Repository navigation
chore(deps): bump dependencies and pinned GitHub Actions - #79
Merged
Merged
Conversation
Refresh every dependency to latest except `@noble/hashes`, move the pinned package manager from pnpm 12.3.4 to 12.4.2, and re-pin the three actions that have newer releases. Runtime deps: none changed, so this is chore-only (no changeset). Tooling: - vitest + @vitest/coverage-v8 5.0.0 -> 5.0.1 - @biomejs/biome 2.5.12 -> 2.5.14 - knip 6.35.1 -> 6.36.0 - @changesets/cli 3.0.2 -> 3.0.3 - @types/node 26.5.0 -> 26.6.1 - @types/react 19.2.18 -> 19.3.0, @types/react-dom 19.2.7 -> 19.3.0 - react + react-dom 19.2.8 -> 19.3.0 (devDeps of @bigmi/react) - pnpm 12.3.4 -> 12.4.2 (`packageManager`) GitHub Actions (SHA-pinned): - pnpm/action-setup v6.0.10 -> v6.1.0. v6.1.0 adds a native pnpm 12 bootstrap: `readTargetVersion` strips the `+sha512` integrity suffix, so `packageManager` resolves to 12.4.2 and the action installs it directly instead of bootstrapping pnpm 11 and running `self-update`. Directly relevant to the 12.4.2 pin above. - changesets/action v2.1.0 -> v2.1.2. Patches only, but two touch the release path: version commits now always switch + reset the branch (as with `push-with-git-cli`), and git-tag push errors are handled. The open Version PR #78 was generated by v2.1.0 — expect the next regeneration to come from v2.1.2. - linear/linear-release-action v0.15.1 -> v0.18.0. The `action.yml` diff across those three minors is purely additive (`no_branch_ref_detection`); all six inputs this repo uses — `access_key`, `command`, `release_version`, `name`, `links`, `stage` — are unchanged. - actions/checkout v7.0.1 and actions/setup-node v7.0.0 are already latest. `pnpm regen` was run afterwards to confirm the lockfile matches a from-scratch resolve; it came back byte-identical, so no transitive churn is hiding in it. `@noble/hashes` deliberately stays on ^1.8.0, for the same reason as #75: bitcoinjs-lib@7.0.2 and bs58check@4.0.0 both declare `@noble/hashes: ^1.2.0`, so v2 resolves two copies into the tree, and v2 removed the `./sha256`, `./sha1` and `./ripemd160` subpaths that bitcoinjs-lib imports. The two `packages/core` source files are Biome 2.5.14 reformatting only. Known, pre-existing and left alone: `@types/node` is on 26.x while CI runs Node 24, and madge@8 wants typescript ^5.4.4 against the repo's 7.0.2.
|
3 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Which Linear task is linked to this PR?
None — routine dependency maintenance.
Why was it implemented this way?
Refresh every dependency to latest except
@noble/hashes, move the pinned package manager from pnpm 12.3.4 to 12.4.2, and re-pin the three GitHub Actions that have newer releases. Same shape as #75.No runtime dependency changed, so this is chore-only and carries no changeset (per the
CLAUDE.mdexemption for.github/, lockfile and tooling-only changes).Tooling
vitest,@vitest/coverage-v8@biomejs/biomeknip@changesets/cli@types/node@types/react@types/react-domreact,react-dom(devDeps of@bigmi/react)pnpm(packageManager)GitHub Actions (SHA-pinned)
pnpm/action-setupchangesets/actionlinear/linear-release-actionactions/checkout(v7.0.1) andactions/setup-node(v7.0.0) are already latest — confirmed against the tag list, not just thereleases/latestendpoint.Each bump was checked against the release path rather than taken on the version number:
pnpm/action-setupv6.1.0 adds a native pnpm 12 bootstrap (#288).readTargetVersionstrips the+sha512integrity suffix, sopackageManagerresolves to12.4.2andtargetsPnpm12routes it to the native lockfile — the action installs pnpm 12 directly instead of bootstrapping pnpm 11 and runningself-update. This pairs with the 12.4.2 pin above.changesets/actionv2.1.2 is patches only andaction.ymlis byte-identical to v2.1.0 (all kebab-case inputs and thehas-changesets/published-packagesoutputs unchanged). Two patches touch the release path: version commits now always switch + reset the branch (as withpush-with-git-cli), and git-tag push errors are handled. The open Version PR chore: version packages #78 was generated by v2.1.0; expect its next regeneration to come from v2.1.2.linear/linear-release-actionv0.18.0 — theaction.ymldiff across those three minors is purely additive (one newno_branch_ref_detectioninput). All six inputslinear-release.yamluses (access_key,command,release_version,name,links,stage) are unchanged, which matters becauseCLAUDE.mdnotes a stale input name in this pipeline fails silently.@noble/hashesstays on^1.8.0pnpm update --latestmoves it to^2.4.0; that was reverted, for the reason recorded in #75.bitcoinjs-lib@7.0.2andbs58check@4.0.0both declare@noble/hashes: ^1.2.0, so v2 resolves two copies into the tree, and v2 removed the./sha256,./sha1and./ripemd160subpaths thatbitcoinjs-libimports.Notes
pnpm regenwas run after the update to confirm the lockfile matches a from-scratch resolve. It came back byte-identical, so there is no hidden transitive churn in the lockfile diff.packages/coresource files are Biome 2.5.14 reformatting only (aPrettify<…>closing bracket moved to its own line).@types/nodeis on 26.x whilesetup-nodepinsnode-version: '24', andmadge@8wantstypescript ^5.4.4against the repo's 7.0.2.Visual showcase (Screenshots or Videos)
N/A — no user-facing change.
Checklist before requesting a review
Verified locally with the exact
Verifyjob sequence, after the regen reinstall:pnpm install --frozen-lockfile(lockfile up to date) →check→check:circular-deps(3/3 clean) →knip:check→build(3/3 built) →check:types→test(76 passed, 1 skipped).