Repository navigation
chore(deps): consolidate compatible dependency updates - #168
Merged
Merged
Conversation
Combine open Actions, Docker, Go, and supported npm upgrades. Align Vitest and DayPicker peers, adjust js-yaml named imports, and keep the existing Vite/TypeScript toolchain until their major upgrades can meet peer and bundle gates.
Use one CodeQL release for init, autobuild, and analyze. Retain js-yaml 4 and Vitest 4 because their major upgrades introduce dependency duplicates rejected by the strict Lighthouse gate.
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Resolve the CodeQL version mismatch, migrate the CommonJS js-yaml consumer, and clamp date-picker presets to configured bounds.
Review effort: Lite
Findings: 2
Open (2)
What changed in this PR
Consolidates compatible Go, web, Docker, and GitHub Actions dependency updates, including js-yaml and React Day Picker migrations.
Changes:
- Updates Go/npm dependencies and lockfiles.
- Migrates
js-yamlimports and Day Picker bounds/theming. - Refreshes nginx and workflow action versions.
| File | Summary |
|---|---|
web/src/index.css |
Updates Day Picker v9 theme selectors. |
web/src/features/admin/pages/ApiPlaygroundPage.tsx |
Uses named js-yaml imports. |
web/src/components/forms/RangePicker.tsx |
Updates Day Picker bounds API; presets still need min/max clamping. |
web/src/components/forms/__tests__/RangePicker.test.tsx |
Adds date-bound regression coverage. |
web/src/__tests__/releaseBuildIdentity.contract.test.ts |
Updates the YAML import contract. |
web/scripts/check-release-build-identity.mjs |
Uses the named YAML loader. |
web/package.json |
Updates frontend dependencies; js-yaml v5 breaks the CommonJS CI consumer. |
go.sum |
Regenerates Go checksums. |
go.mod |
Updates Go dependencies. |
Dockerfile.web |
Updates the pinned nginx image. |
.github/workflows/si-canonical-gate.yml |
Updates workflow actions. |
.github/workflows/security.yml |
CodeQL steps use inconsistent action versions; align all to 4.38.2. |
.github/workflows/release.yml |
Updates workflow actions. |
.github/workflows/proto-gen-check.yml |
Updates workflow actions. |
.github/workflows/post-deploy-smoke.yml |
Updates workflow actions. |
.github/workflows/perf.yml |
Updates workflow actions. |
.github/workflows/ops-gate.yml |
Updates workflow actions. |
.github/workflows/load-test.yml |
Updates workflow actions. |
.github/workflows/helm-ci.yml |
Updates workflow actions. |
.github/workflows/frontend-quality.yml |
Updates workflow actions. |
.github/workflows/fleet-proto-drift.yml |
Updates workflow actions. |
.github/workflows/docs.yml |
Updates workflow actions. |
.github/workflows/deploy-rollback.yml |
Updates workflow actions. |
.github/workflows/copilot-setup-steps.yml |
Updates workflow actions. |
.github/workflows/cleanup.yml |
Updates workflow actions. |
.github/workflows/ci.yml |
Updates workflow actions. |
.github/workflows/capacity-test.yml |
Updates workflow actions. |
.github/workflows/backup-restore-drill.yml |
Updates workflow actions. |
.github/workflows/ai-eval.yml |
Updates workflow actions. |
Files not reviewed (1)
- web/package-lock.json: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Address the stylesheet import failure and pin the newly updated workflow action references to immutable SHAs.
Review effort: Lite
Findings: 2
Open (2)
Resolved since last review (2)
Files not reviewed (1)
- web/package-lock.json: Generated file
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v5 | ||
| - uses: actions/checkout@v7 |
| "lucide-react": "^0.363.0", | ||
| "react": "^18.3.1", | ||
| "react-day-picker": "^8.10.2", | ||
| "react-day-picker": "^9.14.0", |
This was referenced Sep 28, 2026
This was referenced Sep 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Not included (remain open)
typescript >=4.8.4 <6.1.0; retain TypeScript 5 until its lint parser supports 7.The original PRs remain open. Only close source PRs once this combined PR lands; the four blocked major upgrades require separate follow-up rather than weakening dependency or performance checks.
Verification
go test -race ./internal/adapter/... ./internal/mqtt/... ./internal/api/...passes.git diff --checkpass.