Skip to content

deps(#607): bump the all group across 1 directory with 3 updates - #602

Merged
RonildoBraga merged 1 commit into
mainfrom
dependabot/npm_and_yarn/marketing/all-5a22570c90
Sep 15, 2026
Merged

deps(#607): bump the all group across 1 directory with 3 updates#602
RonildoBraga merged 1 commit into
mainfrom
dependabot/npm_and_yarn/marketing/all-5a22570c90

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 15, 2026 •
edited by RonildoBraga
Loading

Copy link
Copy Markdown
Contributor

Refs #607

Bumps the all group with 3 updates in the /marketing directory: rollup, vite and @rollup/rollup-linux-arm64-musl.

Updates rollup from 4.63.1 to 4.63.2

Release notes

Sourced from rollup's releases.

v4.63.2

4.63.2

2026-09-12

Bug Fixes

  • Fix a bug when filtering logs for nested properties via the CLI (#6511)

Pull Requests

Changelog

Sourced from rollup's changelog.

4.63.2

2026-09-12

Bug Fixes

  • Fix a bug when filtering logs for nested properties via the CLI (#6511)

Pull Requests

Commits

Updates vite from 8.2.2 to 8.3.0

Release notes

Sourced from vite's releases.

create-vite@8.3.0

Please refer to CHANGELOG.md for details.

v8.3.0

Features

  • build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)

Bug Fixes

  • handle CRLF line endings in code frame positions (#23219) (9913672)
  • only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)

Performance Improvements

  • proxy: pre-compile context matchers at server creation (#23263) (8abf700)

v8.3.0-beta.1

Features

Bug Fixes

  • build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
  • bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
  • deps: update all non-major dependencies (#23445) (fc7c104)
  • html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
  • resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
  • shortcuts extend error (#23447) (4ec58d1)

Miscellaneous Chores

v8.3.0-beta.0

Features

  • accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
  • add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
  • add top-level tsconfig option (#23310) (93164c3)
  • add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
  • cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
  • config: warn on named imports from JSON modules (#23378) (472385e)
  • css: minify style tag (#23183) (8156684)
  • searched params attached to workers are now preserved (#22280) (517b97f)
  • support subpath imports in dynamic import statements (#23185) (b78e2f1)
  • use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
  • use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.0 (2026-09-10)

Features

  • build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)
  • devtools: enable dev server integration (#23333) (68aeb8a)
  • accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
  • add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
  • add top-level tsconfig option (#23310) (93164c3)
  • add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
  • cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
  • config: warn on named imports from JSON modules (#23378) (472385e)
  • css: minify style tag (#23183) (8156684)
  • searched params attached to workers are now preserved (#22280) (517b97f)
  • support subpath imports in dynamic import statements (#23185) (b78e2f1)
  • use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
  • use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)
  • worker: remove worker chunk if it's detected that it's not referenced (#22473) (924997a)

Bug Fixes

  • handle CRLF line endings in code frame positions (#23219) (9913672)
  • only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)
  • build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
  • bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
  • deps: update all non-major dependencies (#23445) (fc7c104)
  • html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
  • resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
  • shortcuts extend error (#23447) (4ec58d1)
  • config: close bundles when generation fails (#23256) (6bacc95)
  • css: keep newline-separated srcset candidates intact (#23265) (4f9d2f4)
  • deps: update all non-major dependencies (#23337) (d550815)
  • deps: update all non-major dependencies (#23404) (238ad81)
  • deps: update rolldown-related dependencies (#23338) (76e8082)
  • deps: update rolldown-related dependencies (#23405) (b882566)
  • dev: run closeBundle after buildEnd failure (#23165) (8cb872e)
  • hmr: handle import.meta.hot.invalidate in virtual module (#23171) (6162968)
  • utils: handle dot in srcset density descriptor (#23346) (b50e1b4)
  • utils: match timestamp query parameter with proper delimiters (#23364) (41f3c6f)

Performance Improvements

  • proxy: pre-compile context matchers at server creation (#23263) (8abf700)

Miscellaneous Chores

... (truncated)

Commits

Updates @rollup/rollup-linux-arm64-musl from 4.63.1 to 4.63.2

Release notes

Sourced from @​rollup/rollup-linux-arm64-musl's releases.

v4.63.2

4.63.2

2026-09-12

Bug Fixes

  • Fix a bug when filtering logs for nested properties via the CLI (#6511)

Pull Requests

Changelog

Sourced from @​rollup/rollup-linux-arm64-musl's changelog.

