Skip to content

chore(deps): bump vue-router from 4.6.4 to 5.1.0 in /src/frontend#21

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/src/frontend/vue-router-5.1.0
Closed

chore(deps): bump vue-router from 4.6.4 to 5.1.0 in /src/frontend#21
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/src/frontend/vue-router-5.1.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 4, 2026

Copy link
Copy Markdown
Contributor

Bumps vue-router from 4.6.4 to 5.1.0.

Release notes

Sourced from vue-router's releases.

v5.1.0

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

v5.0.7

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits
  • c0e3226 release: vue-router@5.1.0
  • 9ca7672 chore: fix playgroundc usage
  • 315cc09 refactor(experimental): remove defineQueryParamParser and definePathParamParser
  • 7fa42f4 docs: fix gen and dead links
  • 1b3a068 refactor: organize imports and exports add back Router
  • 665be2d docs: links update
  • 5d79bd2 chore: unused param
  • 9ccf3d1 docs: experimental
  • eee8ac6 chore: playground param parsers testing
  • 0194b85 build: build before test:types
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [vue-router](https://github.com/vuejs/router) from 4.6.4 to 5.1.0.
- [Release notes](https://github.com/vuejs/router/releases)
- [Commits](vuejs/router@v4.6.4...v5.1.0)

---
updated-dependencies:
- dependency-name: vue-router
  dependency-version: 5.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 4, 2026
@dependabot dependabot Bot requested a review from flydyk as a code owner June 4, 2026 22:24
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 4, 2026
@flydyk

flydyk commented Jun 4, 2026

Copy link
Copy Markdown
Contributor

Superseded by the consolidated dependency PR #36, which applies this bump (with any required code fixes) alongside the rest of the Dependabot batch. Closing to keep the queue to a single reviewable PR.

@flydyk flydyk closed this Jun 4, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jun 4, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/src/frontend/vue-router-5.1.0 branch June 4, 2026 23:12
flydyk added a commit that referenced this pull request Jun 5, 2026
…license) (#36)

* chore(deps): bump backend NuGet packages (MediatR held at 12.x)

Consolidates Dependabot backend PRs:
- FluentValidation + DI ext 11.11 -> 12.1.1 (#31)
- Mapster 7.4 -> 10.0.7 (#32)
- AwesomeAssertions 8.0 -> 9.4.0 (#28) — namespace moved
  FluentAssertions -> AwesomeAssertions; updated GlobalUsings
- Microsoft.NET.Test.Sdk 17.12 -> 18.6.0 (#34)
- xunit.runner.visualstudio 2.8.2 -> 3.1.5 (#35)
- coverlet.collector 6.0.2 -> 10.0.1 (#29)
- xunit 2.9.2 -> 2.9.3, Microsoft.* runtime 10.0.0 -> 10.0.8 (#27)

MediatR deliberately NOT bumped: v13+ is commercially licensed; the
project pins 12.x to stay OSS-free (see dependabot.yml ignore rule).

Verified: dotnet test -c Release -> 31 + 5 pass; no vulnerable packages.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(deps): bump frontend toolchain + runtime majors (Vite 8, Vitest 4)

Consolidates Dependabot frontend PRs:
- vite 5 -> 8.0.16 (#25, now bundles via rolldown)
- vitest 1 -> 4.1.8 (#22)
- @vitejs/plugin-vue 5 -> 6.0.7 (#23)
- vue-tsc 2 -> 3.3.3 (#20)
- typescript 5.5 -> 6.0.3 (#18)
- vue-router 4 -> 5.1.0 (#21)
- pinia 2 -> 3.0.4 (#24)
- @vue/test-utils 2.4.6 -> 2.4.11 (#17)
- jsdom 24 -> 29.1.1 (#19)

Code fixes required by the toolchain majors:
- Add src/vite-env.d.ts (/// <reference types="vite/client" />): vue-tsc 3
  / TS 6 now type-check side-effect CSS/SCSS imports in main.ts.
- OakTree.vue: wire the <svg> through a stable function ref. vue-tsc 3 no
  longer counts a string ref="svgRef" (composable-owned) as a read, and a
  dynamic :ref auto-unwraps to the element; the function form is correct.
- vite.config.ts: pin Vitest's worker pool to 'threads' (its Vitest-1
  default); Vitest 4 changed it to 'forks', which times out spawning many
  child processes.

Lockfile regenerated under Node 22 / npm 10 so platform-native rolldown
bindings (incl. linux-x64-gnu/musl for CI) resolve. MediatR-equivalent
licensing concern N/A here.

Verified on Node 22.22.3: npm run build OK; vitest 21 files / 132 tests
pass; npm audit -> 0 vulnerabilities.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* ci: codeql-action v4, pin MediatR (ignore majors), full npm audit

- codeql.yml: github/codeql-action init+analyze v3 -> v4 (#16)
- dependabot.yml: ignore MediatR semver-major bumps (v13+ is commercially
  licensed); 12.x minor/patch still flow. Closes the loop on #33.
- ci.yml: drop `--omit=dev` from the npm audit gate now that the Vite 8 /
  Vitest 4 upgrade cleared the dev-toolchain advisories (full tree is clean).
- docs/ci-cd/pr-quality-gates.md: document the full-tree audit + MediatR pin.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(deps): upgrade MediatR 12.5.0 -> 14.1.0 (community license)

A Lucky Penny Software community license was obtained, so MediatR is no
longer held at the OSS 12.x line.

- Directory.Packages.props: MediatR 14.1.0; add Microsoft.Extensions.Logging
  10.0.8 (v14's license check resolves ILoggerFactory).
- AddApplication: register AddLogging() so MediatR's license check works on a
  bare ServiceCollection (unit tests), and apply the license key when supplied.
- Program.cs: pass MediatR:LicenseKey from configuration.
- appsettings.json: document the MediatR:LicenseKey slot (blank; real key via
  user-secrets or MediatR__LicenseKey env var — never committed).
- dependabot.yml: drop the MediatR semver-major ignore (now licensed).
- Docs (runbook, design spec, CLAUDE.md): reflect MediatR 14.x + licensing.

Verified: dotnet test -c Release -> 31 + 5 pass; no vulnerable packages.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore: add UserSecretsId for MediatR license key (local dev)

Enables `dotnet user-secrets set "MediatR:LicenseKey" "<key>"` so the Lucky
Penny community license key is supplied locally without committing it. The id
is not a secret. (Also tidies the csproj formatting that `user-secrets init`
collapsed.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant