chore(deps): batch dev dependency upgrades - #284
Merged
Conversation
Consolidates the open Dependabot PRs that are safe to take, keeping every package on a mature line rather than jumping to the newest major. Lockfile-only (existing ranges already allowed these): - eslint 10.4.0 -> 10.9.1 - typescript-eslint 8.60.0 -> 8.68.0 - @babel/core 7.29.0 -> 7.29.7, @babel/types 7.29.0 -> 7.29.8, @babel/helper-plugin-utils 7.28.6 -> 7.29.7 (stays on the Babel 7 line declared in peerDependencies) - react/react-dom 19.2.4 -> 19.2.8, @types/react 19.2.14 -> 19.2.18 Range changes: - @tenphi/eslint-plugin-tasty ^0.11.3 -> ^1.0.5 - prettier ^3.8.1 -> ^3.9.6; the floor is pinned so format:check is reproducible. 3.9 changes union-type and arrow-callback wrapping, so src/ is reformatted in this commit. - @types/node ^25.3.2 -> ^24.13.3, realigning the types with the Active LTS line the release workflow actually runs on. Node 25 is EOL and Node 26 is still Current. CI: - actions/cache v4 -> v6 (ESM rewrite; needs runner >= 2.327.1) Deliberately not included: the Babel 8 bumps (#236, #239, #259), which conflict with the ^7.24.0 peer range, and changesets/action v2 (#278), which renames every input this repo passes. Internal-only change, so no changeset.
Contributor
📦 Snapshot releasePublished |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidates the open Dependabot PRs that are safe to take. The bias throughout is mature line over newest number — nothing here crosses a major that the repo isn't ready for.
Verified locally:
lint,format:check,typecheck,knip,check:test-only,build,size, and the full suite (82 files / 2171 tests, node + browser projects) all pass.Taken — lockfile only
Existing ranges already allowed these, so
package.jsonis untouched:eslinttypescript-eslint@babel/core@babel/types@babel/helper-plugin-utilsreact/react-dom@types/reactThe Babel packages stay on the 7 line that
peerDependenciesdeclares (^7.24.0).Taken — range changes
@tenphi/eslint-plugin-tasty^0.11.3→^1.0.5(chore(deps-dev): bump @tenphi/eslint-plugin-tasty from 0.11.3 to 1.0.4 #260 proposed 1.0.4).pnpm lintis clean on 1.0.5.prettier^3.8.1→^3.9.6(chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 #241). The floor is pinned deliberately: a loose range lets contributors on 3.8 and 3.9 fight over formatting. 3.9 changed union-type and arrow-callback wrapping, sosrc/is reformatted in the same commit — 14 files, purely cosmetic, and the reason chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 #241 was red.@types/node^25.3.2→^24.13.3— a deliberate downshift, not chore(deps-dev): bump @types/node from 24.13.3 to 26.3.0 #263's bump to 26. Node 25 is EOL, Node 26 is still Current, and this repo runs Node 22 in CI and Node 24 on release. Typing against 24 (Active LTS) matches what actually executes; typing against 26 would lettscaccept APIs the runtime doesn't have. Easy to flip to^26if you'd rather track Current.CI
actions/cachev4 → v6 (chore(deps): bump actions/cache from 4 to 6 #258). v5 moved to the Node 24 runtime, v6 is an ESM rewrite; no input changes. Requires runner ≥ 2.327.1, which GitHub-hosted runners satisfy.Deliberately left out
peerDependenciespins^7.24.0, so shipping Babel 8 in devDeps only would test the plugin against an API surface consumers aren't on. This is a real migration, not a bump.changesets/actionv1 → v2 (chore(deps): bump changesets/action from 1 to 2 #278) — v2 renames every input this repo passes (publish→publish-script,title→pr-title,commit→commit-message) and drops theGITHUB_TOKENenv var in favour of agithub-tokeninput. Merging it as-is would leave the release job silently misconfigured. The npm-auth half of the migration is already fine here since release.yml uses OIDC. Worth its own PR.Closes
#208, #222, #241, #258, #260, #261, #262 — and supersedes #263 with a different target version.
No changeset: dev dependencies and CI only, nothing user-visible.