chore(deps-dev): bump the dev-dependencies group with 6 updates - #307
Merged
Merged
Conversation
Rebuilds #302, #303 and #304 against beta. All three were opened against main, whose package.json trails beta by everything in #297, so most of what they propose is already here and their lockfiles no longer apply. @release-it/conventional-changelog ^12.0.0 -> ^12.0.2 @types/node ^26.5.1 -> ^26.6.1 dotenv ^17.4.2 -> ^18.0.0 js-yaml ^5.4.1 -> ^5.4.2 mocha ^12.0.0 -> ^12.0.2 release-it ^21.0.2 -> ^21.1.0 js-yaml is the only one that reaches the packaged extension — src imports it and esbuild bundles it — and it is a patch. The rest are tooling. The root conventional-changelog-conventionalcommits pin stays at 9.3.1; the 10.x that moves in the lockfile is release-it's own nested copy, already on 10.x before this change. dotenv is declared but imported nowhere in the repo, so its major bump is inert — worth removing rather than tracking, separately. release-it 21.1.0 pulls in one new transitive package, verkit@0.4.0 (MIT). Every version here was published at least three days ago.
Contributor
🛡️ Security Hardening Pipeline ResultsBranch: Workflow Run: 459 Scan Status
Summaries Collected: 4 Scanner Results🔬 CodeQL SAST (Javascript)Status: Completed Findings Summary
No security findings detected for Javascript. Artifacts: CodeQL Reports (Javascript) 🔗 Dependency ReviewStatus: ✅ No issues found No vulnerable or license-violating dependencies detected in this PR. 🔑 Gitleaks (Secrets)No 🔑 Gitleaks (Secrets) findings summary was produced. 📦 OSV (Dependencies)No 📦 OSV (Dependencies) findings summary was produced. Generated by Argus Generated by Argus |
This was referenced Sep 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Rebuilds #302, #303 and #304 against
beta. All three were opened againstmain, whosepackage.jsontrailsbetaby everything in #297, so most of what they propose is already here and their lockfiles no longer apply.Type of Change
Changes Made
Six of the thirteen root bumps across those PRs are genuinely newer than
beta:@release-it/conventional-changelog@types/nodedotenvjs-yamlmocharelease-itThe other seven (
@octokit/core,@typescript-eslint/*,cz-emoji-conventional,eslint,globals,tsx,typescript-eslint) already landed in #297 at the same or a higher version.Notes worth reading before merging
js-yamlis the only one that ships.dependenciesis empty and esbuild bundles whatsrc/imports, sojs-yamlis in the packaged extension and the rest are tooling. It is a patch bump, and the parser suites cover it.conventional-changelog-conventionalcommitsv9 hold still holds. The lockfile moves a 10.x copy, but that isrelease-it's own nested dependency and was already on 10.x. The root pin is untouched at 9.3.1, as.github/dependabot.ymlintends.dotenvis declared and imported nowhere.grep -rn dotenvoutsidenode_modulesand the lockfile returns exactly one hit: its own line inpackage.json. The major bump is therefore inert. Removing it is the better answer than tracking it, but that is a separate change and not something to fold into a dependency PR.verkit@0.4.0(MIT), a dependency ofrelease-it@21.1.0. Dev-only.Validation
Run with npm 10 to match CI (Node 22):
npm ci— clean, 755 packages,found 0 vulnerabilitiesnpm test— 438 passingnpm run lint— clean at--max-warnings 0npx tsc --noEmit— cleanThe lockfile diff is 34 changed, 4 added, 2 removed — the six root bumps plus
release-it's inquirer and conventional-changelog subtrees. No other root dependency moved.Related
Closes #302, #303 and #304 once merged. Companion to #306 for the GitHub Actions bump.
Checklist