chore(deps)(deps-dev): Bump the npm group across 1 directory with 13 updates - #928
Open
dependabot[bot] wants to merge 1 commit into
Open
Conversation
dependabot
Bot
added
the
dependencies
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/DNNPlatform/Portals/1/2sxc/Faq4/npm-067f763e28
branch
3 times, most recently
from
July 26, 2026 23:24
6cffb2b to
129e1bb
Compare
This was referenced Jul 27, 2026
Merged
jsboige
added a commit
that referenced
this pull request
Jul 27, 2026
…ive flaky in real CI (#952) The upper bound (elapsed <= 2*backoff + 2000ms) is not the contract of a backoff; "the delay was applied" is, and that is the lower bound, which stays hard. Measured 2026-07-26: the test took 3 s and failed the 2 240 ms bound on dependabot PRs #928 and #935 while 24 sibling npm runs passed. Those two diffs touch ONLY vendored npm lockfiles under DNNPlatform/Portals/1/2sxc/**, so no production code could be implicated -- 26 dependabot runs firing inside 5 minutes contend for the runner. The flakiness became visible only because #911 made the CI Test step real. Subtracting rather than widening, deliberately: a bigger number only moves the load level at which the bound lies, and it still would not be testing anything. The note in the file records the measurement so the bound is not "restored" later. Local: 643 total / 638 passed / 0 failed / 5 skipped (24 s). Refs #911, #928, #935 Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/DNNPlatform/Portals/1/2sxc/Faq4/npm-067f763e28
branch
from
July 27, 2026 03:34
129e1bb to
7f41345
Compare
clusterManager-Myia
left a comment
clusterManager-Myia
left a comment
Collaborator
There was a problem hiding this comment.
[NanoClaw] structural review — dependabot-authored Argumentum chore(deps)(deps-dev): Bump the npm group across 1 directory with 13 updates (Faq4 vendored 2sxc tree), 2 files (+1359/−793: package.json + package-lock.json, lock churn dominates). dependabot[bot] ≠ my machine identity → no self-review conflict. deps class → quick structural review; STRUCTURAL-ALWAYS (lockfile churn large, no patch body fetched). Load-bearing verification = the dependabot.yml policy at master + the actual bumped-version list (anti-complacency: don't trust the config blindly, confirm no major slipped through).
LGTM — clean ignore-major-class bump, verified firsthand (policy applies + 0 major slip + CI green).
Verified firsthand:
- Policy applies: #928 touches
DNNPlatform/Portals/1/2sxc/Faq4/= a vendored 2sxc/DNN npm tree.dependabot.yml(po-2024 authored #910, jsboige arbitrated 2026-07-26 option A) policy #2 states explicitly: "npm vendored DNNPlatform trees → group + ignore majors (unvalidated in CI, #901)… Patch/minor are lockfile-only and are merged per precedent #120." This PR is exactly that class. - 0 major slipped through the ignore filter (the anti-complacency check) — all 13 bumps read from the dependabot body, every one patch/minor within its major line:
- autoprefixer 10.3.5→10.5.4, css-loader 6.3.0→6.11.0, mini-css-extract-plugin 2.3.0→2.10.2, postcss-loader 6.1.1→6.2.1, sass 1.42.1→1.102.0 (biggest numeric jump, still 1.x = accumulated minors, NOT a major), sass-loader 12.1.0→12.6.0, slidetoggle 3.2.2→3.3.2, style-loader 3.3.0→3.3.4 (patch), terser-webpack-plugin 5.2.4→5.6.1, ts-loader 9.2.6→9.6.2, typescript 4.4.3→4.9.5, webpack 5.53.0→5.109.0, webpack-cli 4.8.0→4.10.0.
- The
ignore: version-update:semver-majoris doing exactly what the policy comment says — no^majordrift reached this PR.
- CI GREEN firsthand @ head
7f41345f:build (Debug)= success,build (Release)= success,GitGuardian Security Checks= success. The bumped versions resolve and the .NET build (which consumes these trees only at the vendored-path level, #901) is unaffected. - Hygiene: 0 secrets (dependabot-authored lockfile/package churn, GitGuardian green). CJK 0.
Honest scoping:
- Did not fetch the package.json/lock patch bodies (+1359/−793 is lock churn — structural rule, no value in reading a regenerated lock). The dependabot body version table is the authoritative bump list and I verified it directly.
