build(deps): bump the npm-minor-patch group across 1 directory with 19 updates - #1485
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
One thing the title understates: this group carries a major transitive bump. The group is configured I don't think it should block. The manifest churn is cosmetic — checked, not assumed
Every resolved version moves forward or stays put — the caret ranges resolve identically, so the lowered floors change nothing that gets installed. It does indicate the group was computed against a stale baseline, so expect this manifest to churn back and forth across successive group PRs; that is noise, not risk. Also worth noting the interaction with #1480: once Generated by Claude Code |
|
·@·d·ependabot r·ebase This PR went to Generated by Claude Code |
|
·@·d·ependabot r·ebase Conflicted by #1490, which merged at 21:09:47 UTC as A rebase is the right remedy here rather than a manual conflict resolution: the conflict is entirely in the generated lockfile, and hand-merging two independent Flagging one thing for whoever reviews the rebased result: #1490 added the Generated by Claude Code |
Dependency ReviewThe following issues were found:
Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. License Issuesapps/web/package.json
OpenSSF ScorecardScorecard details
Scanned Files
|
|
·@·d·ependabot r·ebase This PR went un-mergeable ( The conflict is confined to Rebasing rather than hand-resolving: a lockfile is a generated artifact, and a hand-merged one can be internally inconsistent — resolvable-looking but describing a tree npm would never produce. Dependabot regenerating it against current No review or CI conclusion to report yet — CI has not run on this head. The repository's Actions queue was saturated when this was checked (23 runs queued against 4 in progress), so nothing had been scheduled. The rebase will supersede that head anyway. Generated by Claude Code |
|
·@·d·ependabot r·ebase Two reasons, both measured rather than inferred. 1. This PR conflicts with The base recorded here is 2. Everything else on this head is green: The bump itself looks fine. I ran the Terminal state: Generated by Claude Code |
|
·@·d·ependabot r·ebase Requesting a rebase rather than hand-resolving, because this PR has two problems and a rebase fixes both at once. 1.
|
| package | base 8c93de8 |
this head | |
|---|---|---|---|
@opentelemetry/api |
^1.9.1 |
^1.9.0 |
↓ |
@playwright/test |
^1.62.1 |
^1.62.0 |
↓ |
@tailwindcss/postcss |
^4.3.3 |
^4.3.2 |
↓ |
autoprefixer |
^10.5.4 |
^10.5.2 |
↓ |
playwright |
^1.62.1 |
^1.62.0 |
↓ |
postcss |
^8.5.25 |
^8.5.23 |
↓ |
tailwindcss |
^4.3.3 |
^4.3.2 |
↓ |
eslint-config-next |
^16.2.10 |
^16.3.0 |
↑ (genuine) |
Scoping this honestly: it is a manifest-range regression, not an installed-version downgrade. I checked the lockfile rather than inferring from the manifest, and the resolved versions are unchanged for the entries I could compare directly — @opentelemetry/api stays 1.9.1 and postcss stays 8.5.25 on all three of base, this head, and main. So npm ci installs the same tree today. What regresses is the declared minimum: it silently lowers floors that were raised deliberately, and a future fresh resolution could satisfy the weaker range.
One entry does move for real in the lock: zod goes 3.25.76 → 4.1.11 here, while main is already at 4.3.6. That is a major-version crossing inside a group labelled minor-patch, and merging this as-is would take the lock backwards from 4.3.6 to 4.1.11. It is dev: true and transitive, so the blast radius is small — but it is the clearest single reason not to force this through the conflict by hand.
A rebase recomputes the group against current main and should resolve the conflict, drop the seven backwards floors, and settle zod at or above 4.3.6.
CI status
Checks on 7b39a826 are otherwise in good shape — validate, guards, build, test, lint-frontend, lint-python, CodeQL, gitleaks, dependency-review, bandit, npm-audit, python-safety, trivy and both Security Scan jobs all concluded success. Only Generate and Upload Coverage and a re-queued Canonical issue and evidence were outstanding. These will re-run on the rebased head.
(For anyone reading the queue: the repo's Actions backlog is deep — 251 runs queued against 22 in progress, ~20 min from creation to conclusion — but it is draining, not stalled. 29 of the last 30 CI runs concluded success. #1510 is the change that would shorten it.)
Terminal state
HALTED(merge_conflict) — rebase requested above; re-evaluate once Dependabot pushes. Per §8 of the remediation runbook this is not auto-merged: main is protected and there is no automerge label. Under MERGE_POLICY.md §8 this is Class A once green, so it needs only gates 1–7 rather than a human review pass.