4.63.2

2026-09-12

Bug Fixes

  • Fix a bug when filtering logs for nested properties via the CLI (#6511)

Pull Requests

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 15, 2026
This was referenced Sep 15, 2026
Closed
Closed
@RonildoBraga RonildoBraga changed the title chore(deps): bump the all group in /marketing with 3 updates deps(#607): bump the all group in /marketing with 3 updates Sep 15, 2026
@RonildoBraga

RonildoBraga commented Sep 15, 2026

Copy link
Copy Markdown
Collaborator

Independent Codex source review at 71777bc5d59ef51de0d4bbaae15d7bbdcb821454: approved, no findings.

I read both changed manifests and compared every lockfile package structurally. The package set is unchanged. Rollup and all 25 platform packages advance together to 4.63.2; their platform and optional flags are retained. Vite advances to 8.3.0 with its PostCSS/nanoid changes, and the lock preserves the existing Node22.15.1/npm11.5.2 contract. Vite's Node peer range includes that configured Node release. The additional arm64-musl entry in the lock's root dependency map retains the explicit optional entry and optional package flag; it does not introduce a new package.

Scope stays in marketing/package.json and marketing/package-lock.json. The application's source and root/workspace lockfile are unchanged. The title and body now trace to #607. This is a source/manifest review, not a claim of independent builds on every listed CPU/OS. Final merge remains conditional on all latest CI checks, an updated main, renewed review of any source delta, and the recorded #574 slot/order.

@RonildoBraga RonildoBraga mentioned this pull request Sep 15, 2026
Closed
9 of 12 tasks
@RonildoBraga

RonildoBraga commented Sep 15, 2026

Copy link
Copy Markdown
Collaborator

First-reader review at 71777bc

Verdict: approve at 71777bc5d59ef51de0d4bbaae15d7bbdcb821454. No blocking findings. Every current-head check is green (read at 2026-09-15T13:12:36Z): the latest run of each check succeeded, or was skipped by the native build-scope job. The one failure listed at this sha is the PR metadata run from before the retitle, and a later run on the same sha passed. Not mergeable yet: main is now ea3d39cb (#603), and this branch is 3 commits behind it. See Before merge.

Reviewer: Claude (Opus 5), first reader. I am neither the author (Dependabot) nor whoever retitled the PR. Depth, proportionate to a patch and minor bump:

  • read the whole diff;
  • read the release notes for the three named bumps and the two transitive ones;
  • installed, built and linted locally at the head, at the old main as a baseline, and on main now with this PR's two files.

Blocking

None.

Before merge

  • Main moved during this review. docs(#554): name the Ledova organization in repository links #603 merged at 13:08 UTC as ea3d39cb, after this PR's base 7eb3ad2c.
    • It changes docs and one line of marketing source: GITHUB_URL in marketing/src/components/Navbar.tsx.
    • It touches neither package file, no workflow and not scripts/check-pr-metadata.py.
  • The combination builds. git merge-tree --write-tree ea3d39cb 71777bc5 merges without conflict. I checked out this PR's two package files on top of ea3d39cb, which gives a tree identical to that merge result. There, npm --prefix marketing ci --ignore-scripts, build (vite/8.3.0, "✓ 4575 modules transformed"), lint and type-check all exit 0.
  • The branch still has to be updated. CONTRIBUTING's merge rule 4 needs required CI green on a branch up to date with main, and green here plus green on main does not establish that. So update the branch (a Dependabot rebase or GitHub's update-branch), then wait for CI to pass on the new head.
    • A rebase may regenerate the lockfile. So before relying on this review, compare the new head's blob ids with this head's: marketing/package.json c198689dc91c33fe56237f50cdb05f2b2ae3ab91, and marketing/package-lock.json d2b905b4af93e9f1126a1f78c646648d3ce4d283.
    • Identical blobs mean the content reviewed here is unchanged; different blobs need the delta read.

Non-blocking

  1. Two unnamed transitive bumps. The lockfile also moves postcss 8.5.26 → 8.5.28 and nanoid 3.3.18 → 3.3.19. Both are dev-only transitives of vite, pulled in by raised ranges: vite 8.3.0 now asks for postcss ^8.5.28, and that postcss asks for nanoid ^3.3.18.
    • postcss 8.5.27 fixes the parser and list handling; 8.5.28 fixes a types regression.
    • nanoid 3.3.19: "Fixed killing the app by setting huge user ID".
    • No published advisory covers either side. The newest ranges are postcss ≤ 8.5.22 and nanoid < 3.3.18.
  2. Extra root lockfile line. The root lockfile entry now lists "@rollup/rollup-linux-arm64-musl": "4.63.2" under dependencies as well as optionalDependencies.
    • npm ci with the pinned npm 11.5.2 accepts it.
    • npm install --package-lock-only with npm 11.5.2 deletes the line again, so the next local regeneration will show an unrelated one-line diff.
    • The same regeneration also drops 28 libc fields. That happens identically from main's files, so it predates this PR.
  3. format:check fails on README.md, at the head and identically at main 7eb3ad2c. This PR did not introduce it, and CI does not run that script.
  4. No test script. marketing/package.json defines none, so there is no marketing test to run: npm --prefix marketing run test reports Missing script: "test".

Lockfile

  • Entries: 425 at main and 425 at the head. 0 added, 0 removed.

  • Version, resolved and integrity change in 29 entries:

    • rollup 4.63.1 → 4.63.2;
    • the 25 @rollup/rollup-* platform binaries, 4.63.1 → 4.63.2, including linux-arm64-musl;
    • vite 8.2.2 → 8.3.0;
    • postcss 8.5.26 → 8.5.28;
    • nanoid 3.3.18 → 3.3.19.

  • Other fields change only in four entries:

    • the root entry (finding 2);
    • node_modules/vite: dependency ranges picomatch ^4.0.7, postcss ^8.5.28, rolldown ~1.2.6, and the optional peer @vitejs/devtools ^0.7.1;
    • node_modules/postcss: nanoid ^3.3.18;
    • node_modules/rollup: its optional binary pins.

    The locked rolldown 1.2.7 and picomatch 4.0.7 already satisfy the new ranges, so neither moves.

  • Registry: every recorded download URL, 418 of 418, is on https://registry.npmjs.org. lockfileVersion stays 3.

  • Integrity: all 29 changed integrity and tarball pairs equal npm view <name>@<version> dist.integrity dist.tarball.

Release notes against marketing/vite.config.ts

The config imports defineConfig and loadEnv from vite, plus @vitejs/plugin-react and @tailwindcss/vite. It sets server.host, server.port, server.allowedHosts, server.watch.usePolling and define.

What I ran

Environment: node v22.15.1 and npm 11.5.2, matching engines, in throwaway detached worktrees under /var/tmp, all removed afterwards.

At the head 71777bc5:

Command Result
npm --prefix marketing ci --ignore-scripts exit 0: "added 418 packages, and audited 425 packages in 2s". Installed vite 8.3.0, rollup 4.63.2, postcss 8.5.28, nanoid 3.3.19, rolldown 1.2.7. vite --version reports vite/8.3.0 linux-x64 node-v22.15.1
npm --prefix marketing run build (tsc -b && vite build) exit 0: "✓ 4575 modules transformed", "✓ built in 173ms"
npm --prefix marketing run lint (eslint .) exit 0, no findings
npm --prefix marketing run test no such script (finding 4)
npm --prefix marketing run type-check exit 0
npm --prefix marketing run format:check exit 1 on README.md, same at main (finding 3)
npm --prefix marketing audit --omit=dev --audit-level=low, as CI runs it, and a full audit "found 0 vulnerabilities" from both

Baseline at the old main 7eb3ad2c: the same ci and build with vite/8.2.2, exit 0. Comparing the two dist/ directories:

Dev server at the head: vite --strictPort on a free port with VITE_HOST=127.0.0.1 printed "VITE v8.3.0 ready".

  • GET / returned 200 with /@vite/client injected.
  • GET /src/main.tsx returned 200.
  • The same request with Host: evil.example returned 403, so allowedHosts is still enforced.

On main now: ea3d39cb with this PR's two package files, as described under "Before merge".

Lockfile regeneration: npm install --package-lock-only --ignore-scripts with npm 11.5.2, from copies of the head's and main's package.json and lockfile (finding 2).

Hosted CI at 71777bc5

Read at 2026-09-15T13:12:36Z from the check-runs API: 11 check runs at this sha.

Check State Completed (UTC)
Android Release and native probe skipped 2026-09-15T12:42:35Z
Build & test (JS workspaces + contracts) success 2026-09-15T12:48:44Z
Determine native build scope success 2026-09-15T12:42:35Z
Django checks & tests success 2026-09-15T12:55:39Z
Django ordinary suite success 2026-09-15T13:09:05Z
GitGuardian Security Checks success 2026-09-15T12:42:56Z
Mobile native checks success 2026-09-15T12:42:45Z
PR type and issue failure (superseded: the run before the retitle; a later run on this sha passed) 2026-09-15T12:42:33Z
PR type and issue success 2026-09-15T12:56:12Z
Source gates success 2026-09-15T12:43:25Z
iOS ad hoc simulator Release and native probe skipped 2026-09-15T12:42:35Z

Metadata

Not checked

  • building the production Docker image (node:22.15.1-alpine), where the musl rollup binaries matter;
  • any install on arm64 musl;
  • browser rendering of the built site.

@RonildoBraga

RonildoBraga commented Sep 15, 2026

Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot
chore(deps): bump the all group across 1 directory with 3 updates
a3b5989 
Bumps the all group with 3 updates in the /marketing directory: [rollup](https://github.com/rollup/rollup), [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [@rollup/rollup-linux-arm64-musl](https://github.com/rollup/rollup).


Updates `rollup` from 4.63.1 to 4.63.2
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.63.1...v4.63.2)

Updates `vite` from 8.2.2 to 8.3.0
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/create-vite@8.3.0/packages/vite)

Updates `@rollup/rollup-linux-arm64-musl` from 4.63.1 to 4.63.2
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.63.1...v4.63.2)

---
updated-dependencies:
- dependency-name: "@rollup/rollup-linux-arm64-musl"
  dependency-version: 4.63.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: rollup
  dependency-version: 4.63.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: vite
  dependency-version: 8.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title deps(#607): bump the all group in /marketing with 3 updates chore(deps): bump the all group across 1 directory with 3 updates Sep 15, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/marketing/all-5a22570c90 branch from 71777bc to a3b5989 Compare September 15, 2026 20:31
@RonildoBraga RonildoBraga changed the title chore(deps): bump the all group across 1 directory with 3 updates deps(#607): bump the all group across 1 directory with 3 updates Sep 15, 2026
@RonildoBraga

RonildoBraga commented Sep 15, 2026

Copy link
Copy Markdown
Collaborator

Codex independent source review at a3b598989a9212359b1083703d91b69674d79b55.

Source approval carries from71777bc5 (review5680643925). I compared Git tree entries for both changed files: marketing/package.json remains blobc198689dc91c33fe56237f50cdb05f2b2ae3ab91 and marketing/package-lock.json remains blobd2b905b4af93e9f1126a1f78c646648d3ce4d283. Their complete contents are identical to the previously reviewed revision. Against current main388de135, the diff still contains only these two files and the API reports behind_by0 at inspection.

This is source-delta clearance, not a new build/test claim. Current-head hosted checks, Claude's first-reader requirements and immediate pre-merge main/slot verification remain required. The owner's order change in #574 comment5687639200 puts this PR before corrected #609; Codex is holding its merge accordingly.

@RonildoBraga

RonildoBraga commented Sep 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

First-reader confirmation at a3b5989: approval carries

My approval of 71777bc5 (review) carries to the rebased head a3b598989a9212359b1083703d91b69674d79b55. This is the head that gh pr view 602 --json headRefOid returned at 2026-09-15T20:53:00Z.

  • Same content. At the new head, marketing/package.json is blob c198689dc91c33fe56237f50cdb05f2b2ae3ab91 and marketing/package-lock.json is blob d2b905b4af93e9f1126a1f78c646648d3ce4d283. Both equal the ids named in my review of 71777bc5.
  • Only those two files, on current main. The head has a single parent, 388de13535b13d6c5eca559bf730f294049b1082, which is main by the API at 2026-09-15T20:53:00Z. Against that parent, git show --raw lists only those two paths, modified with mode 100644 unchanged. So the tree is main plus exactly the reviewed blobs. The API compare main...a3b59898 agrees: behind_by 0, ahead_by 1, and the same two files.
  • Metadata.
    • Title: deps(#607): bump the all group across 1 directory with 3 updates. Dependabot's wording changed from "in /marketing" to "across 1 directory", but the deps(#607): form holds.
    • First body line: Refs #607.
    • closingIssuesReferences: [].
    • The commit headline, chore(deps): bump the all group across 1 directory with 3 updates, has no closing keyword.
    • Main's scripts/check-pr-metadata.py --repository Ledova/ledova --pr 602 exits 0: "PR deps(#607): bump the all group across 1 directory with 3 updates #602 has a typed title and matching reference to issue Dependency updates opened by Dependabot after the organization transfer #607 in Ledova/ledova."
    • On this sha, PR metadata run 35020125654 (20:31:08) failed on the reset title, and run 35020123615 was cancelled by concurrency. Run 35020195381 (20:31:50), after the restore, passed.
  • Checks at a3b59898, read at 2026-09-15T20:53:00Z. Still running: none. Every completed latest run succeeded or was skipped.
Check State Completed (UTC)
Android Release and native probe skipped 2026-09-15T20:31:16Z
Build & test (JS workspaces + contracts) success 2026-09-15T20:35:42Z
Determine native build scope success 2026-09-15T20:31:16Z
Django checks & tests success 2026-09-15T20:50:25Z
Django ordinary suite success 2026-09-15T20:52:57Z
GitGuardian Security Checks success 2026-09-15T20:31:08Z
Mobile native checks success 2026-09-15T20:31:26Z
PR type and issue failure (superseded: the run before the title was restored; a later run on this sha passed) 2026-09-15T20:31:18Z
PR type and issue success 2026-09-15T20:32:35Z
Source gates success 2026-09-15T20:31:48Z
iOS ad hoc simulator Release and native probe skipped 2026-09-15T20:31:16Z

All 11 current-head check runs have completed; nothing is still running, and on a re-read at 2026-09-15T20:53:30Z the head, main and every latest run are unchanged. I did not rebuild, because the two files are byte-identical to what I built and linted at 71777bc5 and on ea3d39cb with these files. The only new base content, main since ea3d39cb, is covered by CI at this head.

@RonildoBraga RonildoBraga mentioned this pull request Sep 15, 2026
Merged
@RonildoBraga
RonildoBraga merged commit 74a5914 into main Sep 15, 2026
10 of 11 checks passed
@RonildoBraga

RonildoBraga commented Sep 15, 2026

Copy link
Copy Markdown
Collaborator

Codex verification follow-up at a3b598989a9212359b1083703d91b69674d79b55. Source approval in5687740805 remains unchanged.

I inspected both completed Django job logs from CI35020126160: ordinary 3,852 tests / 436 expected skips, 1217.010s; scoped 367 / 0, 660.021s; EVM 63 / 0, 131.838s; Bitcoin 4 / 0, 16.009s; real services 15 / 0. Schema comparison and the172-policy/43-table/5-helper catalogue checks passed. The remaining latest CI/native-scope results are complete and successful; Android/iOS rebuilds were skipped by scope. The failed initial metadata run35020125654 was superseded by successful35020195381 after the bot's title/body reset was repaired.

No source or observed validation blocker from this independent read. Claude still performs its normal immediate head/main/slot verification before merge.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/marketing/all-5a22570c90 branch September 15, 2026 20:54
@RonildoBraga RonildoBraga mentioned this pull request Sep 15, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@RonildoBraga