Skip to content

chore(deps): bump @shikijs/twoslash from 3.22.0 to 4.3.0#114

Merged
hasparus merged 4 commits into
mainfrom
dependabot/npm_and_yarn/shikijs/twoslash-4.3.0
Jul 2, 2026
Merged

chore(deps): bump @shikijs/twoslash from 3.22.0 to 4.3.0#114
hasparus merged 4 commits into
mainfrom
dependabot/npm_and_yarn/shikijs/twoslash-4.3.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps @shikijs/twoslash from 3.22.0 to 4.3.0.

Release notes

Sourced from @​shikijs/twoslash's releases.

v4.3.0

   🚀 Features

    View changes on GitHub

v4.2.0

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

v4.1.0

   🐞 Bug Fixes

    View changes on GitHub

v4.0.2

   🐞 Bug Fixes

    View changes on GitHub

v4.0.1

   🐞 Bug Fixes

    View changes on GitHub

v4.0.0

   🚨 Breaking Changes

   🚀 Features

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 1, 2026
hasparus
hasparus approved these changes Jul 1, 2026
View reviewed changes

@hasparus hasparus left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CI is green on all functional checks (lint, typecheck, build, Playwright e2e including shiki-twoslash page tests all pass). The only failing job step is Deploy Preview to Vercel (deploy.mjs: missing --token), which fails identically on every open Dependabot PR because secrets aren't available in dependabot-triggered pull_request runs — a pre-existing CI gap unrelated to this dependency bump. Approving and merging.

Generated by Claude Code

@hasparus Claude

hasparus commented Jul 1, 2026

Copy link
Copy Markdown
Owner

·@·d·ependabot r·ebase

Generated by Claude Code

@dependabot
chore(deps): bump @shikijs/twoslash from 3.22.0 to 4.3.0
e82fa01 
Bumps [@shikijs/twoslash](https://github.com/shikijs/shiki/tree/HEAD/packages/twoslash) from 3.22.0 to 4.3.0.
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.3.0/packages/twoslash)

---
updated-dependencies:
- dependency-name: "@shikijs/twoslash"
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/shikijs/twoslash-4.3.0 branch from 3dfaafc to e82fa01 Compare July 1, 2026 10:12
@hasparus @claude
ci: skip Vercel preview deploy for Dependabot PRs (no secrets access)
b1c2581 
Dependabot PRs run from the same repo (not a fork), so the deploy
step's fork-only guard let it through even though GitHub withholds
repository secrets from dependabot-actor runs. That caused
deploy.mjs to fail with 'missing --token'. Treat dependabot[bot]
runs the same as fork PRs: build/lint/typecheck/test still run,
but preview deploy and lighthouse are skipped until a maintainer
adds the 'trusted' label.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@hasparus Claude

hasparus commented Jul 2, 2026

Copy link
Copy Markdown
Owner

CI was failing on build-and-deploy with deploy.mjs: missing --token, unrelated to this dependency bump (build/lint/typecheck/test all passed). Root cause: Dependabot PRs run from a branch in this repo (not a fork), so the "fork-only" guard on the Vercel preview-deploy step let the step run — but GitHub withholds repository secrets from dependabot[bot]-authored runs, so VERCEL_TOKEN was empty.

Pushed a fix that also excludes github.actor == 'dependabot[bot]' from the "trusted" condition (matching the pattern already used for OG_IMAGE_SECRET), so build/lint/typecheck/test still run but the deploy/lighthouse steps are skipped until a maintainer labels the PR trusted. Re-running CI now.

Generated by Claude Code

hasparus added 2 commits July 2, 2026 10:43
@hasparus
Merge remote-tracking branch 'origin/main' into dependabot/npm_and_ya…
effeef8 
…rn/shikijs/twoslash-4.3.0

# Conflicts:
#	pnpm-lock.yaml
@hasparus
Merge remote-tracking branch 'origin/main' into dependabot/npm_and_ya…
f9ed475 
…rn/shikijs/twoslash-4.3.0

# Conflicts:
#	pnpm-lock.yaml
@hasparus hasparus merged commit 27cca4e into main Jul 2, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/shikijs/twoslash-4.3.0 branch July 2, 2026 10:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hasparus hasparus hasparus approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hasparus