Generated by Claude Code
…9 updates Bumps the npm-minor-patch group with 19 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@ai-sdk/gateway](https://github.com/vercel/ai/tree/HEAD/packages/gateway) | `4.0.36` | `4.0.40` | | [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `7.0.47` | `7.0.51` | | [openai](https://github.com/openai/openai-node) | `7.3.0` | `7.4.0` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.5` | | [@opentelemetry/api](https://github.com/open-telemetry/opentelemetry-js) | `1.9.0` | `1.9.1` | | [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.220.0` | `0.221.0` | | [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `10.65.0` | `10.69.0` | | [@stripe/stripe-js](https://github.com/stripe/stripe-js) | `9.9.0` | `9.13.0` | | [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.111.0` | `2.112.0` | | [@upstash/redis](https://github.com/upstash/redis-js) | `1.38.1` | `1.38.2` | | [@vercel/functions](https://github.com/vercel/vercel/tree/HEAD/packages/functions) | `3.7.6` | `3.7.7` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.25.0` | `1.28.0` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.62.0` | `1.62.1` | | [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.3.2` | `4.3.3` | | [autoprefixer](https://github.com/postcss/autoprefixer) | `10.5.2` | `10.5.4` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.2.10` | `16.3.0` | | [playwright](https://github.com/microsoft/playwright) | `1.62.0` | `1.62.1` | | [postcss](https://github.com/postcss/postcss) | `8.5.23` | `8.5.25` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.2` | `4.3.3` | Updates `@ai-sdk/gateway` from 4.0.36 to 4.0.40 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/packages/gateway/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/commits/@ai-sdk/gateway@4.0.40/packages/gateway) Updates `ai` from 7.0.47 to 7.0.51 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/packages/ai/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/commits/ai@7.0.51/packages/ai) Updates `openai` from 7.3.0 to 7.4.0 - [Release notes](https://github.com/openai/openai-node/releases) - [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md) - [Commits](openai/openai-node@v7.3.0...v7.4.0) Updates `tsx` from 4.23.1 to 4.23.5 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.1...v4.23.5) Updates `@opentelemetry/api` from 1.9.0 to 1.9.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v1.9.0...v1.9.1) Updates `@opentelemetry/exporter-trace-otlp-http` from 0.220.0 to 0.221.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.220.0...experimental/v0.221.0) Updates `@sentry/nextjs` from 10.65.0 to 10.69.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.69.0/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.65.0...10.69.0) Updates `@stripe/stripe-js` from 9.9.0 to 9.13.0 - [Release notes](https://github.com/stripe/stripe-js/releases) - [Commits](stripe/stripe-js@v9.9.0...v9.13.0) Updates `@supabase/supabase-js` from 2.111.0 to 2.112.0 - [Release notes](https://github.com/supabase/supabase-js/releases) - [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md) - [Commits](https://github.com/supabase/supabase-js/commits/v2.112.0/packages/core/supabase-js) Updates `@upstash/redis` from 1.38.1 to 1.38.2 - [Release notes](https://github.com/upstash/redis-js/releases) - [Commits](https://github.com/upstash/redis-js/compare/@upstash/redis@1.38.1...@upstash/redis@1.38.2) Updates `@vercel/functions` from 3.7.6 to 3.7.7 - [Release notes](https://github.com/vercel/vercel/releases) - [Changelog](https://github.com/vercel/vercel/blob/main/packages/functions/CHANGELOG.md) - [Commits](https://github.com/vercel/vercel/commits/@vercel/frameworks@3.7.7/packages/functions) Updates `lucide-react` from 1.25.0 to 1.28.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.28.0/packages/lucide-react) Updates `@playwright/test` from 1.62.0 to 1.62.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.62.0...v1.62.1) Updates `@tailwindcss/postcss` from 4.3.2 to 4.3.3 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/@tailwindcss-postcss) Updates `autoprefixer` from 10.5.2 to 10.5.4 - [Release notes](https://github.com/postcss/autoprefixer/releases) - [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md) - [Commits](postcss/autoprefixer@10.5.2...10.5.4) Updates `eslint-config-next` from 16.2.10 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) Updates `playwright` from 1.62.0 to 1.62.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.62.0...v1.62.1) Updates `postcss` from 8.5.23 to 8.5.25 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.23...8.5.25) Updates `tailwindcss` from 4.3.2 to 4.3.3 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/tailwindcss) --- updated-dependencies: - dependency-name: "@ai-sdk/gateway" dependency-version: 4.0.40 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: "@opentelemetry/api" dependency-version: 1.9.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: "@opentelemetry/exporter-trace-otlp-http" dependency-version: 0.221.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@playwright/test" dependency-version: 1.62.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: "@sentry/nextjs" dependency-version: 10.69.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@stripe/stripe-js" dependency-version: 9.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@supabase/supabase-js" dependency-version: 2.112.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@tailwindcss/postcss" dependency-version: 4.3.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: "@upstash/redis" dependency-version: 1.38.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: "@vercel/functions" dependency-version: 3.7.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: ai dependency-version: 7.0.51 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: autoprefixer dependency-version: 10.5.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: lucide-react dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: openai dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: playwright dependency-version: 1.62.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: postcss dependency-version: 8.5.25 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: tailwindcss dependency-version: 4.3.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: tsx dependency-version: 4.23.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
7b39a82 to
a4723cc
Compare
1 participant
Bumps the npm-minor-patch group with 19 updates in the / directory:
4.0.364.0.407.0.477.0.517.3.07.4.04.23.14.23.51.9.01.9.10.220.00.221.010.65.010.69.09.9.09.13.02.111.02.112.01.38.11.38.23.7.63.7.71.25.01.28.01.62.01.62.14.3.24.3.310.5.210.5.416.2.1016.3.01.62.01.62.18.5.238.5.254.3.24.3.3Updates
@ai-sdk/gatewayfrom 4.0.36 to 4.0.40Changelog
Sourced from @ai-sdk/gateway's changelog.
Commits
22095f4Version Packages (#18381)9df82a8Version Packages (#18368)f554a77Version Packages (#18343)fb6d2f8chore(provider/gateway): update gateway model settings files (#18342)3bc0d4fVersion Packages (#18311)bdd5e28feat(provider/gateway): supportvisioninhasmodel filtering (#18305)Updates
aifrom 7.0.47 to 7.0.51Changelog
Sourced from ai's changelog.
Commits
22095f4Version Packages (#18381)160ccdbperf: remove runtime Zod 3 dependency (#18378)9df82a8Version Packages (#18368)79e133cfeat(video): externalize polling control and webhook support for generateVide...da64b51feat(code-mode): simplify tool caller configuration (#18285)f554a77Version Packages (#18343)a364b0dchore: increase bundle size limit to 660kb (#18352)3bc0d4fVersion Packages (#18311)Updates
openaifrom 7.3.0 to 7.4.0Release notes
Sourced from openai's releases.
Changelog
Sourced from openai's changelog.
Commits
83c437frelease: 7.4.0 (#2055)a97cbffci: prepare checks for merge queue (#2066)481b325build(deps-dev): bump@smithy/hash-nodefrom 4.3.5 to 4.4.15 (#2064)3576574build(deps): bump dotenv from 16.6.1 to 17.4.2 (#2065)823d7dfbuild(deps-dev): bump publint from 0.2.12 to 0.3.22 (#2058)f61f267build(deps-dev): bump@types/webfrom 0.0.194 to 0.0.354 (#2061)85ea6b2[dependabot] Configure a seven-day npm cooldown (#2054)4d927debuild(deps): bump ip-address from 10.2.0 to 10.4.0 in /ecosystem-tests/vercel...590982fbuild(deps): bump fast-uri from 3.1.4 to 3.1.5 in /ecosystem-tests/vercel-edg...6d8fb53feat(api): Add gpt-5.5 model and tool metadata fields (#2049)Updates
tsxfrom 4.23.1 to 4.23.5Release notes
Sourced from tsx's releases.
Commits
c55004dtest: remove legacy PTY retrye368161chore(deps): update pty-spawn to 1.1.18d39496ci: validate GitHub Actions workflows6fe724etest: clean up timed-out PTY attemptse0a0536ci: skip unused Windows Node cache6d6dd84ci: remove broken lock automation3c1d051fix: detect the Node inspector enabled via NODE_OPTIONS40380a4ci: lock down the release toolchainf217b6bci: restrict releases to public repository2afc7bbfix(cli): allow async process.once() signal handlers to finish (#827)Updates
@opentelemetry/apifrom 1.9.0 to 1.9.1Release notes
Sourced from @opentelemetry/api's releases.
Changelog
Sourced from @opentelemetry/api's changelog.
Commits
279458eRelease 1.9.1 / 0.35.1 (#3573)4978743fix(http): remove outgoing headers normalization (#3557)d1f9594chore(deps): update dependency rimraf to v4 (#3532)e0abcc0fix: remove JSON syntax error and regenerate tsconfig files (#3566)a90c558fix(sdk-node): register instrumentations early (#3502)5b070b8fix: include TraceState in trace exports (#3569)dcb09b7chore(deps): update dependency gh-pages to v5 (#3571)3bc93a9feat: exponential histogram - part 1 - mapping functions (#3504)3670071fix: avoid grpc types dependency (#3551)b5ef0e4chore: fix proto generation (#3567)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@opentelemetry/apisince your current version.Updates
@opentelemetry/exporter-trace-otlp-httpfrom 0.220.0 to 0.221.0Release notes
Sourced from @opentelemetry/exporter-trace-otlp-http's releases.
