Skip to content

chore(deps): update all dependency updates (major) - #396

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-all-dependency-updates
Open

chore(deps): update all dependency updates (major)#396
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-all-dependency-updates

Conversation

@renovate

@renovate renovate Bot commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Age Confidence
actions/cache action major v5v6 age confidence
actions/checkout action major v6v7 age confidence
actions/setup-node action major v6v7 age confidence
jsdom devDependencies major ^29.0.0^30.0.0 age confidence
lint-staged devDependencies major ^16.2.7^17.0.0 age confidence
typescript (source) devDependencies major ^6.0.0^7.0.0 age confidence
vite-plugin-dts (source) devDependencies major ^4.5.4^5.0.0 age confidence

Release Notes

actions/cache (actions/cache)

v6.1.0

Compare Source

What's Changed

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

Compare Source

What's Changed

Full Changelog: actions/cache@v5...v6.0.0

v6

Compare Source

actions/checkout (actions/checkout)

v7.0.1

Compare Source

v7.0.0

Compare Source

v7

Compare Source

actions/setup-node (actions/setup-node)

v7.0.0

Compare Source

What's Changed
Enhancements:
Bug fixes:
Documentation updates:
Dependency update:
New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

v7

Compare Source

jsdom/jsdom (jsdom)

v30.0.1

Compare Source

v30.0.0

Compare Source

v29.1.1

Compare Source

  • Fixed 'border-radius' computed style serialization. (@​asamuzaK)
  • Fixed computed style computation when using 'background-origin' and 'background-clip' CSS properties. (@​asamuzaK)
  • Significantly optimized initial calls to getComputedStyle(), before the cache warms up. (@​asamuzaK)

v29.1.0

Compare Source

  • Added basic support for the ratio CSS type. (@​asamuzaK)
  • Fixed getComputedStyle() sometimes returning outdated results after CSS was modified. (@​asamuzaK)

v29.0.2

Compare Source

  • Significantly improved and sped up getComputedStyle(). Computed value rules are now applied across a broader set of properties, and include fixes related to inheritance, defaulting keywords, custom properties, and color-related values such as currentcolor and system colors. (@​asamuzaK)
  • Fixed CSS 'background' and 'border' shorthand parsing. (@​asamuzaK)
lint-staged/lint-staged (lint-staged)

v17.2.0

Compare Source

Minor Changes
  • #​1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

    /** @​type {import('lint-staged').Configuration} */
    export default {
      "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
    };

    Where the spawned command is literally "tsc" without any extra arguments. Previously, this was still chunked when a lot of files were staged. Now, it probably won't be chunked because the length of the command is just three letters.

    Also, native JavaScript/Node.js function tasks won't be chunked at all, when previously they were run multiple times when chunked:

    /** @​type {import('lint-staged').Configuration} */
    export default {
      "*.js": {
        title: "Log staged JS files to console",
        task: async (files) => {
          console.log("Staged JS files:", files);
        },
      },
    };

v17.1.1

Compare Source

Patch Changes
  • #​1820 a626a9f - It's now possible to set --max-arg-length=Infinity to effectively disable chunking of tasks based on the number of staged files. The parsing and validation of the numeric CLI options --max-arg-length and --concurrency has been improved.

v17.1.0

Compare Source

Minor Changes
  • #​1816 7568d4f - The console output of lint-staged has been simplified so that there's less interactive spinners and more explicit messages like "Started…" -> "Done!". The primary purpose of this was to remove Listr2, a very large dependency.

    Before:

    Size of node_modules/ after installing: 1561.7 kB with 29 packages.

    Fancy interactive spinners, but output dynamically changes:

    ✔ Backed up original state in git stash (0b191303)
    ✔ Running tasks for staged files...
    ✔ Staging changes from tasks...
    ✔ Cleaning up temporary files...

    After:

    Size of node_modules/ after installing: 974.0 kB with 5 packages (37.6 % smaller, 82.7 % less transitive dependencies).

    Simpler but more explicit output:

    ⋯ Backing up original state…
    ✔ Done backing up original state (35b38ed1)!
    ⋯ Running tasks for staged files…
        *.js — 1 file
          ⋯ oxlint --fix
        *.{json,md} — 1 file
          ⋯ oxfmt --write
    
    ✔ oxfmt --write
    ✔ oxlint --fix
    
    ✔ Done running tasks for staged files!
    ⋯ Staging changes from tasks…
    ✔ Done staging changes from tasks!
    ⋯ Cleaning up temporary files…
    ✔ Done cleaning up temporary files!
Patch Changes
  • #​1816 c19079d - Try to restore hidden unstaged changes when using --no-revert.

  • #​1818 efb23a2 - Console output colors are enabled/disabled more consistently.

  • #​1818 26112a1 - Failed JS function tasks now properly kill other tasks, unless --continue-on-error is used. Previously their failure didn't affect other tasks.

v17.0.8

Compare Source

Patch Changes
  • #​1809 179b437 - Fix lint-staged discarding the ongoing merge conflict status (.git/MERGE_HEAD) when using the --hide-unstaged or --hide-all options.

  • #​1811 3d0b2c0 - Fix issues with Git commands that are successful but also emit warnings to stderr, by ignoring the stderr output completely when the process exits with code 0. This was the behavior when using nano-spawn and execa, but when switching to tinyexec in 16.3.0 both stdout and stderr were used as interleaved output.

v17.0.7

Compare Source

Patch Changes

v17.0.6

Compare Source

Patch Changes
  • #​1803 bdf2770 - Run all tests with Deno, in addition to Node.js and Bun.

  • #​1796 7508272 - Fix performance regression of lint-staged v17 by going back to using git add to stage task modifications. This was changed to git update-index --again in v17 for less manual work, but unfortunately the update-index command gets slower in very large Git repos.

  • #​1797 7b2505a - This version of lint-staged uses the new staged publishing for npm packages feature. Releases are already published from GitHub Actions with trusted publishing, but now an additional approval with two-factor authentication is also required.

  • #​1802 321b0a9 - Downgrade dependency tinyexec@1.2.2 to avoid issues in version 1.2.3.

v17.0.5

Compare Source

Patch Changes
  • #​1792 1f67271 - Correctly set the --max-arg-length default value based on the running platform. This controls how very long lists of staged files are split into multiple chunks.

v17.0.4

Compare Source

Patch Changes
  • #​1788 f95c1f8 - Another fix for making sure lint-staged adds task modifications correctly to the commit in the following cases:

    • after editing <file> it is staged with git add <file>, and then committed with git commit
    • after editing <file> it is committed with git commit --all without explicit git add
    • after editing <file> it is committed with git commit <pathspec> without explicit git add

    There's new test cases which actually setup the Git pre_commit hook to run lint-staged and verify them. These issues started in v17.0.0 when trying to improve support for committig without having explicitly staged files.

v17.0.3

Compare Source

Patch Changes
  • #​1782 06813f9 Thanks @​iiroj! - Fix lint-staged behavior when implicitly committing files without using git add by either:
    • git commit -am "my commit message" where -a (--all) means to automatically stage all tracked modified and deleted files
    • git commit -m "my commit message" . where . is an example of a pathspec where matching files will be staged

v17.0.2

Compare Source

Patch Changes

v17.0.1

Compare Source

Patch Changes
  • #​1776 4a5664b Thanks @​iiroj! - Adjust GitHub Actions workflow so that automatic publishing works with signed commits.

v17.0.0

Compare Source

Major Changes
  • #​1745 e244adf Thanks @​iiroj! - Node.js v20 is no longer supported, and the oldest supported version is now 22.22.1, which is an active LTS version at the time of this release. Node.js 20 will be EOL after April 2026. Please upgrade your Node.js version!

  • #​1676 0584e0b Thanks @​outslept! - Lint-staged now tries to verify the installed Git version is at least 2.32.0, released in 2021. If you're using an even older Git version, you need to upgrade it before running lint-staged!

  • #​1745 2dcc40a Thanks @​iiroj! - The dependency yaml is now marked as optional and probably won't be installed by default. If you're using a YAML configuration file you should install the package separately:

    npm install --development yaml

    If you're using .lintstagedrc as the config file name (without a file extension), it will be treated as a YAML file. If the content is JSON, consider renaming it to .lintstagedrc.json to avoid needing to install yaml.

Minor Changes
  • #​1748 809d5ef Thanks @​iiroj! - Add new option --hide-all for hiding all unstaged changes and untracked files, before running tasks. This makes it easier to run tools like Knip which check for unused code. Untracked files are included in the backup stash and restored automatically after running.

  • #​1759 f13045a Thanks @​iiroj! - Update dependencies, including tinyexec@1.1.1 to fix the following issues:

    • When using a Node.js version manager with multiple versions installed (nvm, n, for example), scripts with the #!/usr/bin/env node shebang (Prettier, ESLint, for example) were previously spawned using the default Node.js version configured by the version manager (the one which node points to) on POSIX systems. Now, they will be spawned with the same version that lint-staged itself was started with.
      • For example, if your default Node.js version is 24.14.1 but lint-staged is run with the latest version 25.9.0, the tasks spawned by lint-staged will now also use version 25.9.0. Previously they were spawned using 24.14.1.
    • When installing Node.js from the Ubuntu App Center (Snap store), the node executable available in PATH is a symlink pointing to Snap itself. The sandboxing features of Snap prevented lint-staged from spawning scripts with the #!/usr/bin/env node shebang, because it meant lint-staged tried to spawn Snap via the symlink. This resulted in an ENOENT error when trying to run prettier, for example. Now, since the real node executable's directory is available in the PATH, lint-staged will instead spawn the script with the real node binary succesfully.
  • #​1761 d3251b1 Thanks @​iiroj! - Lint-staged now runs git update-index --again after running tasks, instead of git add <originally staged files>. This should improve compatibility when using non-default indexes, for example when committing with a pathspec git commit -m "message" . instead of adding files to the index.

  • #​1745 a9585ac Thanks @​iiroj! - Remove commander as a dependency and use the built-in parseArgs from node:util to parse CLI flags.

Patch Changes
  • #​1755 c82d30b Thanks @​iiroj! - All tests now pass on the Bun runtime (latest).

  • #​1750 a401818 Thanks @​iiroj! - Remove manual handling for git stash --keep-index resurrecting deleted files, because the issue was fixed in Git 2.23.0 and lint-staged requires at least Git 2.32.0.

  • #​1771 c4b8936 Thanks @​iiroj! - Fix documentation about multiple config files and the --cwd option. When using it, all tasks will be run in the specified directory. For example, to run everything in the actual process.cwd(), use lint-staged --cwd=".".

microsoft/TypeScript (typescript)

v7.0.2

Compare Source

v6.0.3: TypeScript 6.0.3

Compare Source

For release notes, check out the release announcement blog post.

Downloads are available on:

qmhc/unplugin-dts (vite-plugin-dts)

v5.0.3

Compare Source

v5.0.2

Compare Source

v5.0.1

Compare Source

v5.0.0

Compare Source


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "every month"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@coderabbitai

coderabbitai Bot commented Jul 1, 2026

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

This PR updates GitHub Actions versions and bumps four development dependencies: jsdom, lint-staged, TypeScript, and vite-plugin-dts. No application logic or exported entities change.

Changes

Version and Dependency Bumps

Layer / File(s) Summary
CI workflow action versions
.github/workflows/ci.yml
Bumps actions/checkout and actions/setup-node from v6 to v7, and actions/cache from v5 to v6.
Development dependency versions
package.json
Updates jsdom, lint-staged, typescript, and vite-plugin-dts to newer version ranges.

