chore(deps)(deps): Bump the npm group across 1 directory with 10 updates - #940
Conversation
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
added
the
dependencies
clusterManager-Myia
left a comment
clusterManager-Myia
left a comment
There was a problem hiding this comment.
[NanoClaw] structural review — dependabot[bot] npm-group bump, 2 files (+984/−924). Reviewed the decision content (package.json ±10) firsthand; lock file is the resolved transitive tree (consistent with minor bumps, not separately auditable line-by-line without the toolchain).
LGTM — mechanical, policy-conformant, zero major bumps.
The 10 devDependency floors (base→head), all minor/patch, no major:
autoprefixer 10.4.8→10.5.4 · css-loader 6.7.1→6.11.0 · mini-css-extract-plugin 2.6.1→2.10.2 · postcss-loader 7.0.1→7.3.4 · sass 1.54.5→1.102.0 · sass-loader 13.0.2→13.3.3 · ts-loader 9.3.1→9.6.2 · typescript 4.7.4→4.9.5 · webpack 5.74.0→5.109.0 · webpack-cli 4.10.0 (unchanged). Plus bootstrap dep 5.2.0→5.3.8 (minor). semver ⇒ backward-compatible ranges; the ignore-major policy in the merged dependabot.yml is doing its job — no breaking floors introduced.
- Secrets scan on
package.json@ head: clean (0sk-/ghp_/AKIA/tokens/keys). - Target is a vendored 2sic/2shine DNN skin (
repository: 2sic/dnn-theme-2shine-bs5) — third-party theme bundled into DNNPlatform. Bumping its build-toolchain deps doesn't touch Argumentum's own runtime; thewebpackbuild-prod script is the only consumer.
The substantive observation (not a blocker): this PR is one of 27 open dependabot bumps in a burst that opened right after #910 was merged today (16:35Z, 05e12463). #910 is the group + ignore-major dependabot.yml — and #940's base is exactly 05e12463. So this burst is the intended, in-scope consequence of the just-ratified policy (jsboige's option A: keep tracking the vendored npm trees), not premature. The technical content of each bump is trivial; the real decision is merge-wave scope — whether to batch-merge 27 mechanical bumps or triage. That's an owner call (Emerjesse/jsboige), surfaced here for visibility, not a per-PR defect.
Noted separately (not this PR): #936 (jsboige, open) is a doc-hygiene follow-up fixing the now-stale "NOT merged / deliberate arbitration" header comment inside the merged dependabot.yml — worth its own pass so the policy file doesn't read as unratified in six months. Distinct from these bumps.
— NanoClaw (myia-ai-01) · structural · dependabot bump · 0 major / 0 secrets
dependabot
Bot
changed the title
833a4e2 to
5820e3f
Compare
5820e3f to
884e7d0
Compare
884e7d0 to
95458ec
Compare
Bumps the npm group with 10 updates in the /DNNPlatform/Portals/_default/Skins/2shineBS5 directory: | Package | From | To | | --- | --- | --- | | [bootstrap](https://github.com/twbs/bootstrap) | `5.2.0` | `5.3.8` | | [autoprefixer](https://github.com/postcss/autoprefixer) | `10.4.8` | `10.5.4` | | [css-loader](https://github.com/webpack/css-loader) | `6.7.1` | `6.11.0` | | [mini-css-extract-plugin](https://github.com/webpack/mini-css-extract-plugin) | `2.6.1` | `2.10.2` | | [postcss-loader](https://github.com/webpack/postcss-loader) | `7.0.1` | `7.3.4` | | [sass](https://github.com/sass/dart-sass) | `1.54.5` | `1.102.0` | | [sass-loader](https://github.com/webpack/sass-loader) | `13.0.2` | `13.3.3` | | [ts-loader](https://github.com/TypeStrong/ts-loader) | `9.3.1` | `9.6.2` | | [typescript](https://github.com/microsoft/TypeScript) | `4.7.4` | `4.9.5` | | [webpack](https://github.com/webpack/webpack) | `5.74.0` | `5.109.0` | Updates `bootstrap` from 5.2.0 to 5.3.8 - [Release notes](https://github.com/twbs/bootstrap/releases) - [Commits](twbs/bootstrap@v5.2.0...v5.3.8) Updates `autoprefixer` from 10.4.8 to 10.5.4 - [Release notes](https://github.com/postcss/autoprefixer/releases) - [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md) - [Commits](postcss/autoprefixer@10.4.8...10.5.4) Updates `css-loader` from 6.7.1 to 6.11.0 - [Release notes](https://github.com/webpack/css-loader/releases) - [Changelog](https://github.com/webpack/css-loader/blob/main/CHANGELOG.md) - [Commits](webpack/css-loader@v6.7.1...v6.11.0) Updates `mini-css-extract-plugin` from 2.6.1 to 2.10.2 - [Release notes](https://github.com/webpack/mini-css-extract-plugin/releases) - [Changelog](https://github.com/webpack/mini-css-extract-plugin/blob/main/CHANGELOG.md) - [Commits](webpack/mini-css-extract-plugin@v2.6.1...v2.10.2) Updates `postcss-loader` from 7.0.1 to 7.3.4 - [Release notes](https://github.com/webpack/postcss-loader/releases) - [Changelog](https://github.com/webpack/postcss-loader/blob/main/CHANGELOG.md) - [Commits](webpack/postcss-loader@v7.0.1...v7.3.4) Updates `sass` from 1.54.5 to 1.102.0 - [Release notes](https://github.com/sass/dart-sass/releases) - [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md) - [Commits](sass/dart-sass@1.54.5...1.102.0) Updates `sass-loader` from 13.0.2 to 13.3.3 - [Release notes](https://github.com/webpack/sass-loader/releases) - [Changelog](https://github.com/webpack/sass-loader/blob/main/CHANGELOG.md) - [Commits](webpack/sass-loader@v13.0.2...v13.3.3) Updates `ts-loader` from 9.3.1 to 9.6.2 - [Release notes](https://github.com/TypeStrong/ts-loader/releases) - [Changelog](https://github.com/TypeStrong/ts-loader/blob/main/CHANGELOG.md) - [Commits](TypeStrong/ts-loader@v9.3.1...v9.6.2) Updates `typescript` from 4.7.4 to 4.9.5 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v4.7.4...v4.9.5) Updates `webpack` from 5.74.0 to 5.109.0 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.74.0...v5.109.0) --- updated-dependencies: - dependency-name: autoprefixer dependency-version: 10.5.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: bootstrap dependency-version: 5.3.8 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: css-loader dependency-version: 6.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: mini-css-extract-plugin dependency-version: 2.10.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: postcss-loader dependency-version: 7.3.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: sass dependency-version: 1.102.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: sass-loader dependency-version: 13.3.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: ts-loader dependency-version: 9.6.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: typescript dependency-version: 4.9.5 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: webpack dependency-version: 5.109.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm ... Signed-off-by: dependabot[bot] <support@github.com>
95458ec to
1b45c99
Compare
1 participant
Bumps the npm group with 10 updates in the /DNNPlatform/Portals/_default/Skins/2shineBS5 directory:
5.2.05.3.810.4.810.5.46.7.16.11.02.6.12.10.27.0.17.3.41.54.51.102.013.0.213.3.39.3.19.6.24.7.44.9.55.74.05.109.0Updates
bootstrapfrom 5.2.0 to 5.3.8Release notes
Sourced from bootstrap's releases.
... (truncated)
Commits
25aa8ccRelease v5.3.8 (#41669)122bff5Remove Themes from docs (#41671)320f713docs: Minor range example code optimization (#41665)ac5f51cRevert "Attempt to return focus explicitly to dropdown trigger (#41365)" (#41...4bd8b6cMigrate MyGet script to GH actions (#41583)f50f38bCSS: Fix spinner deformation in flex boxes when content is multiline (#41654)47c75b8Set cursor pointer on input search cancel button (#41639)26c86baBuild(deps): Bump github/codeql-action from 3.29.8 to 3.29.10 (#41664)099b02bBuild(deps-dev): Bump rollup from 4.46.2 to 4.46.34b8a2c9Build(deps-dev): bump dependenciesUpdates
autoprefixerfrom 10.4.8 to 10.5.4Release notes
Sourced from autoprefixer's releases.
... (truncated)
Changelog
Sourced from autoprefixer's changelog.
... (truncated)
Commits
4cad00fRelease 10.5.4 versione62a4b1Update CI configc8f0d0aUpdate dependenciescae3577Move back to latest pnpm 11fd31eb3Fix duplicated prefixed selectors on reformatted CSS (#1552)958d390Release 10.5.3 version21d2adbFix gradient parserf7ddae9Fix bracket parser10ea5e7Update dependencies and remove patchb6e8a2aUpdate Dev ContainerMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for autoprefixer since your current version.
Updates
css-loaderfrom 6.7.1 to 6.11.0Release notes
Sourced from css-loader's releases.
... (truncated)
Changelog
Sourced from css-loader's changelog.
... (truncated)
Commits
95cf5c5chore(release): 6.11.0bbca614feat: supports multiple composes (#1582)e022e3bfix: do not break@scopeat-rule without params (#1581)6274480test: for@scope(#1580)24e114achore: update codecov-action to v4 (#1575)f5be49cci: fix commitlint check (#1574)53b3096test: case for pure and nesting (#1573)d70117dchore: update dependency-review-action to the latest version (#1570)7bbb57cchore(release): 6.10.0d641c4dfeat: pass theresourceQueryandresourceFragmentto theautoand `mode...Updates
mini-css-extract-pluginfrom 2.6.1 to 2.10.2Release notes
Sourced from mini-css-extract-plugin's releases.
... (truncated)
Changelog
Sourced from mini-css-extract-plugin's changelog.
... (truncated)
Commits
d50f981chore(release): 2.10.2b02c8actest: more (#1163)143693efix: use matchResource for importModule when available (#1162)da57ee5chore(release): 2.10.11e73d98test: fix (#1160)0233180fix: handle null module.layer in renderContentAsset (#1159)24ab26bchore(release): 2.10.0144de04test: fix (#1155)4e4a95dfix: prevent generation of a contentHash for a chunk when the set of css modu...54f775dfeat: respectoutput.cssFilenameandoutput.cssChunkFilename(#1151)Updates
postcss-loaderfrom 7.0.1 to 7.3.4Release notes
Sourced from postcss-loader's releases.
... (truncated)
Changelog
Sourced from postcss-loader's changelog.
... (truncated)
Commits
754c4a5chore(release): 7.3.48ef0c7efix: do not crash if pkg.(d|devD)ependencies unset (#667)84f16bechore: update github action/setup-node (#675)d6a0768chore(deps-dev): bump@babel/traversefrom 7.22.17 to 7.23.2 (#674)fdf99fdchore: upgrade dependencies to the latest version (#671)c05b3bfchore: update github actions/checkout (#665)59c86f1chore: update dependencies to the latest version (#666)cde30a4chore: update dependencies to the latest version (#661)46c4018chore: upgrade dependencies to the latest version (#660)7a85867chore(release): 7.3.3Updates
sassfrom 1.54.5 to 1.102.0Release notes
Sourced from sass's releases.
... (truncated)
Changelog
Sourced from sass's changelog.
... (truncated)
Commits
45d1efeUse gamma 2.40 for display-referred rec2020 (#2729)96aa291Persist credentials on all repos we push to (#2812)5af0b89Set the Git committer for release tasks (#2811)2cecbbbFix more issues downstream from Zizmor (#2809)a16f014Emit floating-pointrgb()values as percentages (#2800)4ed2c88Serializeif()values as CSS, not as inspected values (#2808)9dfde3dFix more post-Zizmor failures (#2806)e8c1233Fix some GitHub actions issues introduced by the Zizmor refactor (#2798)d676118Merge pull request #2797 from sass/lints548e660Prefer interpolation to compose stringsMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for sass since your current version.
Updates
sass-loaderfrom 13.0.2 to 13.3.3Release notes
Sourced from sass-loader's releases.
... (truncated)
Changelog
Sourced from sass-loader's changelog.
Commits
542c9e4chore(release): 13.3.3e34f938fix: sass embedded importer detection0084b93fix: warning output (#1173)8a5e16cchore: update github action/setup-node (#1167)3a9e064docs: update (#1169)92d862ctest: dropfiberstest (#1171)54a0736docs: add missing parameter (#1155)7599ac2chore(deps-dev): bump@babel/traversefrom 7.22.8 to 7.23.2 (#1164)2c1f06fchore: update github actions/checkout (#1159)32e56a6chore: update dependencies to the latest version (#1154)Updates
ts-loaderfrom 9.3.1 to 9.6.2Release notes
Sourced from ts-loader's releases.