Commits
76fa6b5chore: prepare next release (#6942)3787896chore(deps): update dependency webpack-cli to v7.2.1 (#6934)be5f757fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)f6d8fbechore(deps): lock file maintenance (#6559)9612732chore: remove examples/dice from workspaces (#6937)7107906chore: start using min-release-age in .npmrc, disable minimumReleaseAge for r...a7e5d11chore(deps): update dependency webpack to v5.108.4 (#6933)af7a82dchore(deps): update dependency msw to v2.15.0 (#6831)b9f57c6chore(deps): update dependency@types/webpack-envto v1.18.8 (#6877)cbb4abfchore(deps): update ubuntu docker tag to v26 (#6635)Updates
@sentry/nextjsfrom 10.65.0 to 10.69.0Release notes
Sourced from @sentry/nextjs's releases.
... (truncated)
Changelog
Sourced from @sentry/nextjs's changelog.
... (truncated)
Commits
417af5drelease: 10.69.0e7cf605meta(changelog): Update changelog for 10.69.0 (#22807)7c5a00efix(v10/effect): Setsentry.originon logs fromSentryEffectLogger(#22806)df53214feat(v10/cloudflare): Add wranglerConfigPath to Vite options (#22803)e96e15efeat(v10/cloudflare): Add Spotlight integration for local dev event forwardin...ea4a322fix(v10/cloudflare): Also skip cf: prefixed DOs (#22802)6a84103feat(v10/cloudflare): Instrument Agents automatically (#22788)f0c3569feat(v10/cloudflare): Rotate agent conversation id on chat clear (#22787)0516355feat(v10/cloudflare): Add instrumentAgentWithSentry for Cloudflare Agents (#2...d3a6e52fix(v10/cloudflare): FilterCREATE INDEXspans oncf_-prefixed tables (#2...Updates
@stripe/stripe-jsfrom 9.9.0 to 9.13.0Release notes
Sourced from @stripe/stripe-js's releases.
Commits
1a6a2c6v9.13.0d7b9de4Add promo code config (#956)0b9223eAdd StripePaymentElementUpdateOptions (#955)43d35b1v9.12.1f501947Bump brace-expansion from 1.1.11 to 1.1.16 in /examples/parcel (#953)0d7ed54v9.12.0d45ffdeBump js-yaml from 3.14.2 to 3.15.0 (#950)9675093Bump ws from 5.2.3 to 5.2.7 (#951)ec1315eAdd optional line item types to Checkout SDK (#949)31973ebv9.10.0Updates
@supabase/supabase-jsfrom 2.111.0 to 2.112.0Release notes
Sourced from @supabase/supabase-js's releases.
... (truncated)
Changelog
Sourced from @supabase/supabase-js's changelog.
Commits
2877b5btest(supabase): replace test-tracing harness with real-OTel unit and e2e cove...a413544feat(supabase): move OpenTelemetry tracing to opt-in /tracing subpath (#2583)e6c975cfix(supabase): forward db retry option (#2571)a262492chore(release): version 2.111.0 changelogs (#2572)Updates
@upstash/redisfrom 1.38.1 to 1.38.2Release notes
Sourced from @upstash/redis's releases.
Commits
fc3089bchore: version packages (#1441)c0f5ad7fix: deduplicate telemetry header values in mergeTelemetry (#1440)Updates
@vercel/functionsfrom 3.7.6 to 3.7.7Changelog
Sourced from @vercel/functions's changelog.
Commits
83ce42aVersion Packages (#13725)1c51d62fix(oidc): use released version in dependencies (#13726)aa0e5e4Version Packages (#13723)5b5a74cFix oidc workspace:* usage in dependencies (#13722)775e077Version Packages (#13682)a133e53Add refresh token behavior to getVercelOidcToken (#13608)74cd92crefactor: extract AWS dynamic import to async loader with error handling (#13...8960730Version Packages (#13679)a4173aa[@vercel/functions] Declare attachDatabasePool stable (#13673)cfb4ebdVersion Packages (#13650)Attestation changes
This version has no provenance attestation, while the previous version (3.7.6) was attested. Review the package versions before updating.
Updates
lucide-reactfrom 1.25.0 to 1.28.0Release notes
Sourced from lucide-react's releases.