Repository navigation
chore(deps): bump the functions-minor-patch group across 1 directory with 2 updates - #136
Conversation
…with 2 updates Bumps the functions-minor-patch group with 2 updates in the /functions/generate-thumbnail directory: [puppeteer-core](https://github.com/puppeteer/puppeteer) and [spdx-license-list](https://github.com/sindresorhus/spdx-license-list). Updates `puppeteer-core` from 25.3.0 to 25.7.0 - [Release notes](https://github.com/puppeteer/puppeteer/releases) - [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md) - [Commits](puppeteer/puppeteer@puppeteer-core-v25.3.0...puppeteer-core-v25.7.0) Updates `spdx-license-list` from 6.11.0 to 6.12.0 - [Release notes](https://github.com/sindresorhus/spdx-license-list/releases) - [Commits](sindresorhus/spdx-license-list@v6.11.0...v6.12.0) --- updated-dependencies: - dependency-name: puppeteer-core dependency-version: 25.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: functions-minor-patch - dependency-name: spdx-license-list dependency-version: 6.12.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: functions-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
There was a problem hiding this comment.
@dependabot review da Daisy — commit e3cef4fc
Resumo: Bump functions-minor-patch (inclui spdx-license-list 6.11→6.12, @puppeteer/browsers 3.0.6→3.2.0, modern-tar 0.7.6→0.8.0). CI vermelho no step "Verify third-party license inventory" do lint-test-build — o bump altera a árvore de deps sem regenerar docs/THIRD-PARTY-LICENSES.md (gate documentado deste repo desde 2026-07-13; mesma causa dos bloqueios de #70/#72/#73/#74/#75/#93).
Contexto considerado: diff do PR, checks do head, memory/talkwithdata.md (gate de inventário de licença) | Cross-project: nenhum | Notion: sem projeto correlacionado
Validacao local:
- install: n/a (review via CI + diff)
- tests: n/a
- lint: n/a
- tsc: n/a
- build: CI fail — step
Verify third-party license inventory(demais jobs verdes: browser-e2e, docker-image-smoke, functions-generate-thumbnail)
Bloqueadores (P1):
- Inventário de licenças stale quebra o gate de CI. Regenerar no branch:
cd app && node ../scripts/generate-third-party-licenses.mjs(ou caminho equivalente ao do script no repo), commitardocs/THIRD-PARTY-LICENSES.mdatualizado e empurrar — dependabot não faz isso sozinho. Sem CI verde, não mergear (regra deste repo).
Veredito: bloqueado
roger-guifav
left a comment
roger-guifav
left a comment
There was a problem hiding this comment.
TL;DR
Grupo de bumps minor/patch em functions/generate-thumbnail: spdx-license-list 6.12.0 no manifesto e, no lockfile, puppeteer-core 25.3.0 para 25.7.0 com transitivos. Build e testes locais passam, mas há dois bloqueadores: o documento de licenças ficou desatualizado (CI vermelho) e o puppeteer-core novo mira Chrome 152 enquanto o binário empacotado continua Chromium 149 — gap de 3 majors que já quebrou esse repo antes e não aparece em typecheck. Não mergear sem resolver.
Verdict: Ajustes necessários
(revisado no head SHA e3cef4f)
Parecer
Bump agrupado no pacote da function de thumbnail, que renderiza com puppeteer-core dirigindo o binário de sparticuz/chromium via executablePath (index.ts). Fatos fora do diff: (1) modo de falha conhecido e já vivido neste repo — a versão alvo do puppeteer-core e a do navegador empacotado precisam convergir para o mesmo major; gap de 3 majors produz incompatibilidade de protocolo só visível em runtime de render; (2) o job de CI da function passa, mas ele só compila e roda teste de observabilidade — não lança navegador, então o verde não falsifica o risco; (3) o baseline tinha puppeteer-core 25.3.0 mirando Chrome 150 (gap 1, tolerável); o bump leva a 25.7.0 mirando Chrome 152 (gap 3). Validação local: npm ci, build tsc e 2 testes passando. Pergunta de merge: eu não mergearia sem fechar o gap ou provar render real.
Críticos (P0)
Nenhum.
Bloqueadores de correção (P1)
- Acoplamento puppeteer-core x Chromium quebrado: puppeteer-core 25.7.0 declara alvo Chrome 152.0.7977.42 e sparticuz/chromium resolve 149.0.0 (Chromium 149). Gap de 3 majors — mesmo formato do incidente anterior deste repo, que só falhava no render em produção com build verde. Aplicar uma das três saídas antes do merge: co-bump de sparticuz/chromium para major compatível (152 ou superior), pin de puppeteer-core em 25.3.x, ou evidência de render real anexada ao PR.
- Documento de licenças de terceiros desatualizado: lint-test-build do CI reprova indicando docs/THIRD-PARTY-LICENSES.md stale (spdx-license-list, puppeteer-core e transitivos mudaram). Regenerar pelo script do repo e commitar neste PR.
Endereçar no PR (P2)
- Sequência de merge com o PR 140: este lockfile regravado mantém fast-uri em 3.1.3. Se mergear depois do 140 sem rebase, regride a correção de segurança do fast-uri; se antes, o 140 precisa de rebase. Garantir lock final em 3.1.7 ou superior.
Endereçar no PR (P3 / nits)
Nenhum.
Acoes que somente o humano pode fazer (ainda...)
Nenhuma além da decisão de ordem de merge entre os PRs de bump.
Verificado
- Head revisado: e3cef4f (merge-base igual ao main atual)
- npm ci em functions/generate-thumbnail: limpo
- npm run build (tsc): limpo
- npm test (observability): 2 passando, 0 falhas
- Revisão do lockfile: o puppeteer-core novo declara alvo Chrome 152 (build 7977); o baseline declarava Chrome 150; o navegador empacotado resolve no major 149 nos dois casos
- CI: functions-generate-thumbnail verde (só build/teste, sem render real); lint-test-build reprova por documento de licenças stale; browser-e2e e docker-image-smoke passam
- Não executei render headless real localmente — limite declarado; é justamente o gap que exige evidência ou co-bump
Roger (Hermes KVM) - review v2 - e3cef4f
2 participants
Bumps the functions-minor-patch group with 2 updates in the /functions/generate-thumbnail directory: puppeteer-core and spdx-license-list.
Updates
puppeteer-corefrom 25.3.0 to 25.7.0Release notes
Sourced from puppeteer-core's releases.
... (truncated)
Changelog
Sourced from puppeteer-core's changelog.
... (truncated)
Commits
58e5798chore: release main (#15331)0c187dbfeat: roll to Chrome 152.0.7977.42 (#15330)eb874a5fix: logger calling causing crashes (#15338)df2d719refactor: use Desposable stacks to track listeners (#15332)c4d220cchore(deps-dev): bump the dev-dependencies group across 1 directory with 9 up...df5a524fix: roll to Firefox 153.0.4 (#15329)987f146feat(tracing): support bufferSize option in tracing.start (#15328)d484e21chore: release main (#15296)cd7308cchore: add linux arm64 to daily job (#15327)fc984bdfeat: allow downloading CfT linux-arm64 (#15325)Updates
spdx-license-listfrom 6.11.0 to 6.12.0Release notes
Sourced from spdx-license-list's releases.
Commits
169ac906.12.0a303218Update to SPDX license list version 3.28Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions