chore(deps): bump the npm-minor-patch group with 8 updates - #357
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the npm-minor-patch group with 8 updates: | Package | From | To | | --- | --- | --- | | [turbo](https://github.com/vercel/turborepo) | `2.10.10` | `2.10.12` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` | | [@types/d3-shape](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/d3-shape) | `3.1.8` | `3.2.0` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.2.5` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.10` | `4.1.11` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.67.0` | `8.68.0` | | [next](https://github.com/vercel/next.js) | `15.5.23` | `15.5.24` | | [@types/chrome](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/chrome) | `0.2.6` | `0.2.7` | Updates `turbo` from 2.10.10 to 2.10.12 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.10.10...v2.10.12) Updates `vitest` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) Updates `@types/d3-shape` from 3.1.8 to 3.2.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/d3-shape) Updates `@types/react-dom` from 19.2.4 to 19.2.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `@vitest/coverage-v8` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-v8) Updates `typescript-eslint` from 8.67.0 to 8.68.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/typescript-eslint) Updates `next` from 15.5.23 to 15.5.24 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.23...v15.5.24) Updates `@types/chrome` from 0.2.6 to 0.2.7 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/chrome) --- updated-dependencies: - dependency-name: turbo dependency-version: 2.10.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: "@types/d3-shape" dependency-version: 3.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@types/react-dom" dependency-version: 19.2.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: typescript-eslint dependency-version: 8.68.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: next dependency-version: 15.5.24 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: "@types/chrome" dependency-version: 0.2.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
pmontiel-git
left a comment
pmontiel-git
left a comment
There was a problem hiding this comment.
Two red legs, and they are not the same kind of red
The bump itself is clean. All 27 manifests change version strings and nothing else — deduped the whole diff and it is exactly the 8 packages in the table, no stray edits riding along. No @types/node movement, so the per-package declaration rule is untouched. Dependency audit is green, and next lands on 15.5.24, which is precisely the version #356's renewed postcss waiver says it re-checked against — so that waiver stays accurate on merge instead of going stale the day it landed.
Windows · Unit tests — the known flake, ignore it
FAIL cli/test/commands/vault.test.ts > aka vault show > mints no fingerprint key
Error: Test timed out in 20000ms. (the case took 35,947ms)
main fails this leg the same way with a different victim each time — handle-capture.test.ts and resolve.test.ts in run 33193169019, scan.test.ts and with-two-writers.test.ts in 33193140123, every one of them Test timed out in 20000ms. Rotating victim, one shared cause: a loaded Windows runner against the 20s ceiling. Nothing here points at this diff.
No-network · Full suite — worth one look before merging
FAIL packages/plugin-sdk/test/runtime-isolation.test.ts
> what isolation costs when nothing is wrong
> costs the cold starts once, then a round trip per scan
AssertionError: isolated 8.547ms vs in-process 0.759ms over 40 interleaved samples
expected 11.257634173503442 to be less than 10
This one is not a timeout. It is the ratio gate — the assertion in this repo built specifically so a loaded runner cannot move it, and whose own header records 1.070 / 1.098 / 1.037 quiet and 1.014 / 1.046 / 1.017 under 96 CPU burners on 14 cores, "where BOTH medians roughly doubled and the quotient did not move".
11.26 is not that shape. Against the header's own figures:
| quiet | under 96 burners | this run | vs loaded | |
|---|---|---|---|---|
| in-process median | 0.171ms | 0.399ms | 0.759ms | 1.9x |
| isolated median | 0.183ms | 0.404ms | 8.547ms | 21.2x |
The denominator moved like a loaded runner. The numerator moved like something else. Load hitting one side ~2x and the other ~21x is the exact asymmetry the ratio exists to be immune to, so "loaded runner" does not explain this the way it explains the Windows leg.
Two reasons I would check rather than re-run until green:
-
It has never failed before.
MAX_ISOLATION_RATIOlanded 2026-08-18 ind19151fd. I pulled every CI failure since, on every branch: 33206747365 and 33197698662 (installer suite,install-ps1), 33193169019 and 33193140123 (Windows timeouts), 33180422918 (the realcategoryStyleprototype-guard bug). None of them is this gate. This is its first red in ~13 days, and it is on the one run that changes vitest. -
vitest 4.1.11's headline fix is a concurrency change. From the release notes in this PR's own body, first entry: "Revive global concurrency limit for test lifecycle" (vitest-dev/vitest#10992). What this gate measures is a
worker_threadsround trip running inside a vitest worker, and the leg it failed on is the one that runs all 33 turbo tasks inside a network namespace — the most contended job in the matrix. A change in how the runner schedules lifecycle concurrency is a plausible mechanism for charging a second-thread round trip more than same-thread work, which is the asymmetry in the table above. Plausible, not proven — but it is a named mechanism rather than a shrug.
Suggested: re-run just No-network. Green → one-off, and the useful takeaway is that the gate is less load-invariant on this leg than its header claims. Red again → vitest is the suspect, and pulling it out of the group so the other seven merge would confirm it in a single run.
Not blocking from my side — I would merge this once that leg is explained rather than just re-rolled.
pmontiel-git
left a comment
pmontiel-git
left a comment
There was a problem hiding this comment.
Re-checked: nothing has changed, and I tested my own vitest hypothesis — it does not hold up
Same commit (29ca1c56), same run, attempt 1. The No-network leg I asked to be re-run has not been re-run, and it still reports byte-identical numbers to the ones in my earlier comment:
AssertionError: isolated 8.547ms vs in-process 0.759ms over 40 interleaved samples
expected 11.257634173503442 to be less than 10
Identical to 15 significant figures is the same run surfaced again, not a second data point.
Correcting myself on the vitest theory
I suggested 4.1.11's "Revive global concurrency limit for test lifecycle" was a plausible mechanism. I went and tested it instead of leaving it as a suggestion, and it does not reproduce locally.
Two worktrees, one on this branch (vitest 4.1.11) and one on the base (vitest 4.1.10), running the same gate:
- Quiet, 3 runs on 4.1.11 — passed every time.
- Under 4x CPU oversubscription on 16 cores, 4.1.11 — passed. (I had to abandon the matched 4.1.10 arm; my own load generator made the comparison take longer than it was worth.)
So the named mechanism I offered is not supported by the evidence I could gather. Treat that part of my earlier comment as withdrawn — the vitest bump is still the most suspicious thing in a group that otherwise only moves version strings, but "it changed concurrency scheduling" is now a coincidence I could not turn into a reproduction, not a mechanism.
What still stands
- The bump itself is clean — 27 manifests, version strings only, exactly the 8 tabled packages, no
@types/nodemovement. Dependency auditis green andnextlands on 15.5.24, keeping #356's postcss waiver accurate.- The Windows leg is the known rotating-victim flake; ignore it.
- The ratio gate had not failed once in the ~13 days since
MAX_ISOLATION_RATIOlanded, and this is still its first red. - The asymmetry is still the interesting part and is still unexplained: the denominator moved ~1.9x versus the header's loaded figures while the numerator moved ~21x. A ratio built to be load-invariant does not do that under load alone.
Ask
Unchanged, and now cheaper than my earlier suggestion: just re-run No-network. Since I cannot reproduce it on either vitest version, a green re-run is now the likely outcome and would make this a one-off — with the honest takeaway that the gate is less load-invariant on that leg than its own header claims, which is worth a follow-up issue against the gate rather than against this PR. If it goes red a second time with different numbers, that is the real signal and pulling vitest out of the group would isolate it in one run.
Not blocking from my side. I would not merge on the current evidence, but I would merge on one green re-run.
|
@dependabot rebase |
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
2 participants
Bumps the npm-minor-patch group with 8 updates:
2.10.102.10.124.1.104.1.113.1.83.2.019.2.419.2.54.1.104.1.118.67.08.68.015.5.2315.5.240.2.60.2.7Updates
turbofrom 2.10.10 to 2.10.12Release notes
Sourced from turbo's releases.
... (truncated)
Commits
53752d4publish 2.10.12 to registry9d2b03bfix: Run pnpm directly on Windows (#13843)c97782bfeat: Require high confidence for issue fixes (#13842)f153cdachore: Alert Slack for low-confidence issues (#13841)e1674e4chore: Add automatic issue handling (#13840)7107f26fix: Escape ampersands in RSS feed enclosure URLs (#13839)a76330bchore: Handle feedback on Factory pull requests (#13836)3787c06chore: Use geistdocs 1.23.1 (#13834)bbe5406chore: Skip redundant Factory PR approval (#13837)72805d7fix: Move model selector to workspace creation (#13835)Updates
vitestfrom 4.1.10 to 4.1.11Release notes
Sourced from vitest's releases.
Commits
9bd8d46chore: release v4.1.11 (#10995)9851dbcfix(browser): trigger playwright/chromium gc on lower disk availability [back...Updates
@types/d3-shapefrom 3.1.8 to 3.2.0Commits
Updates
@types/react-domfrom 19.2.4 to 19.2.5Commits
Updates
@vitest/coverage-v8from 4.1.10 to 4.1.11Release notes
Sourced from @vitest/coverage-v8's releases.
Commits
9bd8d46chore: release v4.1.11 (#10995)Updates
typescript-eslintfrom 8.67.0 to 8.68.0Release notes
Sourced from typescript-eslint's releases.
Changelog
Sourced from typescript-eslint's changelog.
Commits
8f4e00achore(release): publish 8.68.055f6d5dchore: enable source maps (#12677)Updates
nextfrom 15.5.23 to 15.5.24Release notes
Sourced from next's releases.
Commits
b6c45b4v15.5.24b0f3460[15.5.x] Fix ISR misses with backslashes in segments when deployed on Windows409772e[15.5.x] [next/image]: disable avif image optimization9c44b88[15.x] support sharp 0.34 and 0.35144fa5d[15.5.x] Remove generated error codes (#97783)ddd94f0[15.5.x] Authenticate Turborepo remote caching with OIDC instead of a static ...1da7a0a[15.5] [ci] Use OIDC tokens to read private preview builds (#97259)70ab0fe[15.x] Default deploy e2e tests to the repo next version (#96899)e57d564v15.5.23c4914aa[15.x] Port ReplyServer traversal guards to FlightClient (#96405)Updates
@types/chromefrom 0.2.6 to 0.2.7Commits
Most Recent Ignore Conditions Applied to This Pull Request
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions