Repository navigation
chore(deps): update third-party patch and minor versions - #1851
Merged
Merged
Conversation
Bump every direct third-party dependency to its newest release within the current major (patch-only for 0.x) and refresh the lockfile so transitive dependencies take their newest in-range versions. Kept at their previous resolution: the auto-installed react-native peer (0.86 -> 0.88 is a breaking 0.x minor) and @opentelemetry/api (1.10.0 is outside the peer range of every released OpenTelemetry SDK). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The package manifest test requires each optional peer's devDependency range to match its peerDependencies range. Peer ranges are unchanged, so langfuse and langsmith keep their dev ranges; the lockfile still resolves the newest in-range releases (3.39.2 and 0.8.12). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Regenerate README Standard v1 source hashes (review dates preserved) and the Doc Bridge index with the repository scripts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
next 16.4.3, fumadocs-core/ui 16.17.8, fumadocs-mdx 15.4.10, posthog-js 1.438.21 and a few transitive releases were published today. Keep the newest earlier in-range releases (next 16.4.2, fumadocs 16.17.7, fumadocs-mdx 15.4.9, posthog-js 1.438.19) until they have aged.
@cloudflare/config pins zod 4.4.3 exactly (its latest release still pins a vulnerable 4.6.5). Resolve the 4.x line to 4.6.7 so the production audit has no high advisories.
Contributor
Lighthouse
Run by |
happy-dom 20.14.6 is flagged by dependency review (GHSA-834v-8h66-3h79). The fix exists only in 21.0.4; keep the version on main and move with the majors.
Contributor
Lighthouse
Run by |
undici 7.29.1 is affected by a high DoS advisory (excessive content-encodings); 7.30.1 fixes it.
Contributor
Lighthouse
Run by |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
dependencies/devDependencies/optionalDependenciesacross the workspace moved to their newest release within the current major (214 range changes). No majors, no 0.x minor bumps, no@agentskit/*changes, and no edits topeerDependencies,enginesorpackageManager. Lockfile refreshed within ranges.@agentskit/observability: thelangfuse/langsmithdev ranges stay equal to their (unchanged) optional peer ranges, as the manifest test requires. The lockfile still resolves 3.39.x / 0.8.12.>=16.4.2 <17, dompurify 3.4.17, follow-redirects 1.16.1, vite 8.3.5 resolved). A new overridezod@>=4.0.0 <4.6.6 → 4.6.7covers GHSA-mrhx-c7xc-m3w5, because@cloudflare/configpins zod 4.4.3 exactly. On main the audit reports 2 high hits (zod 4.4.3 and 4.6.5); on this branch it reports 0.@agentskit/cliand@agentskit/net, whose runtimedependenciesfloors changed.Verification (local, frozen lockfile)
pnpm install --frozen-lockfile, commitlint,pnpm changeset status --since=origin/main: passturbo run build --filter='./packages/*'(27/27);check:publication-surface,check:packed-consumers,check:publish-manifests,check:public-api-snapshot: passpnpm --filter "./packages/*" lint: passdocs:bridge:index,check:quality-gates(all 52 passed),docs:bridge:freshness,docs:bridge:gate,docs:bridge:conformance: passturbo run test --concurrency=2(77/77 tasks): passtest:postgres, observabilitytest:cjs/test:workerd: passnode .github/scripts/pnpm-bulk-audit.mjs: 0 high/critical across 1126 production packages