- This is one of a burst of sibling npm-tree bumps (#922/#924/#925/#926/#927 etc.) — same class by construction (same dependabot.yml policy, same ignore-major filter). I'm reviewing #928 as the freshest+largest representative; the sibling verdict holds wherever the same policy+green-CI applies. Merge-wave decision is owner-side (jsboige arbitrated 2026-07-26).
- Vendored trees are "unvalidated in CI" per #901 (CI builds the .NET pipeline, not these webpack trees) — so CI green = "the .NET pipeline still builds with these package.json edits", not "the webpack tree itself was exercised". That's the documented limitation of the ignore-major policy, not a new concern.
Why this LGTM is earned, not mechanical: the value of a dependabot bump review is whether the ignore-major policy actually held for THIS bump set (a misconfigured filter could let a breaking major through). I checked the 13 versions directly — all patch/minor, no major. Policy + green CI + lockfile-only edits = the documented clean class. Owner merge-wave.
— NanoClaw (myia-ai-01) · structural · dependabot npm vendored-tree group bump · 13/13 bumps verified patch/minor firsthand (0 major slip past ignore-major filter), dependabot.yml policy #2 applies, CI green firsthand (Debug/Release/GitGuardian)
…updates Bumps the npm group with 13 updates in the /DNNPlatform/Portals/1/2sxc/Faq4 directory: | Package | From | To | | --- | --- | --- | | [autoprefixer](https://github.com/postcss/autoprefixer) | `10.3.5` | `10.5.4` | | [css-loader](https://github.com/webpack/css-loader) | `6.3.0` | `6.11.0` | | [mini-css-extract-plugin](https://github.com/webpack/mini-css-extract-plugin) | `2.3.0` | `2.10.2` | | [postcss-loader](https://github.com/webpack/postcss-loader) | `6.1.1` | `6.2.1` | | [sass](https://github.com/sass/dart-sass) | `1.42.1` | `1.102.0` | | [sass-loader](https://github.com/webpack/sass-loader) | `12.1.0` | `12.6.0` | | [slidetoggle](https://github.com/zgrybus/slidetoggle) | `3.2.2` | `3.3.2` | | [style-loader](https://github.com/webpack-contrib/style-loader) | `3.3.0` | `3.3.4` | | [terser-webpack-plugin](https://github.com/webpack/minimizer-webpack-plugin) | `5.2.4` | `5.6.1` | | [ts-loader](https://github.com/TypeStrong/ts-loader) | `9.2.6` | `9.6.2` | | [typescript](https://github.com/microsoft/TypeScript) | `4.4.3` | `4.9.5` | | [webpack](https://github.com/webpack/webpack) | `5.53.0` | `5.109.0` | | [webpack-cli](https://github.com/webpack/webpack-cli) | `4.8.0` | `4.10.0` | Updates `autoprefixer` from 10.3.5 to 10.5.4 - [Release notes](https://github.com/postcss/autoprefixer/releases) - [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md) - [Commits](postcss/autoprefixer@10.3.5...10.5.4) Updates `css-loader` from 6.3.0 to 6.11.0 - [Release notes](https://github.com/webpack/css-loader/releases) - [Changelog](https://github.com/webpack/css-loader/blob/main/CHANGELOG.md) - [Commits](webpack/css-loader@v6.3.0...v6.11.0) Updates `mini-css-extract-plugin` from 2.3.0 to 2.10.2 - [Release notes](https://github.com/webpack/mini-css-extract-plugin/releases) - [Changelog](https://github.com/webpack/mini-css-extract-plugin/blob/main/CHANGELOG.md) - [Commits](webpack/mini-css-extract-plugin@v2.3.0...v2.10.2) Updates `postcss-loader` from 6.1.1 to 6.2.1 - [Release notes](https://github.com/webpack/postcss-loader/releases) - [Changelog](https://github.com/webpack/postcss-loader/blob/main/CHANGELOG.md) - [Commits](webpack/postcss-loader@v6.1.1...v6.2.1) Updates `sass` from 1.42.1 to 1.102.0 - [Release notes](https://github.com/sass/dart-sass/releases) - [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md) - [Commits](sass/dart-sass@1.42.1...1.102.0) Updates `sass-loader` from 12.1.0 to 12.6.0 - [Release notes](https://github.com/webpack/sass-loader/releases) - [Changelog](https://github.com/webpack/sass-loader/blob/main/CHANGELOG.md) - [Commits](webpack/sass-loader@v12.1.0...v12.6.0) Updates `slidetoggle` from 3.2.2 to 3.3.2 - [Release notes](https://github.com/zgrybus/slidetoggle/releases) - [Changelog](https://github.com/zgrybus/slideToggle/blob/master/CHANGELOG.md) - [Commits](zgrybus/slideToggle@v3.2.2...v3.3.2) Updates `style-loader` from 3.3.0 to 3.3.4 - [Release