Skip to content

chore: update deps - #32

Merged
flipvh merged 1 commit into
mainfrom
chore/deps-update
Oct 2, 2026
Merged

flipvh merged 1 commit into
mainfrom
chore/deps-update

Conversation

@flipvh

@flipvh flipvh commented Oct 2, 2026

Copy link
Copy Markdown
Member

Updates all dependencies to latest, including majors. pnpm audit is now clean (it reported one low advisory before).

Majors

  • vitest 4 → 5. No config changes needed. vite is now a peer and resolves to 8.1.3.
  • @inquirer/core 11 → 12. The useState setter now also accepts a reducer. Our contributions prompt never stores a function value, so its behavior is unchanged. A single copy resolves, because the @inquirer/prompts sub-packages already depend on ^12.

Minors/patches: @pierre/diffs 1.5.1, biome 2.5.15 (with the biome migrate schema bump), lefthook 2.1.15, @types/node 26.6.3, native-preview 7.0.0-dev.20260707.2 (same as cella and create-cella).

Held back

  • typescript stays on ^6. tsup's dts: true build (for the ./config export) uses the JS compiler API, and typescript 7 (native) doesn't ship it. Type checking already runs on @typescript/native-preview. cella keeps the same pin.
  • Newer patches (lefthook 2.1.16, @types/node 26.6.4) are under a day old and blocked by minimumReleaseAge.

Audit: adds the esbuild@<0.28.1 override that cella and create-cella already carry. It fixes GHSA-g7r4-m6w7-qqqr (low, Windows dev server only), which came in through tsup and vite on esbuild 0.27. esbuild now resolves to a single 0.28.2.

Verified locally: pnpm ts, pnpm lint, pnpm test (205/205), pnpm test-build, pnpm test:release (pack + install + run, dts emitted).

🤖 Generated with Claude Code

Majors: vitest 4 -> 5, @inquirer/core 11 -> 12 (useState setter now also
takes a reducer; our prompt stores no function values).

typescript stays on 6: tsup's dts build uses the JS compiler API, which
typescript 7 (native) no longer ships. Type checking already runs on
@typescript/native-preview.

Adds the esbuild override create-cella and cella already carry, clearing
the low advisory GHSA-g7r4-m6w7-qqqr (tsup and vite pulled esbuild 0.27).
pnpm audit is now clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@flipvh
flipvh merged commit 1132396 into main Oct 2, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant