Repository navigation
Bump the npm_and_yarn group across 2 directories with 14 updates - #2
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the npm_and_yarn group with 1 update in the /api directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Bumps the npm_and_yarn group with 11 updates in the /web directory: | Package | From | To | | --- | --- | --- | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.2.0` | | [@astrojs/netlify](https://github.com/withastro/astro/tree/HEAD/packages/integrations/netlify) | `7.0.8` | `7.0.13` | | [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `6.3.1` | `6.4.6` | | [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.55.5` | `5.55.7` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.3` | | [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder) | `1.1.4` | `1.3.0` | | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.6.0` | `5.10.1` | | [ip-address](https://github.com/beaugunderson/ip-address) | `10.1.0` | `10.2.0` | | [tar](https://github.com/isaacs/node-tar) | `7.5.13` | `7.5.20` | | [tmp](https://github.com/raszi/node-tmp) | `0.2.5` | `0.2.7` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.3.3` | `7.3.6` | Updates `vitest` from 2.1.9 to 4.1.10 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest) Updates `js-yaml` from 4.1.1 to 4.2.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.2.0) Updates `@astrojs/netlify` from 7.0.8 to 7.0.13 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/netlify/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/netlify@7.0.13/packages/integrations/netlify) Updates `astro` from 6.3.1 to 6.4.6 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@6.4.6/packages/astro) Updates `svelte` from 5.55.5 to 5.55.7 - [Release notes](https://github.com/sveltejs/svelte/releases) - [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md) - [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.55.7/packages/svelte) Updates `devalue` from 5.7.1 to 5.8.1 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.7.1...v5.8.1) Updates `fast-uri` from 3.1.0 to 3.1.3 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.3) Updates `fast-xml-builder` from 1.1.4 to 1.3.0 - [Changelog](https://github.com/NaturalIntelligence/fast-xml-builder/blob/main/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-builder@v1.1.4...v1.3.0) Updates `fast-xml-parser` from 5.6.0 to 5.10.1 - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.6.0...v5.10.1) Updates `ip-address` from 10.1.0 to 10.2.0 - [Commits](beaugunderson/ip-address@v10.1.0...v10.2.0) Updates `tar` from 7.5.13 to 7.5.20 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.13...v7.5.20) Updates `tmp` from 0.2.5 to 0.2.7 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.5...v0.2.7) Updates `uuid` from 11.1.0 to 13.0.0 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v11.1.0...v13.0.0) Updates `vite` from 7.3.3 to 7.3.6 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.6/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.6/packages/vite) --- updated-dependencies: - dependency-name: vitest dependency-version: 4.1.10 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@astrojs/netlify" dependency-version: 7.0.13 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: astro dependency-version: 6.4.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: svelte dependency-version: 5.55.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: devalue dependency-version: 5.8.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-xml-builder dependency-version: 1.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-xml-parser dependency-version: 5.10.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.20 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tmp dependency-version: 0.2.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: uuid dependency-version: 13.0.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.6 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
📝 WalkthroughWalkthroughDependency version constraints are updated in the API and web package manifests, including runtime, build, deployment adapter, and test dependencies. ChangesDependency Version Updates
Estimated code review effort: 1 (Trivial) | ~3 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
| "@types/js-yaml": "^4.0.9", | ||
| "js-yaml": "^4.1.0", | ||
| "js-yaml": "^5.2.1", |
There was a problem hiding this comment.
⚠️ Bug: api js-yaml jumps to major ^5.2.1, unlike web (4.2.0)
In api/package.json, js-yaml is bumped from ^4.1.0 to ^5.2.1 — a major version jump that is not reflected in the PR description (which lists only vitest for the /api directory) and is inconsistent with the same package in web/package.json, which moves to ^4.2.0. A major bump can introduce breaking API changes, and @types/js-yaml is left at ^4.0.9 (no 5.x types exist), so type definitions will no longer match the runtime library. Align the api js-yaml version with web (^4.2.0), or if the 5.x upgrade is intentional, update @types/js-yaml accordingly and verify all js-yaml usage against the 5.x API.
Keep api js-yaml on the 4.x line, consistent with web/package.json and the existing @types/js-yaml.:
"@types/js-yaml": "^4.0.9",
"js-yaml": "^4.2.0",
- Apply fix
Check the box to apply the fix or reply for a change | Was this helpful? React with 👍 / 👎
Code Review
|
| Auto-apply | Compact |
|
|
Was this helpful? React with 👍 / 👎 | Gitar
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@api/package.json`:
- Line 40: Regenerate api/bun.lock from the updated api/package.json so Vitest
resolves to ^4.1.10 and its compatible Vite dependency, replacing the stale
vitest@2.1.9 and vite@5.4.21 entries. Verify the resulting lockfile supports bun
install --frozen-lockfile.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 3531091e-5443-4682-a42a-dfefbfad1a89
⛔ Files ignored due to path filters (1)
web/yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (2)
api/package.jsonweb/package.json
| "prettier": "^3.8.3", | ||
| "typescript": "^5.7.2", | ||
| "vitest": "^2.1.8", | ||
| "vitest": "^4.1.10", |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -e
node --version
yarn --cwd api why vite
yarn --cwd api vitest --versionRepository: big-main/awesome-privacy
Length of output: 347
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Repo root files:\n'
git ls-files | sed -n '1,200p' | rg '^(api/package\.json|api/(pnpm-lock|yarn.lock|package-lock\.json)|\.github/workflows/|\.nvmrc|\.node-version|package\.json|yarn\.lock|pnpm-lock\.yaml)$' -n || true
printf '\napi/package.json:\n'
cat -n api/package.json
printf '\nWorkflow files:\n'
git ls-files .github/workflows | sed -n '1,200p' || trueRepository: big-main/awesome-privacy
Length of output: 2139
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'api CI workflow:\n'
cat -n .github/workflows/ci-api.yml
printf '\nRoot package files:\n'
git ls-files | rg '(^package\.json$|^bun\.lockb$|^bun\.lock$|^pnpm-lock\.yaml$|^yarn.lock$|^package-lock\.json$|^\.nvmrc$|^\.node-version$)' || true
printf '\nAny vite references:\n'
rg -n --hidden --glob '!**/node_modules/**' '\bvite\b' .Repository: big-main/awesome-privacy
Length of output: 17920
🏁 Script executed:
#!/bin/bash
set -euo pipefail
cat -n .github/workflows/ci-api.yml
printf '\n---\n'
git ls-files | rg '(^package\.json$|^bun\.lockb$|^bun\.lock$|^pnpm-lock\.yaml$|^yarn.lock$|^package-lock\.json$|^\.nvmrc$|^\.node-version$)' || true
printf '\n---\n'
rg -n --hidden --glob '!**/node_modules/**' '\bvite\b' .Repository: big-main/awesome-privacy
Length of output: 17870
🌐 Web query:
Vitest 4 requirements Node 20 Vite 6 migration documentation
💡 Result:
As of July 17, 2026, Vitest 4 has evolved its minimum requirements beyond its initial release specifications. While Vitest 4.0 was originally released requiring Node.js >= 20.0.0 and Vite >= 6.0.0 [1][2], current versions of Vitest now require Node.js >= 22.12.0 and Vite >= 6.4.0 [3][4][5]. This update was implemented to support native WebSocket functionality and align with Node.js release schedules [4]. Migration Documentation and Considerations: 1. Requirements Check: Before migrating, ensure your environment meets the current minimums (Node.js 22.12.0+ and Vite 6.4.0+) [3][4]. Running on older versions is unsupported and likely to cause errors [1]. 2. Official Migration Guide: The primary resource for upgrading is the official Vitest Migration Guide, located at https://vitest.dev/guide/migration.html [1]. It details breaking changes, such as: - Browser Mode: Provider factories are now required instead of strings (e.g., configuring providers like @vitest/browser-playwright) [6][7]. - Coverage: The coverage.all option has been removed, and the default behavior now includes only covered files in reports [7]. - Mocking: Changes to how mocks are constructed and handled [7]. - Pool Rework: Updates to environment variables and configuration options (e.g., VITEST_MAX_FORKS renamed to VITEST_MAX_WORKERS) [7]. 3. Vite 6 Migration: When moving to Vite 6, note that Vitest configures Vite to exclude the module conditional export by default, which may affect how some dependencies are resolved [8]. Consult the official Vite 6 migration documentation at https://v6.vite.dev/guide/migration for general Vite-specific breaking changes [9]. It is highly recommended to review the official changelog and migration guide specifically for the version path you are taking, as specific breaking changes may have been introduced incrementally since the initial Vitest 4.0 release [10][6].
Citations:
- 1: https://vitest.dev/guide/migration.html
- 2: Migration documentation doesn't specify Vite version required. vitest-dev/vitest#9646
- 3: https://github.com/vitest-dev/vitest/blob/main/docs/guide/index.md
- 4: feat!: require Node.js 22 and Vite 6.4 vitest-dev/vitest#10178
- 5: https://github.com/vitest-dev/vitest/releases
- 6: https://vitest.dev/blog/vitest-4
- 7: https://github.com/vitest-dev/vitest/blob/1a4705da/docs/guide/migration.md
- 8: https://v3.vitest.dev/guide/migration
- 9: https://v6.vite.dev/guide/migration
- 10: https://github.com/vitest-dev/vitest/releases/tag/v4.0.0
Sync api/bun.lock for Vitest 4. api/package.json now asks for vitest@^4.1.10, but the lockfile still resolves vitest@2.1.9 and vite@5.4.21; bun install --frozen-lockfile in API CI will fail until it’s regenerated.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@api/package.json` at line 40, Regenerate api/bun.lock from the updated
api/package.json so Vitest resolves to ^4.1.10 and its compatible Vite
dependency, replacing the stale vitest@2.1.9 and vite@5.4.21 entries. Verify the
resulting lockfile supports bun install --frozen-lockfile.
Bumps the npm_and_yarn group with 1 update in the /api directory: vitest.
Bumps the npm_and_yarn group with 11 updates in the /web directory:
4.1.14.2.07.0.87.0.136.3.16.4.65.55.55.55.73.1.03.1.31.1.41.3.05.6.05.10.110.1.010.2.07.5.137.5.200.2.50.2.77.3.37.3.6Updates
vitestfrom 2.1.9 to 4.1.10Release notes
Sourced from vitest's releases.
... (truncated)
Commits
db616d2chore: release v4.1.10 (#10718)bae52b5fix(vm): fix external module resolve error with deps optimizer query for enco...a7a61e7chore: release v4.1.9 (#10598)934b0f5fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...7fb2965fix(browser): wait for orchestrator readiness before resolving browser sessio...a518019fix: fiximportOriginalwith optimizer and query import [backport to v4] (#...e61f2ddchore: release v4.1.8e4067b3fix(browser): disable clientcdpAPI whenallowWrite/allowExec: false[ba...a09d472chore: release v4.1.7a8fd24cchore: release v4.1.6Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.
Updates
js-yamlfrom 4.1.1 to 4.2.0Changelog
Sourced from js-yaml's changelog.
Commits
590dbab4.2.0 releasedf944dc5Add package.json funding fieldf692719Changelog update9971a06Fix digits in YAML named tag handles464a5b8Fix flow scalar trailing whitespace folding, close #3071fda4f7Tests for #567, #565031ad07Stop resolving numbers with underscores as numeric scalars, #627e46d223CI config update9023feeAdd lockfile990e6f4Docs updateUpdates
@astrojs/netlifyfrom 7.0.8 to 7.0.13Release notes
Sourced from @astrojs/netlify's releases.
Changelog
Sourced from @astrojs/netlify's changelog.
Commits
19ad1b4[ci] release (#17023)1310277Harden Netlify remotePatterns regex to match canonical wildcard semantics (#1...75ae5df[ci] release (#16912)17a0fbdchore(deps): update devalue (#16900)9e6edc2fix(docs): replace last occurrences ofwithastro/adapters(#16693)c7157e6[ci] release (#16870)45b7fa9[ci] release (#16742)03b8f7fchore: update typescript to v6 (#16661)e345bcd[ci] release (#16653)04fdbb2Update pnpm to v11 (#16716)Updates
astrofrom 6.3.1 to 6.4.6Release notes
Sourced from astro's releases.
Changelog
Sourced from astro's changelog.
... (truncated)
Commits
19ad1b4[ci] release (#17023)f1baeea[ci] formatffda27bValidate origin in prerendered error page fetch against allowedDomains (#17033)0408628[ci] formatadd3df1Harden addAttribute to reject invalid attribute names (#17026)cfeb958[ci] formatb10e86efix : content collections image hmr (#16765)0b879fb[ci] release (#16972)dc45246Revert isNode workerd detection that caused Cloudflare build regression (#16997)132a879[ci] formatUpdates
sveltefrom 5.55.5 to 5.55.7Release notes
Sourced from svelte's releases.
... (truncated)
Changelog
Sourced from svelte's changelog.
... (truncated)
Commits
4d8f99aVersion Packages (#18220)0552308chore: bump devalue (#18219)e1cbbd9Merge commit from forka16ebc6Merge commit from forkd2375e2Merge commit from fork547853eMerge commit from fork55f9c85Version Packages (#18158)a10e8e4fix: keep dependencies of$state.eager/pending(alternative approach) (#1...ef4b97dfix: duplicated "of" in events.js comment (#18217)5122936fix: treat batches as a linked list (#18205)Updates
devaluefrom 5.7.1 to 5.8.1Release notes
Sourced from devalue's releases.
Changelog
Sourced from devalue's changelog.
Commits
796ea83Version Packages (#152)206ca67Merge commit from fork14933f7Version Packages (#151)c5115b0feat:stringifyAsync(#150)67dad45docs: update README to reflect serialization stability non-goal (#147)Updates
fast-urifrom 3.1.0 to 3.1.3Release notes
Sourced from fast-uri's releases.
Commits
0549fe3Bumped v3.1.32a6d357Merge commit from fork919dd8eBumped v3.1.2c65ba57fixup: linting6c86c17Merge commit from forka95158aHandle malformed fragment decoding without throwing (#171)cea547cBumped v3.1.1876ce79Merge commit from forkdcdf690ci: add lock-threads workflow (#169)c860e65build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (#167)Updates
fast-xml-builderfrom 1.1.4 to 1.3.0Changelog
Sourced from fast-xml-builder's changelog.
Commits
11829bf1.3.060774c1browser bundle740bd54update dependencyed22f021.2.19dc1fc9update release info64808e5Merge pull request #15 from spokodev/fix/multikey-comment-double-hyphene930f89Merge pull request #14 from greymoth-jp/fix/stopnode-attr-escape121d93efix: neutralize double hyphen in multi-key comment object0235eb0fix: escape quotes in stopNode attribute valuese6d7c63Update funding sources in FUNDING.ymlUpdates
fast-xml-parserfrom 5.6.0 to 5.10.1Release notes
Sourced from fast-xml-parser's releases.