notes](https://github.com/webpack-contrib/style-loader/releases) - [Changelog](https://github.com/webpack/style-loader/blob/v3.3.4/CHANGELOG.md) - [Commits](webpack/style-loader@v3.3.0...v3.3.4) Updates `terser-webpack-plugin` from 5.2.4 to 5.6.1 - [Release notes](https://github.com/webpack/minimizer-webpack-plugin/releases) - [Changelog](https://github.com/webpack/minimizer-webpack-plugin/blob/main/CHANGELOG.md) - [Commits](webpack/minimizer-webpack-plugin@v5.2.4...v5.6.1) Updates `ts-loader` from 9.2.6 to 9.6.2 - [Release notes](https://github.com/TypeStrong/ts-loader/releases) - [Changelog](https://github.com/TypeStrong/ts-loader/blob/main/CHANGELOG.md) - [Commits](TypeStrong/ts-loader@v9.2.6...v9.6.2) Updates `typescript` from 4.4.3 to 4.9.5 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v4.4.3...v4.9.5) Updates `webpack` from 5.53.0 to 5.109.0 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.53.0...v5.109.0) Updates `webpack-cli` from 4.8.0 to 4.10.0 - [Release notes](https://github.com/webpack/webpack-cli/releases) - [Changelog](https://github.com/webpack/webpack-cli/blob/main/CHANGELOG.md) - [Commits](https://github.com/webpack/webpack-cli/compare/webpack-cli@4.8.0...webpack-cli@4.10.0) --- updated-dependencies: - dependency-name: autoprefixer dependency-version: 10.5.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: css-loader dependency-version: 6.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: mini-css-extract-plugin dependency-version: 2.10.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: postcss-loader dependency-version: 6.2.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: sass dependency-version: 1.102.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: sass-loader dependency-version: 12.6.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: slidetoggle dependency-version: 3.3.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: style-loader dependency-version: 3.3.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: terser-webpack-plugin dependency-version: 5.6.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: ts-loader dependency-version: 9.6.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: typescript dependency-version: 4.9.5 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: webpack dependency-version: 5.109.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: webpack-cli dependency-version: 4.10.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/DNNPlatform/Portals/1/2sxc/Faq4/npm-067f763e28
branch
from
July 27, 2026 07:16
7f41345 to
fe39c33
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm group with 13 updates in the /DNNPlatform/Portals/1/2sxc/Faq4 directory:
10.3.510.5.46.3.06.11.02.3.02.10.26.1.16.2.11.42.11.102.012.1.012.6.03.2.23.3.23.3.03.3.45.2.45.6.19.2.69.6.24.4.34.9.55.53.05.109.04.8.04.10.0Updates
autoprefixerfrom 10.3.5 to 10.5.4Release notes
Sourced from autoprefixer's releases.
... (truncated)
Changelog
Sourced from autoprefixer's changelog.
... (truncated)
Commits
4cad00fRelease 10.5.4 versione62a4b1Update CI configc8f0d0aUpdate dependenciescae3577Move back to latest pnpm 11fd31eb3Fix duplicated prefixed selectors on reformatted CSS (#1552)958d390Release 10.5.3 version21d2adbFix gradient parserf7ddae9Fix bracket parser10ea5e7Update dependencies and remove patchb6e8a2aUpdate Dev ContainerMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for autoprefixer since your current version.
Updates
css-loaderfrom 6.3.0 to 6.11.0Release notes
Sourced from css-loader's releases.
... (truncated)
Changelog
Sourced from css-loader's changelog.
... (truncated)
Commits
95cf5c5chore(release): 6.11.0bbca614feat: supports multiple composes (#1582)e022e3bfix: do not break@scopeat-rule without params (#1581)6274480test: for@scope(#1580)24e114achore: update codecov-action to v4 (#1575)f5be49cci: fix commitlint check (#1574)53b3096test: case for pure and nesting (#1573)d70117dchore: update dependency-review-action to the latest version (#1570)7bbb57cchore(release): 6.10.0d641c4dfeat: pass theresourceQueryandresourceFragmentto theautoand `mode...Updates
mini-css-extract-pluginfrom 2.3.0 to 2.10.2Release notes
Sourced from mini-css-extract-plugin's releases.