Estimated code review effort: 1 (Trivial) | ~3 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The PR description lists updates and release notes, but it omits the required Changes and Test sections and the manual test instructions. Add the template sections for Changes and Test, plus manual verification steps and any applicable automatic tests.
✅ Passed checks (4 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Title check ✅ Passed The title is concise and accurately summarizes the main change: a major dependency update.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch renovate/major-all-dependency-updates

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)

15-15: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Version bump looks correct; consider persist-credentials: false.

actions/checkout@v7 is valid. Static analysis flags that credentials aren't set to non-persistent, which is a pre-existing config gap (unrelated to this version bump) but worth addressing while touching this line, since checkout persists the token to the git config by default.

🔒 Optional hardening
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 15, The checkout version bump is fine, but
the `actions/checkout` step still leaves persisted credentials by default.
Update the existing checkout step to explicitly set `persist-credentials: false`
so the token is not written to git config; use the `actions/checkout` step in
the CI workflow as the place to make this change.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Line 41: The package.json engine range is too low for the current lint-staged
dependency, which means Node 20 users can still install successfully but fail
when the pre-commit hook runs. Update the engines field in package.json to match
the Node 24 baseline used by .nvmrc and CI, or alternatively downgrade
lint-staged to a version compatible with Node 20; use the package.json engines
entry and the lint-staged dependency as the main symbols to locate the fix.

---

Nitpick comments:
In @.github/workflows/ci.yml:
- Line 15: The checkout version bump is fine, but the `actions/checkout` step
still leaves persisted credentials by default. Update the existing checkout step
to explicitly set `persist-credentials: false` so the token is not written to
git config; use the `actions/checkout` step in the CI workflow as the place to
make this change.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f8fba563-8bc9-44ae-b11b-4af3a09898b7

📥 Commits

Reviewing files that changed from the base of the PR and between 60a1ffe and 0e0bc93.

⛔ Files ignored due to path filters (1)
  • yarn.lock is excluded by !**/yarn.lock, !**/*.lock
📒 Files selected for processing (2)
  • .github/workflows/ci.yml
  • package.json
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • ftrackhq/ftrack (manual)

Comment thread package.json
"husky": "^9.1.7",
"jsdom": "^29.0.0",
"lint-staged": "^16.2.7",
"lint-staged": "^17.0.0",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

What is the minimum Node.js version required by lint-staged v17?

💡 Result:

The minimum Node.js version required by lint-staged v17 is Node.js v22.22.1 [1][2][3]. Starting with v17, support for Node.js v20 was removed [1][2].

Citations:


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== package.json ==\n'
sed -n '1,220p' package.json

printf '\n== Husky/pre-commit hooks ==\n'
for f in .husky/pre-commit .husky/*; do
  [ -f "$f" ] && { echo "--- $f"; sed -n '1,120p' "$f"; }
done

printf '\n== CI/workflow Node references ==\n'
rg -n --hidden --glob '.github/workflows/*.yml' --glob '.github/workflows/*.yaml' 'node-version|setup-node|actions/setup-node|node [0-9]|NODE_VERSION|volta|engines' .github/workflows || true

Repository: ftrackhq/ftrack-javascript

Length of output: 2709


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== .nvmrc ==\n'
sed -n '1,40p' .nvmrc

printf '\n== CI workflow ==\n'
sed -n '1,120p' .github/workflows/ci.yml

Repository: ftrackhq/ftrack-javascript

Length of output: 1395


Raise the Node engine floor or downgrade lint-staged. .nvmrc and CI already use Node 24, but package.json still advertises >=20.0.0; anyone on Node 20 will hit a failing yarn lint-staged pre-commit hook because lint-staged@17 requires Node >=22.22.1.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 41, The package.json engine range is too low for the
current lint-staged dependency, which means Node 20 users can still install
successfully but fail when the pre-commit hook runs. Update the engines field in
package.json to match the Node 24 baseline used by .nvmrc and CI, or
alternatively downgrade lint-staged to a version compatible with Node 20; use
the package.json engines entry and the lint-staged dependency as the main
symbols to locate the fix.

@renovate
renovate Bot force-pushed the renovate/major-all-dependency-updates branch from 0e0bc93 to b21e2e6 Compare July 8, 2026 20:57
@renovate

renovate Bot commented Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: yarn.lock
! Corepack is about to download https://repo.yarnpkg.com/4.13.0/packages/yarnpkg-cli/bin/yarn.js

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)

15-15: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Consider setting persist-credentials: false.

Static analysis flags this checkout step for not disabling credential persistence, which can leak the GITHUB_TOKEN to subsequent steps unnecessarily.

🔒️ Suggested hardening
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false

As per static analysis hints, zizmor flagged: "credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false".

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 15, The checkout step in the CI workflow
should disable credential persistence to avoid exposing the GitHub token to
later steps. Update the actions/checkout usage in the workflow to set
persist-credentials to false on the checkout action, keeping the change
localized to the checkout job configuration.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/ci.yml:
- Line 15: The checkout step in the CI workflow should disable credential
persistence to avoid exposing the GitHub token to later steps. Update the
actions/checkout usage in the workflow to set persist-credentials to false on
the checkout action, keeping the change localized to the checkout job
configuration.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b9ff590f-87ea-4cb9-b3a3-14da58c65547

📥 Commits

Reviewing files that changed from the base of the PR and between 0e0bc93 and b21e2e6.

📒 Files selected for processing (2)
  • .github/workflows/ci.yml
  • package.json
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • ftrackhq/ftrack (manual)
✅ Files skipped from review due to trivial changes (1)
  • package.json

@renovate
renovate Bot force-pushed the renovate/major-all-dependency-updates branch from b21e2e6 to f394ac4 Compare July 14, 2026 05:34

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 15-17: Update the actions/checkout step to set persist-credentials
to false, ensuring the checkout token is not retained for later
repository-controlled commands; leave the actions/setup-node step unchanged.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 268eca08-48ae-47c3-80d5-a65e9f7d33d0

📥 Commits

Reviewing files that changed from the base of the PR and between b21e2e6 and f394ac4.

📒 Files selected for processing (2)
  • .github/workflows/ci.yml
  • package.json
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • ftrackhq/ftrack (manual)
🚧 Files skipped from review as they are similar to previous changes (1)
  • package.json

Comment thread .github/workflows/ci.yml
Comment on lines +15 to +17
- uses: actions/checkout@v7
- name: Using Node.js from .nvmrc
uses: actions/setup-node@v6
uses: actions/setup-node@v7

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,220p' .github/workflows/ci.yml

Repository: ftrackhq/ftrack-javascript

Length of output: 1359


Disable persisted checkout credentials.

actions/checkout leaves the GitHub token available to later repo-controlled commands by default. Add persist-credentials: false unless this job needs authenticated git access.

Proposed fix
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- uses: actions/checkout@v7
- name: Using Node.js from .nvmrc
uses: actions/setup-node@v6
uses: actions/setup-node@v7
- uses: actions/checkout@v7
with:
persist-credentials: false
- name: Using Node.js from .nvmrc
uses: actions/setup-node@v7
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 15-15: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 15 - 17, Update the actions/checkout
step to set persist-credentials to false, ensuring the checkout token is not
retained for later repository-controlled commands; leave the actions/setup-node
step unchanged.

Source: Linters/SAST tools

@renovate
renovate Bot force-pushed the renovate/major-all-dependency-updates branch from f394ac4 to 0b08ae6 Compare July 27, 2026 10:34

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Around line 40-41: Regenerate yarn.lock to reflect the updated dependency
ranges for jsdom, lint-staged, typescript, and vite-plugin-dts in package.json.
Use the repository’s Yarn workflow so the lockfile is consistent and immutable
installs succeed.
- Line 40: Update the jsdom dependency version in package.json from the
unavailable ^30.0.0 range to a published compatible release, using ^29.1.1.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: df160347-ad79-4ae8-9dc3-3df2e0cfef8e

📥 Commits

Reviewing files that changed from the base of the PR and between f394ac4 and 0b08ae6.

📒 Files selected for processing (2)
  • .github/workflows/ci.yml
  • package.json
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • ftrackhq/ftrack (manual)

Comment thread package.json
"husky": "^9.1.7",
"jsdom": "^29.0.0",
"lint-staged": "^16.2.7",
"jsdom": "^30.0.0",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== package.json excerpt =="
nl -ba package.json | sed -n '34,46p'

echo
echo "== yarn.lock jsdom entries =="
rg -n '^jsdom@|jsdom@' yarn.lock | sed -n '1,40p'

echo
echo "== published jsdom metadata (registry) =="
python3 - <<'PY'
import json, urllib.request
url = "https://registry.npmjs.org/jsdom"
with urllib.request.urlopen(url, timeout=20) as r:
    data = json.load(r)
print("dist-tags.latest:", data.get("dist-tags", {}).get("latest"))
versions = sorted(data.get("versions", {}).keys(), key=lambda s: [int(x) if x.isdigit() else x for x in __import__('re').split(r'(\d+)', s)])
print("recent versions:", versions[-8:])
PY

Repository: ftrackhq/ftrack-javascript

Length of output: 231


🌐 Web query:

jsdom npm latest release 30.0.0 29.1.1

💡 Result:

As of today, July 27, 2026, the latest version of the jsdom package on npm is 29.1.1 [1][2][3]. This version was released on April 30, 2026 [4][5][3]. There is no official release of the jsdom package itself at version 30.0.0 [2][3]. While version 30.0.0 exists for related packages such as jest-environment-jsdom [6], it does not apply to the core jsdom library. Users should continue to track the official jsdom repository on GitHub for future release announcements [2].

Citations:


🏁 Script executed (no clone):

#!/bin/bash
set -euo pipefail
python3 - <<'PY'
import json, urllib.request
data = json.load(urllib.request.urlopen("https://registry.npmjs.org/jsdom", timeout=20))
print(data["dist-tags"].get("latest"))
PY

Length of output: 2411


Use a published jsdom release. ^30.0.0 does not resolve on npm; the latest official jsdom release is 29.1.1, so this dependency range will break installs until it’s changed.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 40, Update the jsdom dependency version in package.json
from the unavailable ^30.0.0 range to a published compatible release, using
^29.1.1.

Source: MCP tools

Comment thread package.json
Comment on lines +40 to +41
"jsdom": "^30.0.0",
"lint-staged": "^17.0.0",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== package.json (relevant deps) =="
cat -n package.json | sed -n '1,140p'

echo
echo "== package manager config files =="
fd -a -t f 'package.json|yarn.lock|.yarnrc.yml|.npmrc|pnpm-lock.yaml|package-lock.json' .

echo
echo "== yarn.lock entries for mentioned packages =="
rg -n '^(jsdom|lint-staged|typescript|vite-plugin-dts)@|^  version "|^  resolution:|^  dependencies:|^    (jsdom|lint-staged|typescript|vite-plugin-dts):' yarn.lock

Repository: ftrackhq/ftrack-javascript

Length of output: 28880


Regenerate yarn.lock for these dependency bumps. yarn.lock still pins the old ranges for jsdom, lint-staged, typescript, and vite-plugin-dts, so immutable Yarn installs will fail until the lockfile is updated.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 40 - 41, Regenerate yarn.lock to reflect the
updated dependency ranges for jsdom, lint-staged, typescript, and
vite-plugin-dts in package.json. Use the repository’s Yarn workflow so the
lockfile is consistent and immutable installs succeed.

Source: MCP tools

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants