Skip to content

Repository navigation

build(deps): bump the all group across 1 directory with 12 updates - #24

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/all-475432b010
Closed

build(deps): bump the all group across 1 directory with 12 updates#24
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/all-475432b010

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 13, 2026

Copy link
Copy Markdown

Bumps the all group with 12 updates in the / directory:

Package From To
@browserbasehq/sdk 2.20.0 2.21.0
@browserbasehq/stagehand 3.7.1 4.2.0
@commitlint/cli 21.2.2 21.2.3
@commitlint/config-conventional 21.2.2 21.2.3
@dotenvx/dotenvx 2.28.0 2.34.2
devtools-protocol 0.0.1676105 0.0.1716261
fallow 3.27.0 3.33.1
lint-staged 17.5.1 17.6.0
oxfmt 0.68.0 0.72.0
tsdown 0.22.14 0.23.0
tsx 4.23.13 4.23.15
vite 8.3.0 8.3.4

Updates @browserbasehq/sdk from 2.20.0 to 2.21.0

Release notes

Sourced from @​browserbasehq/sdk's releases.

v2.21.0

2.21.0 (2026-09-24)

Features

  • Add secrets SDK generation (f22482a)
Changelog

Sourced from @​browserbasehq/sdk's changelog.

2.21.0 (2026-09-24)

Features

  • Add secrets SDK generation (f22482a)
Commits

Updates @browserbasehq/stagehand from 3.7.1 to 4.2.0

Release notes

Sourced from @​browserbasehq/stagehand's releases.

@​browserbasehq/stagehand@​3.7.3

Patch Changes

Changelog

Sourced from @​browserbasehq/stagehand's changelog.

TypeScript SDK 4.2.0

Minor Changes

  • #3030 34edfa3 Thanks @​supremeboxlogos! - Export browser pages as PDF bytes in TypeScript, Python, and Go, with configurable print settings and timeouts, and optional local file saving in TypeScript and Python.

  • #3118 a837acf Thanks @​miguelg719! - Add clientOptions to browserbase.launch() and browserbase.connect(). Thanks to @​pr1m8 for the original proposal that motivated this feature.

  • #3083 666b6fa Thanks @​seanmcguire12! - expose a timeout option for page.snapshot() across all sdks, defaulting to 20 seconds. set it to 0 for unlimited execution. one budget covers the whole snapshot capture.

  • #3140 f2060a6 Thanks @​seanmcguire12! - automatically discover Stagehand extensions when connecting to browsers. deprecate & ignore extension IDs passed into .connect().

  • #2916 476658b Thanks @​seanmcguire12! - add page level hooks for webmcp tools added and webmcp tools removed events.

Patch Changes

  • #3045 4da1a21 Thanks @​github-actions! - Keep telemetry disabled unless an OTLP traces endpoint is explicitly configured.

  • #2893 5802f59 Thanks @​miguelg719! - Bound experimental batch and RPC deadlines so callers can stop waiting without replaying actions or accepting late capture state.

  • #2894 819db28 Thanks @​miguelg719! - Add configurable bounded CDP heartbeats and sanitized disconnect diagnostics with cleanup on shutdown.

  • #2892 0210688 Thanks @​miguelg719! - Release a newly created Browserbase session when initial attachment fails, and support upload retries

  • #2978 f3543d3 Thanks @​seanmcguire12! - Fix locator failures when entering loading iframes, and correctly target iframe elements when an XPath ends at the iframe.

  • #3033 1562d35 Thanks @​seanmcguire12! - add per-call locator timeouts across TypeScript, Python, & Go. one timeout covers frame readiness, element lookup, & execution, including typing delays & highlight duration. the default is 20 seconds. setting timeout to 0 disables it.

  • #3146 7d8dcef Thanks @​seanmcguire12! - Make selector waits include frame readiness in their timeout, support unlimited waits with timeout: 0, and clean up observers when the wait ends.