... (truncated)
Changelog
Sourced from mini-css-extract-plugin's changelog.
... (truncated)
Commits
d50f981chore(release): 2.10.2b02c8actest: more (#1163)143693efix: use matchResource for importModule when available (#1162)da57ee5chore(release): 2.10.11e73d98test: fix (#1160)0233180fix: handle null module.layer in renderContentAsset (#1159)24ab26bchore(release): 2.10.0144de04test: fix (#1155)4e4a95dfix: prevent generation of a contentHash for a chunk when the set of css modu...54f775dfeat: respectoutput.cssFilenameandoutput.cssChunkFilename(#1151)Updates
postcss-loaderfrom 6.1.1 to 6.2.1Release notes
Sourced from postcss-loader's releases.
Changelog
Sourced from postcss-loader's changelog.
Commits
b3239cbchore(release): 6.2.16a9c043chore(deps): update7f165b4fix: watching configuration (#553)f460c22chore(release): 6.2.0c654f61chore(deps): update (#550)4313feedocs(readme): update getting started instructions (#549)bcf088adocs: update templates (#545)4899cc5ci: updatecodecov-actionto v2 (#544)f52d4c2ci: update commitlint action to v4 (#543)f653500ci: setup npm cache (#542)Updates
sassfrom 1.42.1 to 1.102.0Release notes
Sourced from sass's releases.
... (truncated)
Changelog
Sourced from sass's changelog.
... (truncated)
Commits
45d1efeUse gamma 2.40 for display-referred rec2020 (#2729)96aa291Persist credentials on all repos we push to (#2812)5af0b89Set the Git committer for release tasks (#2811)2cecbbbFix more issues downstream from Zizmor (#2809)a16f014Emit floating-pointrgb()values as percentages (#2800)4ed2c88Serializeif()values as CSS, not as inspected values (#2808)9dfde3dFix more post-Zizmor failures (#2806)e8c1233Fix some GitHub actions issues introduced by the Zizmor refactor (#2798)d676118Merge pull request #2797 from sass/lints548e660Prefer interpolation to compose stringsMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for sass since your current version.
Updates
sass-loaderfrom 12.1.0 to 12.6.0Release notes
Sourced from sass-loader's releases.
Changelog
Sourced from sass-loader's changelog.
Commits
972a178chore(release): 12.6.0f670635test: more (#1026)c8dae87feat: addsass-embeddedto auto loading (#1025)d3827f2chore(release): 12.5.0afbe114feat: addedsass-embeddedsupport and theapioptionff8d078docs: fix typo in BUG.md (#1023)a6cf219chore: upgrade dependencies to the latest version (#1022)6fef18bdocs(readme): added sass options (#1019)33d7572chore(deps): bump nanoid from 3.1.30 to 3.2.0 (#1021)c525b1fci: fix (#1020)Updates
slidetogglefrom 3.2.2 to 3.3.2Release notes
Sourced from slidetoggle's releases.
Commits
4849f88Release 3.3.286b138fRevert "issue/16_1 (#27)"af321fcissue/16_1 (#27)07393ccIssue/24 (#26)5b85674issue/23 (#25)88e2d97v3.2.2 update READNE.MD (#20)Updates
style-loaderfrom 3.3.0 to 3.3.4Release notes
Sourced from style-loader's releases.
Changelog
Sourced from style-loader's changelog.
Commits
bfdc1fcchore(release): 3.3.4c12e70bfix: css experiments logic337e730fix: css experiments logic43cdf2bfix: css experiments logicc4b80b4fix: css experiments logic14e731edocs: add security warning (#615)fd577b7chore: update github action/setup-node (#614)12de2e0chore: update github actions/checkout (#611)16e401bdocs: remove Gitter from issue templates (#607)9dc73f3chore: update dependencies to the latest version (#606)Updates
terser-webpack-pluginfrom 5.2.4 to 5.6.1Release notes
Sourced from terser-webpack-plugin's releases.
... (truncated)
Changelog
Sourced from terser-webpack-plugin's changelog.
... (truncated)
Commits
5207f94chore(release): new release (#683)06bda34fix: dedupe extracted comments in linear time (#682)39fd982chore(deps): bump fast-uri from 3.1.0 to 3.1.2 (#680)57bdcfcchore(release): new release (#675)