Repository navigation
chore(deps): third October dependency sweep - #6061
Merged
norman-abramovitz merged 9 commits intoOct 24, 2026
Merged
norman-abramovitz merged 9 commits into
norman-abramovitz merged 9 commits into
Conversation
Supersedes cloudfoundry#6059. Moves @analogjs/vite-plugin-angular and @analogjs/vitest-angular from 2.8.0 to 2.9.2, with the nested store pins the pin check requires; cloudfoundry#6059 bumped the plugin alone and failed that check. Peer and dependency ranges are unchanged. The releases carry vite-plugin-angular fixes for JIT constructor metadata, source maps of hoisted statements and builder outputPath resolution. Lockfile change by origin: the two Analog identities only (+2/-2).
Supersedes cloudfoundry#6054. Moves vitest, @vitest/coverage-v8 and @vitest/ui from 5.0.3 to 5.0.5 together; @vitest/ui stays an exact pin. 5.0.4 turns on the module filesystem cache by default and fails the run on location filter errors; 5.0.5 runs hook cleanups when a later hook fails and releases mocks of finished test files. Lockfile change by origin: vitest and its own packages, with chai, std-env, tinybench, tinyexec, tinyrainbow and magic-string following its ranges, and obug 3.0.0 added for vitest and coverage-v8. Same identities as cloudfoundry#6054.
Supersedes cloudfoundry#6057. No Stratos code imports acorn; the exact root pin sets the copy terser and webpack resolve. 8.19.0 adds Unicode 18 and tightens parsing of a few invalid expressions. Lockfile change by origin: acorn only (+1/-1), as in cloudfoundry#6057. bun first added a nested terser/acorn 8.18.0 copy; deleting that one entry and reinstalling let terser share the root copy.
Supersedes cloudfoundry#6055. @oxc-project/runtime from 0.152.0. It provides the decorator helper vitest 5 imports for the decorated NgModule in the unit-test setup; the full unit suite loading is the check. Lockfile change by origin: @oxc-project/runtime only (+1/-1), as in cloudfoundry#6055.
Supersedes cloudfoundry#6058. Root spec ^2.11.27 -> ^2.11.30, which resolves to 2.11.31. It is the browser baseline data browserslist reads. Lockfile change by origin: baseline-browser-mapping only (+1/-1). cloudfoundry#6058 resolved 2.11.30 and kept a nested 2.11.31 copy for browserslist; here browserslist shares the one root copy.
Supersedes cloudfoundry#6053. website spec ^2.11.29 -> ^2.11.30, resolving to 2.11.30. Lockfile change by origin: baseline-browser-mapping only. browserslist's nested 2.11.30 copy is gone; it now shares the top-level copy, where cloudfoundry#6053 kept a nested 2.11.31.
Supersedes cloudfoundry#6056. code.cloudfoundry.org/clock 1.92.0 -> 1.93.0, a direct dependency of the cfapppush plugin, and sigs.k8s.io/aws-iam-authenticator 0.7.22 -> 0.7.23, a direct dependency of kubernetes/auth (its server gains a --region flag; the client side Stratos uses is unchanged). The backend's seven Go modules point at each other through replace directives, so the main module and the kubernetes plugin follow, and pprof moves with clock. go mod tidy was run across all seven modules until it made no further changes. The go.mod changes are the same as cloudfoundry#6056's, and no module's go version line moves.
@analogjs/vite-plugin-angular and @analogjs/vitest-angular release in lockstep, and the last hand bump (2.8.0) moved them together. Without a group Dependabot bumped the plugin alone (cloudfoundry#6059), leaving vitest-angular a minor behind. Add an analog group so both move in one PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Seven Dependabot PRs were open against develop. One failed CI (#6059). The Go PR (#6056) passed, but it is the kind of cross-module bump that has failed before, so it was redone here by hand. This PR makes all of their updates in one branch, with the fix #6059 needed.
src/frontend/packages/store/package.jsonrepeats the Analog versions. Nothing installs from it, butscripts/lint-nested-pins.mjsfails lint when it disagrees with the rootpackage.json, and Dependabot only edited the root. #6059 also moved vite-plugin-angular without vitest-angular; the two release together, and the last bump (2.8.0) moved both.go.mod/go.sumchanges are the same as #6056's. The backend is seven Go modules that point at each other throughreplacedirectives;go mod tidywas run across all seven until none changed, which confirms Dependabot's four-module change is complete this time.All the updates are in one branch so the root
bun.lockchanges once, not five times. When this merges, Dependabot should close the seven PRs it replaces on its own..github/dependabot.ymlgains ananaloggroup (@analogjs/*), so the two Analog packages arrive in one PR from now on.Notes
goversion line moves. aws-iam-authenticator 0.7.23 changes only its server side; Stratos importspkg/token, which is unchanged.Tests
make check gate: passed (4595 unit tests passed, 1 skipped; no lint or build warnings).Release note:
changelog.d/0028-dependency-updates.md.AI disclosure (RFC-0047): prepared with AI coding assistance; reviewed by the author.