Skip to content

chore(deps): update all dependency updates (major) #396

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update all dependency updates (major) #396

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,9 @@ jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
- name: Using Node.js from .nvmrc
uses: actions/setup-node@v6
uses: actions/setup-node@v7
Comment on lines +15 to +17

@coderabbitai coderabbitai Bot Jul 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,220p' .github/workflows/ci.yml

Repository: ftrackhq/ftrack-javascript

Length of output: 1359

Disable persisted checkout credentials.

actions/checkout leaves the GitHub token available to later repo-controlled commands by default. Add persist-credentials: false unless this job needs authenticated git access.

Proposed fix 
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- uses: actions/checkout@v7
- name: Using Node.js from .nvmrc
uses: actions/setup-node@v6
uses: actions/setup-node@v7
- uses: actions/checkout@v7
with:
persist-credentials: false
- name: Using Node.js from .nvmrc
uses: actions/setup-node@v7
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 15-15: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 15 - 17, Update the actions/checkout
step to set persist-credentials to false, ensuring the checkout token is not
retained for later repository-controlled commands; leave the actions/setup-node
step unchanged.

Source: Linters/SAST tools

with:
node-version-file: ".nvmrc"

Expand All @@ -25,7 +25,7 @@ jobs:
run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
shell: bash
- name: Restore yarn cache
uses: actions/cache@v5
uses: actions/cache@v6
with:
path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
key: yarn-cache-folder-${{ hashFiles('**/yarn.lock', '.yarnrc.yml') }}
Expand Down
8 changes: 4 additions & 4 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,15 +37,15 @@
"eslint": "^10.0.0",
"globals": "^17.0.0",
"husky": "^9.1.7",
"jsdom": "^29.0.0",
"lint-staged": "^16.2.7",
"jsdom": "^30.0.0",

@coderabbitai coderabbitai Bot Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== package.json excerpt =="
nl -ba package.json | sed -n '34,46p'

echo
echo "== yarn.lock jsdom entries =="
rg -n '^jsdom@|jsdom@' yarn.lock | sed -n '1,40p'

echo
echo "== published jsdom metadata (registry) =="
python3 - <<'PY'
import json, urllib.request
url = "https://registry.npmjs.org/jsdom"
with urllib.request.urlopen(url, timeout=20) as r:
    data = json.load(r)
print("dist-tags.latest:", data.get("dist-tags", {}).get("latest"))
versions = sorted(data.get("versions", {}).keys(), key=lambda s: [int(x) if x.isdigit() else x for x in __import__('re').split(r'(\d+)', s)])
print("recent versions:", versions[-8:])
PY

Repository: ftrackhq/ftrack-javascript

Length of output: 231

🌐 Web query:

jsdom npm latest release 30.0.0 29.1.1

💡 Result:

As of today, July 27, 2026, the latest version of the jsdom package on npm is 29.1.1 [1][2][3]. This version was released on April 30, 2026 [4][5][3]. There is no official release of the jsdom package itself at version 30.0.0 [2][3]. While version 30.0.0 exists for related packages such as jest-environment-jsdom [6], it does not apply to the core jsdom library. Users should continue to track the official jsdom repository on GitHub for future release announcements [2].

Citations:

🏁 Script executed (no clone):

#!/bin/bash
set -euo pipefail
python3 - <<'PY'
import json, urllib.request
data = json.load(urllib.request.urlopen("https://registry.npmjs.org/jsdom", timeout=20))
print(data["dist-tags"].get("latest"))
PY

Length of output: 2411

Use a published jsdom release. ^30.0.0 does not resolve on npm; the latest official jsdom release is 29.1.1, so this dependency range will break installs until it’s changed.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 40, Update the jsdom dependency version in package.json
from the unavailable ^30.0.0 range to a published compatible release, using
^29.1.1.

Source: MCP tools

"lint-staged": "^17.0.0",

@coderabbitai coderabbitai Bot Jul 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

What is the minimum Node.js version required by lint-staged v17?

💡 Result:

The minimum Node.js version required by lint-staged v17 is Node.js v22.22.1 [1][2][3]. Starting with v17, support for Node.js v20 was removed [1][2].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== package.json ==\n'
sed -n '1,220p' package.json

printf '\n== Husky/pre-commit hooks ==\n'
for f in .husky/pre-commit .husky/*; do
  [ -f "$f" ] && { echo "--- $f"; sed -n '1,120p' "$f"; }
done

printf '\n== CI/workflow Node references ==\n'
rg -n --hidden --glob '.github/workflows/*.yml' --glob '.github/workflows/*.yaml' 'node-version|setup-node|actions/setup-node|node [0-9]|NODE_VERSION|volta|engines' .github/workflows || true

Repository: ftrackhq/ftrack-javascript

Length of output: 2709

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== .nvmrc ==\n'
sed -n '1,40p' .nvmrc

printf '\n== CI workflow ==\n'
sed -n '1,120p' .github/workflows/ci.yml

Repository: ftrackhq/ftrack-javascript

Length of output: 1395

Raise the Node engine floor or downgrade lint-staged. .nvmrc and CI already use Node 24, but package.json still advertises >=20.0.0; anyone on Node 20 will hit a failing yarn lint-staged pre-commit hook because lint-staged@17 requires Node >=22.22.1.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 41, The package.json engine range is too low for the
current lint-staged dependency, which means Node 20 users can still install
successfully but fail when the pre-commit hook runs. Update the engines field in
package.json to match the Node 24 baseline used by .nvmrc and CI, or
alternatively downgrade lint-staged to a version compatible with Node 20; use
the package.json engines entry and the lint-staged dependency as the main
symbols to locate the fix.

Comment on lines +40 to +41

@coderabbitai coderabbitai Bot Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== package.json (relevant deps) =="
cat -n package.json | sed -n '1,140p'

echo
echo "== package manager config files =="
fd -a -t f 'package.json|yarn.lock|.yarnrc.yml|.npmrc|pnpm-lock.yaml|package-lock.json' .

echo
echo "== yarn.lock entries for mentioned packages =="
rg -n '^(jsdom|lint-staged|typescript|vite-plugin-dts)@|^  version "|^  resolution:|^  dependencies:|^    (jsdom|lint-staged|typescript|vite-plugin-dts):' yarn.lock

Repository: ftrackhq/ftrack-javascript

Length of output: 28880

Regenerate yarn.lock for these dependency bumps. yarn.lock still pins the old ranges for jsdom, lint-staged, typescript, and vite-plugin-dts, so immutable Yarn installs will fail until the lockfile is updated.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 40 - 41, Regenerate yarn.lock to reflect the
updated dependency ranges for jsdom, lint-staged, typescript, and
vite-plugin-dts in package.json. Use the repository’s Yarn workflow so the
lockfile is consistent and immutable installs succeed.

Source: MCP tools

"msw": "^2.12.7",
"pinst": "^3.0.0",
"prettier": "^3.7.4",
"typescript": "^6.0.0",
"typescript": "^7.0.0",
"typescript-eslint": "^8.57.2",
"vite": "^8.0.0",
"vite-plugin-dts": "^4.5.4",
"vite-plugin-dts": "^5.0.0",
"vitest": "^4.1.0",
"ws": "^8.19.0"
},
Expand Down
Loading