  • #3052 70f4e91 Thanks @​seanmcguire12! - Match native XPath semantics for text() predicates when a shadow root routes locators through the composed-tree parser

Python SDK 4.2.0

Minor Changes

  • #3030 34edfa3 Thanks @​supremeboxlogos! - Export browser pages as PDF bytes in TypeScript, Python, and Go, with configurable print settings and timeouts, and optional local file saving in TypeScript and Python.

  • #3118 a837acf Thanks @​miguelg719! - Add client_options to browserbase.launch() and browserbase.connect().

  • #3083 666b6fa Thanks @​seanmcguire12! - expose a timeout option for page.snapshot() across all sdks, defaulting to 20 seconds. set it to 0 for unlimited execution. one budget covers the whole snapshot capture.

  • #3140 f2060a6 Thanks @​seanmcguire12! - automatically discover Stagehand extensions when connecting to browsers. deprecate & ignore extension IDs passed into .connect().

  • #2916 476658b Thanks @​seanmcguire12! - add page level hooks for webmcp tools added and webmcp tools removed events.

Patch Changes

... (truncated)

Commits
  • 2d605b0 Release Stagehand packages (#2969)
  • 7d8dcef [fix]: use progress tracker in waitForSelector() (#3146)
  • f2060a6 [fix]: discover extension automatically & deprecate extension id param (#3140)
  • 0f3d0df Point eval sites at Vercel instead of GitHub Pages (#3141)
  • a837acf feat(sdk): add Browserbase clientOptions to launch and connect (#3118)
  • 7abca76 [chore]: bump various transitive JS deps across monorepo (#3115)
  • 82ef425 [refactor]: use progress tracker in act/extract/observe (#3109)
  • 819db28 Add bounded CDP heartbeat and sanitized disconnect diagnostics (#2894)
  • 5802f59 Recover bounded capture deadlines and preserve terminal session loss (#2893)
  • 666b6fa [feat]: expose timeout param in page.snapshot() (#3083)
  • Additional commits viewable in compare view

Updates @commitlint/cli from 21.2.2 to 21.2.3

Release notes

Sourced from @​commitlint/cli's releases.

v21.2.3

21.2.3 (2026-09-19)

Bug Fixes

Refactor

Chore, ci, build, etc.

New Contributors

Full Changelog: conventional-changelog/commitlint@v21.2.2...v21.2.3

Changelog

Sourced from @​commitlint/cli's changelog.

21.2.3 (2026-09-19)

Bug Fixes

  • lint: trim trailing whitespace off the message handed to ignore matchers (#4960) (a6f279b)
Commits
  • 95d4056 v21.2.3
  • a6f279b fix(lint): trim trailing whitespace off the message handed to ignore matchers...
  • See full diff in compare view

Updates @commitlint/config-conventional from 21.2.2 to 21.2.3

Release notes

Sourced from @​commitlint/config-conventional's releases.

v21.2.3

21.2.3 (2026-09-19)

Bug Fixes

Refactor

Chore, ci, build, etc.

New Contributors

Full Changelog: conventional-changelog/commitlint@v21.2.2...v21.2.3

Changelog

Sourced from @​commitlint/config-conventional's changelog.

21.2.3 (2026-09-19)

Bug Fixes

  • rules: report the case that matched in case rule failure messages (#4962) (9f5f7bc)
Commits

Updates @dotenvx/dotenvx from 2.28.0 to 2.34.2

Release notes

Sourced from @​dotenvx/dotenvx's releases.

v2.34.2

see CHANGELOG

v2.34.1

see CHANGELOG

v2.34.0

see CHANGELOG

v2.33.0

see CHANGELOG

v2.32.4

see CHANGELOG

v2.32.3

see CHANGELOG

v2.32.2

see CHANGELOG

v2.32.1

see CHANGELOG

v2.32.0

see CHANGELOG

v2.31.1

see CHANGELOG

v2.31.0

see CHANGELOG

v2.30.0

see CHANGELOG

v2.29.0

see CHANGELOG

v2.28.2

see CHANGELOG

v2.28.1

see CHANGELOG

Changelog

Sourced from @​dotenvx/dotenvx's changelog.

2.34.2 (2026-10-09)

Changed

  • Patch: fix atomic edge case of writing .env and .env.keys file (#1014)

2.34.1 (2026-10-08)

Changed

  • Patch: don't write public key on ctrl+c or prompt failure (#1009)

2.34.0 (2026-10-08)

Changed

  • Swap internal provider logic for @​dotenvx/providers (#1008)
  • BREAKING: Remove lock commands and support for unlocking. Passwords are too difficult to manage securely. Convenience not worth it for the agentic future we are entering. (#1008)
  • Return provider information with dotenvx keypair command (#1008)
  • Swap armor provider logic to @​dotenvx/providers#armor (#1009)

2.33.0 (2026-10-05)

Added

  • Add Envfile profiles for selecting .env file combinations with --profile or DOTENV_ENV.
  • Automatically redact stdout/stderr from config() when an Envfile is present.

Changed

  • Move Envfile processing into @dotenvx/primitives.
  • First file wins when combining Envfile rules. run and check validate final values; encryption rules apply to encrypt, set, and protect.

2.32.4 (2026-10-01)

Changed

  • Make Envfile the filename. Final decision. (#1003)

2.32.3 (2026-09-30)

Changed

  • Make Dotenvspec the filename (#1002)
  • Improve startup time for cli (#1001)

2.32.2 (2026-09-29)

Changed

... (truncated)

Commits

Updates devtools-protocol from 0.0.1676105 to 0.0.1716261

Commits

Updates fallow from 3.27.0 to 3.33.1

Release notes

Sourced from fallow's releases.

v3.33.1: health and duplication baselines in CI, Vitest fixes

Bug fixes

  • The GitHub Action and the GitLab template can baseline health and duplication on the default run. A project with existing complexity can now gate the default fallow run with a baseline. Set the health-baseline and dupes-baseline inputs of the action, or FALLOW_HEALTH_BASELINE and FALLOW_DUPES_BASELINE in the GitLab template. Create the files with fallow health --save-baseline and fallow dupes --save-baseline. Other commands ignore these inputs. Both integrations report a stale health or duplication baseline, or one that another command saved. fail-on-stale-baseline (FALLOW_FAIL_ON_STALE_BASELINE) judges these baselines too. It also judges a --health-baseline or --dupes-baseline flag that you pass through args (FALLOW_ARGS). (#3316)
  • The action and the GitLab template no longer count health findings that a baseline accepts. With a health baseline, the CLI passed, but the action and the GitLab template failed the job with fail-on-issues. A fallow health run also failed the job. The count now uses the findings that remain after the baseline. (#3316)
  • The job summary counts health findings after the baseline. With a loaded health baseline, fallow report --format github-summary shows the new findings and gives the accepted ones as context, for example "2 new functions exceed thresholds (74 in the baseline)". Without a baseline, the summary does not change. (#3316)
  • fallow --help names the baseline flags of the bare run. On bare fallow, --baseline and --save-baseline hold the dead-code baseline only. When a bare run gets a fallow health or fallow dupes baseline through --baseline, fallow now prints a note that tells you to use --health-baseline or --dupes-baseline. (#3316)
  • The Vitest JSX import source follows the Vitest project model. On Vitest 5, an inline test.projects entry inherits the JSX import source of its config unless it sets extends: false. On Vitest 4, it inherits only with extends: true. Fallow reads the Vitest version from node_modules/vitest, else from the declared range. Project and base include globs add up. Fallow also reads a config that extends names. It reads project configs with a custom name, such as vitest.e2e.config.ts, also when a glob entry names them. Fallow no longer reports these files as unused. (#3318)
  • Fallow reads test.exclude for the Vitest JSX import source. When test.exclude or a negated test.include entry removes a test file, Fallow no longer applies the JSX runtime of its project to that file. Without test.exclude, the Vitest default exclude applies. The globs are relative to test.dir, test.root or the Vite root when the config sets one. (#3318)
  • react is no longer an unused dependency when Vitest test files use JSX with the default runtime. When a Vitest config sets no JSX import source, Vite imports the react JSX runtime. Fallow now credits react when a test file of that config has JSX and no @jsxImportSource pragma. A TypeScript test file gives no credit when its tsconfig sets jsxImportSource, or a jsx mode without the automatic runtime. The credit applies only to the workspace of the test file. A vite.config.* next to a vitest.config.* gives no credit, because Vitest does not load it. (#3318)
  • The source-map warning of fallow coverage upload-source-maps tries the same paths as Fallow Cloud. The CLI dropped the first segments of a source such as webpack:///@scope/app/./src/x.ts, and the cloud did not. The warning could then check a path that the cloud never uses. A shared fixture of path cases now keeps the two implementations equal. (#3320)

Full Changelog: fallow-rs/fallow@v3.33.0...v3.33.1

v3.33.0: fallow architecture, baseline pruning, faster musl binaries

Features

  • fallow architecture reports import cycles, boundary violations and rule-pack policy violations in one command. Use --cycles, --boundaries or --policy to select one kind. The command takes the same scope and output flags as fallow dead-code. Run fallow guard <files> before an edit and fallow architecture after it. Bare fallow shows these findings in an "Architecture" category after the other dead-code categories. It also shows the category with --quiet, --group-by and --summary. With --group-by, fallow architecture shows one "Architecture" heading per group.
  • fallow architecture --format json writes kind: "architecture" with its own schema_version (1). With --group-by, the kind is architecture-grouped. The arrays, finding ids, actions, exit codes, gate outcomes and severities are the same as on fallow dead-code. next_steps names fallow architecture. With --explain, _meta.docs points to the architecture page, and _meta.rules lists only the architecture rules. --save-baseline writes a dead-code baseline (kind: "dead-code"), so the two commands read each other's baselines. The JSON schema and the generated TypeScript types have the ArchitectureOutput and ArchitectureGroupedOutput types.
  • fallow report, MCP, the Node bindings and CI accept the architecture report.
    • fallow report --from renders a saved architecture or architecture-grouped file in every format, the same as the direct run. PR comments and reviews of fallow architecture have the title "Fallow architecture report".
    • The MCP server has a check_architecture tool, and Code Mode exposes it as checkArchitecture. The Node bindings have detectArchitecture, and fallow_api has run_architecture. Each returns the architecture output. detectCircularDependencies, detectBoundaryViolations and the MCP analyze tool keep the dead-code output.
    • Bare fallow accepts architecture in --only and --skip. --only architecture runs the dead-code analysis and reports only the architecture findings, and its Failed: line names architecture. --skip architecture removes these findings from the dead-code section. The health score and the --save-baseline file do not change.
    • The GitHub Action accepts command: architecture, and the GitLab template accepts FALLOW_COMMAND: architecture. For this command, issue-types and FALLOW_ISSUE_TYPES take cycles, boundaries and policy. Another value stops the job with exit code 2 and an error that names the valid values.
    • Telemetry records fallow architecture runs as the architecture workflow.
  • fallow baselines prune removes the baseline entries of fixed findings. The command reads the files that audit.deadCodeBaseline, audit.healthBaseline and audit.dupesBaseline name. It runs one whole-project analysis and removes each entry that --baseline no longer matches. It never adds an entry, so a new finding stays visible to the gates. After a prune, --fail-on-stale-baseline passes, and the baseline hides the same findings as before. --check writes nothing and exits 1 when an entry can be pruned. --dead-code-baseline, --health-baseline and --dupes-baseline override the config paths. --coverage gives the coverage input for CRAP scores. The command skips a file with an older key form or with fields from a newer version. It prints the command that saves that file again. The stale-baseline warning and the gate message now name the prune command. Thanks @​BenMcGit for the request (#3281).
  • fallow hooks install --target git --prune-baselines prunes the baselines in the pre-commit hook. The hook runs fallow baselines prune before the audit and stages the baseline files that the prune wrote. The prune reads the working tree, but the commit uses the index. So the hook skips the prune when the working tree has unstaged or untracked changes. It also skips the prune for a commit with paths (git commit <path>). A failed prune never blocks the commit. The hints for Lefthook and for an existing hook include the same step.
  • fallow trace --dependency <package> reports how the code uses each imported name of a package. The report gives file and call counts, and sites with line and column. It follows one hop through project wrappers such as useSelector.withTypes(), and it counts each use that it cannot resolve. --sites, --specifier, --limit and --cursor page the sites. --callers --depth N adds the files that import the users. The MCP tool trace_dependency accepts the same options.
  • A JSX import source in a Vitest config now adds a module graph edge. With the automatic JSX runtime, oxc.jsx.importSource (or the older esbuild.jsxImportSource) makes each test file with JSX import <source>/jsx-dev-runtime. Fallow now adds this edge when the source is a path and the test file has JSX and no @jsxImportSource pragma. A package source only marks the package as used. A local JSX runtime no longer shows as unused, and --impact-closure on a runtime file now includes these test files.
    • The edge applies to the files that test.include matches. Fallow uses the root config when it has no test.projects, else each inline project config.
    • A project inherits the root source only with extends: true. The classic runtime adds no edge.
    • A relative source resolves from the test file first, then from the config directory. A source that does not resolve adds no edge and no unresolved import.

Changed

  • The Linux musl binaries are about 4 times faster. The malloc of musl is slow when many threads allocate, and fallow analyzes files in parallel. The musl binaries now use mimalloc. This applies to the linux-x64-musl and linux-arm64-musl npm packages and the musl release assets. On a 10-core aarch64 Alpine container, check, dupes and health took 77% less time over 15 fixture cases, with identical output. Peak memory is about a third higher. The Node addon keeps the default allocator. Glibc, macOS and Windows builds do not change.
  • Fallow hides the findings in an unused file by default. Fallow no longer lists an unused export, type, class member or enum member in a file that it reports as unused. Deleting the file removes these findings too. The JSON output has the count in cascade_hidden, and SARIF and markdown (grouped or not) show the count too. To list the findings, pass --show-cascade, set showCascade in the config, or use the show_cascade parameter of the MCP tools. The health vital signs still count them. When an issue-type filter leaves out unused-files, nothing is hidden.
  • fallow viz shows where to start and says what is wrong.
    • The Overview panel opens with the health grade and one card per lens. Each card shows the number of files, the number of high findings, and the worst file with its reason. The Overview map colors files that have findings in any lens. Folder labels show how many of their files have findings.
    • Each lens list opens with a short summary and a severity split. The list groups rows into high, medium and low. The full file name comes first, then a plain reason. For example, "File path built from input" replaces path-traversal, and "High complexity, no test coverage" replaces a CRAP score. Security lists each file once with all of its candidates.
    • Folders with no imports to or from other folders now show when the active lens has findings in them, for example unused files. Health colors only files above the review threshold, so high-risk files stand out. Folders without findings fade.
    • The Overview tab of the file panel opens with a list of the lenses that have findings in the file, each with its reason. The Health tab shows maintainability, change risk and importers. Then it lists each function to fix with its branches, lines, test coverage and next step. The treemap rings and names the selected file.
    • Folder and import-group labels have two lines (the name, then the size and findings). The labels stay over their cluster and keep clear of the controls and the legend. Import groups that span folders read as site/src + 5 more instead of (mixed). The status line shows the grouping or the path of the file in focus. The map hides disabled controls.
    • A click on a line between two folders lists the target files in use. Then it lists every import, with forbidden and cyclic imports first.
    • Hover tooltips use the same plain reasons as the panel. During a search, the legend explains the match and importer rings.
    • Below 700 px, the panel docks under the map as a sheet, so the map stays visible at full width. The legend becomes one line, crowded labels drop, and the file focus view fits both columns.
    • The map now follows the design of fallow.tools and fallow.cloud: paper and ink, Barlow type, hairline rules, square panels and flat controls. Day paper is the default. The night theme follows the system or the stored choice. The report embeds the fonts, so it looks the same offline.
    • On the graph, folders are octagons, the imports between them run at 0, 45 and 90 degrees, and flagged files have a ring. When you hover over an import line, the map picks the line under the pointer, gives it a pale blue halo and fades the others. Lines that are hidden at the current zoom no longer react. A hover over a file draws its imports the same way, in ink.
    • With a file open, the panel shows its place in the active lens ("3 of 61 in Security") with previous and next buttons. The j and k keys do the same.
    • High findings, sparse medium findings, and the copies of an open duplicated block get a halo on the graph.

... (truncated)

Commits
  • fccff88 chore: release v3.33.1
  • 9909983 fix(coverage): match the cloud source-map path candidates (#3320)
  • c3c4c57 fix(vitest): use forward slashes in the project glob prefix on Windows (#3319)
  • 503b8cd chore(release): set RELEASED_TAG to v3.33.0
  • 29df8f5 chore(docker): pin FALLOW_VERSION 3.33.0 with refreshed checksums
  • 576dc2b chore(napi): sync package.json / package-lock / index.js to v3.33.0
  • 1cc5402 fix(vitest): follow the Vitest project model for the JSX import source (#3318)
  • f4121c2 fix(action): baseline health and duplication on the default run (#3316)
  • 278dbc6 chore: release v3.33.0
  • 7615ef9 feat(vitest): add a graph edge for the Vitest JSX import source (#3315)
  • Additional commits viewable in compare view

Updates lint-staged from 17.5.1 to 17.6.0

Release notes

Sourced from lint-staged's releases.

v17.6.0

Minor Changes

  • #1850 938d3f4 - Task functions like { title, task } can now use a logger function log() to emit output while the task runs. By default, the output will only be visible if the task fails, unless the --verbose option was used. Additionally, when the task rejects, the error will be shown in the output.

    import { defineConfig } from 'lint-staged/config'
export default defineConfig({
'*': {
title: 'Fail if PDF files are committed',
task: async (filepaths, { log }) => {
const pdfFiles = filepaths.filter((f) => f.toLowerCase().endsWith('.pdf'))
if (pdfFiles.length > 0) {
log('PDF files should not be committed: %s', pdfFiles)
throw new Error('Failed')
}
},
},
})

  • #1854 30562bc - lint-staged now stages changes to all tracked files modified by tasks, including files that weren’t originally staged or didn’t match the configured globs. This can happen when your task has side-effects, or it's a function that ignores the staged files like () => "prettier --write .".

    If you have unstaged changes in a file and the task also edits that file, your unstaged changes will be staged too. Use --hide-unstaged to hide your changes while tasks run.

Patch Changes

  • #1860 4296532 - The assignment of staged files to lint-staged configuration files (when using multiple, for example in a monorepo) has been rewritten to be more efficient. As a reminder, each staged file is assigned to exactly one configuration (the closest one), even if that config doesn't match the file in its globs.

  • #1861 c45f28a - Fix running parallel tasks for a single glob, when tasks are created by a function. Nesting one level of arrays inside an array of tasks will result in the inner tasks running in parallel. This behavior should now be consistent when creating tasks using functions. In the following example eslint and prettier will run in parallel (for all files, when any JS files are staged):

    import { defineConfig } from 'lint-staged/config'
export default defineConfig({
'*.js': () => [['eslint --max-warnings=0 .', 'prettier --list-different .']],
})

  • #1859 f0ea69d - Various performance improvements from skipping redundant internal Git calls.

  • #1856 69d7d17 - Partially staged changes are hidden in a uniquely-named patch file to avoid multiple invocations of lint-staged overwriting it. This makes it safer to run lint-staged in multiple worktrees at the same time.

Changelog

Sourced from lint-staged's changelog.

17.6.0

Minor Changes

  • #1850 938d3f4 - Task functions like { title, task } can now use a logger function log() to emit output while the task runs. By default, the output will only be visible if the task fails, unless the --verbose option was used. Additionally, when the task rejects, the error will be shown in the output.

    import { defineConfig } from 'lint-staged/config'
export default defineConfig({
'*': {
title: 'Fail if PDF files are committed',
task: async (filepaths, { log }) => {
const pdfFiles = filepaths.filter((f) => f.toLowerCase().endsWith('.pdf'))
if (pdfFiles.length > 0) {
log('PDF files should not be committed: %s', pdfFiles)
throw new Error('Failed')
}
},
},
})

  • #1854 30562bc - lint-staged now stages changes to all tracked files modified by tasks, including files that weren’t originally staged or didn’t match the configured globs. This can happen when your task has side-effects, or it's a function that ignores the staged files like () => "prettier --write .".

    If you have unstaged changes in a file and the task also edits that file, your unstaged changes will be staged ...

    Description has been truncated

@dependabot
build(deps): bump the all group across 1 directory with 12 updates
e4621af 
Bumps the all group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@browserbasehq/sdk](https://github.com/browserbase/sdk-node) | `2.20.0` | `2.21.0` |
| [@browserbasehq/stagehand](https://github.com/browserbase/stagehand/tree/HEAD/packages/sdk-ts) | `3.7.1` | `4.2.0` |
| [@commitlint/cli](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/cli) | `21.2.2` | `21.2.3` |
| [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional) | `21.2.2` | `21.2.3` |
| [@dotenvx/dotenvx](https://github.com/dotenvx/dotenvx) | `2.28.0` | `2.34.2` |
| [devtools-protocol](https://github.com/ChromeDevTools/devtools-protocol) | `0.0.1676105` | `0.0.1716261` |
| [fallow](https://github.com/fallow-rs/fallow) | `3.27.0` | `3.33.1` |
| [lint-staged](https://github.com/lint-staged/lint-staged) | `17.5.1` | `17.6.0` |
| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.68.0` | `0.72.0` |
| [tsdown](https://github.com/rolldown/tsdown) | `0.22.14` | `0.23.0` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.13` | `4.23.15` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.0` | `8.3.4` |



Updates `@browserbasehq/sdk` from 2.20.0 to 2.21.0
- [Release notes](https://github.com/browserbase/sdk-node/releases)
- [Changelog](https://github.com/browserbase/sdk-node/blob/main/CHANGELOG.md)
- [Commits](browserbase/sdk-node@v2.20.0...v2.21.0)

Updates `@browserbasehq/stagehand` from 3.7.1 to 4.2.0
- [Release notes](https://github.com/browserbase/stagehand/releases)
- [Changelog](https://github.com/browserbase/stagehand/blob/main/CHANGELOG.md)
- [Commits](https://github.com/browserbase/stagehand/commits/@browserbasehq/stagehand@4.2.0/packages/sdk-ts)

Updates `@commitlint/cli` from 21.2.2 to 21.2.3
- [Release notes](https://github.com/conventional-changelog/commitlint/releases)
- [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/cli/CHANGELOG.md)
- [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.3/@commitlint/cli)

Updates `@commitlint/config-conventional` from 21.2.2 to 21.2.3
- [Release notes](https://github.com/conventional-changelog/commitlint/releases)
- [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/config-conventional/CHANGELOG.md)
- [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.3/@commitlint/config-conventional)

Updates `@dotenvx/dotenvx` from 2.28.0 to 2.34.2
- [Release notes](https://github.com/dotenvx/dotenvx/releases)
- [Changelog](https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md)
- [Commits](dotenvx/dotenvx@v2.28.0...v2.34.2)

Updates `devtools-protocol` from 0.0.1676105 to 0.0.1716261
- [Commits](ChromeDevTools/devtools-protocol@v0.0.1676105...v0.0.1716261)

Updates `fallow` from 3.27.0 to 3.33.1
- [Release notes](https://github.com/fallow-rs/fallow/releases)
- [Changelog](https://github.com/fallow-rs/fallow/blob/main/release.toml)
- [Commits](fallow-rs/fallow@v3.27.0...v3.33.1)

Updates `lint-staged` from 17.5.1 to 17.6.0
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](lint-staged/lint-staged@v17.5.1...v17.6.0)

Updates `oxfmt` from 0.68.0 to 0.72.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.72.0/npm/oxfmt)

Updates `tsdown` from 0.22.14 to 0.23.0
- [Release notes](https://github.com/rolldown/tsdown/releases)
- [Commits](rolldown/tsdown@v0.22.14...v0.23.0)

Updates `tsx` from 4.23.13 to 4.23.15
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.13...v4.23.15)

Updates `vite` from 8.3.0 to 8.3.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite)

---
updated-dependencies:
- dependency-name: "@browserbasehq/sdk"
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: "@browserbasehq/stagehand"
  dependency-version: 4.2.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all
- dependency-name: "@commitlint/cli"
  dependency-version: 21.2.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: "@commitlint/config-conventional"
  dependency-version: 21.2.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: "@dotenvx/dotenvx"
  dependency-version: 2.34.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: devtools-protocol
  dependency-version: 0.0.1716261
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: fallow
  dependency-version: 3.33.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: lint-staged
  dependency-version: 17.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: oxfmt
  dependency-version: 0.72.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: tsdown
  dependency-version: 0.23.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: tsx
  dependency-version: 4.23.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: vite
  dependency-version: 8.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 13, 2026
@LordCoughmann

LordCoughmann commented Oct 13, 2026

Copy link
Copy Markdown
Owner

Closing this as unmergeable, same class as #15/#20/#21.

Both jobs fail at the first step, but not for the catalog reason the sweep notes describe. Its regenerated lockfile pairs @effect/platform-node-shared@4.0.3 with effect@4.0.2, and that version of the shared package imports effect/dist/net/AddressResolver.js, which only exists from effect 4.0.3 onward:

ERR_MODULE_NOT_FOUND: Cannot find module '.../@effect+platform-node-shared@4.0.3_..._effect@4.0.2/node_modules/effect/dist/net/AddressResolver.js'
  imported from '.../@effect/platform-node-shared/dist/NodeAddressResolver.js'

So pnpm install --frozen-lockfile fails in both jobs before any check runs. The release-age policy also blocks #24's rewrites in a way the ignore list cannot rescue.

Two changes since this PR was opened:

  1. main now has the manual sweep for Effect 4.0.3 / Vitest 5 / oxlint 0.6.0 / alchemy 2.0.0-beta.81, released as v0.3.0.
  2. .github/dependabot.yml now ignores @browserbasehq/stagehand >=4.0.0, so the next group PR will not re-propose Stagehand v4 (ADR-0002).

The remaining updates here (sdk, commitlint, dotenvx, fallow, lint-staged, oxfmt, tsdown, tsx, vite) are in-range dev tooling and can be picked up by the next manual sweep. Note that devtools-protocol needs pnpm codegen:cdp:protocol regenerated and committed with any bump, so it can never land in a group PR as-is.

@dependabot @github

dependabot Bot commented on behalf of github Oct 13, 2026

Copy link
Copy Markdown
Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/all-475432b010 branch October 13, 2026 12:15
LordCoughmann added a commit that referenced this pull request Oct 13, 2026
@LordCoughmann
chore(ci): stop Dependabot proposing Stagehand v4
5f4bcca 
ADR-0002 states that the Dependabot ignore list "encodes" the decision to
stay on upstream Stagehand v3, but @browserbasehq/stagehand was never in it.
So every monthly group PR keeps proposing 4.x: the open PR #24 offers 4.2.0
alongside a dozen updates that could otherwise land.

Add the entry with a '>=4.0.0' version filter, so 3.x patches still flow
while v4 proposals stop. This makes the ADR's statement true and keeps the
group PR limited to updates that can actually merge.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@LordCoughmann