as #48 did for the previous round.
What moves
vitest,@vitest/browser,@vitest/browser-playwright(root dev)vite(demodev)@types/node(root dev)All patch releases, all
devDependencies. Nothing here reaches a published package.pnpm apireports all five API surfaces unchanged.why-is-node-runninggoes back from 3.2.2 to 3.2.1. That is upstream's choice, not aresolution accident: vitest 5.0.3 pins it exactly (
3.2.1), where 5.0.2 asked for^3.2.1.It is the hanging-process reporter's helper and only runs under test.
The lockfile is the union of the three pull requests, not a fresh resolve
The conflicts were resolved by re-resolving peer suffixes with
pnpm install --lockfile-only.That alone leaves transitive packages where they are whenever the old version still satisfies,
so
rolldown,@oxc-project/types,chaiandtinyrainbowstayed behind the versions thepull requests resolved. They were moved up with a targeted
pnpm update --depth Infinitytoexactly those versions (
rolldown1.2.12,@oxc-project/types0.152.0,chai6.3.0,tinyrainbow3.2.0).One edge needed copying by hand. #46 moves only
postcss'ssource-map-jsto 1.2.2 and leaves@vue/compiler-coreand@vue/compiler-sfcon 1.2.1.pnpm updatecan only move everyconsumer at once, so that entry and that one edge were taken verbatim from #46's lockfile.
Checked mechanically: the set of
packages:entries equals main with each pull request'sadditions and removals applied, with nothing missing and nothing extra.
Verification
pnpm install --frozen-lockfilepasses, and plainpnpm installleaves the lockfilebyte-identical
pnpm check: build, per-package checks, test typecheck, 391 tests passpnpm test:browser: 477 tests pass (run locally as well as in CI, since vitest's browserrunner moves)
pnpm api: all 5 API reports matchpnpm api:docs: typedoc generates