chore: update dependencies and add shellcheck directives by shunkakinoki · Pull Request #1755 · shunkakinoki/dotfiles

shunkakinoki · 2026-05-12T07:29:07Z

Changes

Update multiple JavaScript/TypeScript packages via bun
Update Python dependencies (vllm 0.20.0 -> 0.20.1)
Add last_pull to beads .gitignore
Add shellcheck directives to activate_roborev_spec.sh

Key Dependency Updates

@anthropic-ai/claude-code: 2.1.138 -> 2.1.139
@github/copilot: 1.0.44 -> 1.0.45
@oh-my-pi/pi-*: 14.9.3 -> 14.9.5
chrome-devtools-mcp: 0.25.0 -> 0.26.0
playwright-chromium: 1.59.1 -> 1.60.0
oxlint: 1.63.0 -> 1.64.0
vllm (Python): 0.20.0 -> 0.20.1

Testing

All dependency locks updated
Shellcheck compliance added to spec script

Generated with Claude Code by Claude 4.7

Summary by cubic

Updates JS/TS and Python dependencies to keep tooling current, and adds ShellCheck directives to the roborev activation spec. Also ignores the last_pull state file in .beads.

Dependencies
- @anthropic-ai/claude-code 2.1.138 → 2.1.139
- @github/copilot 1.0.44 → 1.0.45; @oh-my-pi/pi-* 14.9.3 → 14.9.5
- playwright-chromium 1.59.1 → 1.60.0; chrome-devtools-mcp 0.25.0 → 0.26.0
- oxlint 1.63.0 → 1.64.0; oxfmt 0.48.0 → 0.49.0
- Python vllm 0.20.0 → 0.20.1
Refactors
- Add # shellcheck shell=bash and disable SC2016 in spec/activate_roborev_spec.sh.
- Add last_pull to .beads/.gitignore.

^{Written for commit 5eb787a. Summary will update on new commits.}

Update multiple JavaScript/TypeScript packages via bun and Python dependencies via uv. Key updates: - @anthropic-ai/claude-code: 2.1.138 -> 2.1.139 - @github/copilot: 1.0.44 -> 1.0.45 - @oh-my-pi/pi-*: 14.9.3 -> 14.9.5 - chrome-devtools-mcp: 0.25.0 -> 0.26.0 - playwright-chromium: 1.59.1 -> 1.60.0 - oxlint: 1.63.0 -> 1.64.0 - vllm (Python): 0.20.0 -> 0.20.1 Also: - Add last_pull to beads .gitignore - Add shellcheck directives to activate_roborev_spec.sh Co-Authored-By: Claude 4.7 <noreply@example.com>

indent-zero · 2026-05-12T07:29:11Z

PR Summary

Routine dependency-maintenance PR that bumps multiple JS/TS CLI tools via Bun and one Python package via uv to pull in latest patch/minor releases. Also lands two small auxiliary tweaks: a beads runtime ignore entry and shellcheck directives on the roborev spec.

JS/TS bumps in package.json (and matching bun.lock regeneration): @anthropic-ai/claude-code 2.1.138→2.1.139, @github/copilot 1.0.44→1.0.45, @oh-my-pi/pi-coding-agent & pi-natives 14.9.3→14.9.5, @sourcegraph/amp, @traces-sh/traces 0.5.6→0.5.7, @upstash/context7-mcp 2.2.4→2.2.5, chrome-devtools-mcp 0.25.0→0.26.0, droid 0.122.0→0.123.0 (with all @factory/cli-* variants), oxfmt 0.48.0→0.49.0, oxlint 1.63.0→1.64.0, playwright-chromium 1.59.1→1.60.0.
Python: vllm floor raised from >=0.20.0 to >=0.20.1 in pyproject.toml.
flake.lock: standard lastModified/narHash/rev rotations on devenv, home-manager, neovim-nightly-overlay, neovim-src, nixpkgs-nightly, nixpkgs-unstable, rust-overlay (no input source changes).
.beads/.gitignore: add last_pull to the runtime-files block.
spec/activate_roborev_spec.sh: add file-level # shellcheck shell=bash and a scoped # shellcheck disable=SC2016 before the literal '"${./activate.sh}" "${dataDir}"' assertion.
Lockfile sync: bun.lock's trustedDependencies gains deepsec, which was already trusted in package.json on main — no new install-script authorization.

Issues

No issues found.

CI Checks

Waiting for CI checks...

coderabbitai · 2026-05-12T07:29:26Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ada8a388-6452-4816-9bd4-4e078dec0ab7

📥 Commits

Reviewing files that changed from the base of the PR and between 1936965 and 5eb787a.

⛔ Files ignored due to path filters (2)

bun.lock is excluded by !**/*.lock
flake.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

.beads/.gitignore
package.json
pyproject.toml
spec/activate_roborev_spec.sh

📝 Walkthrough

Summary by CodeRabbit

Chores
- Updated package dependencies across the Node.js ecosystem including development tools and testing frameworks to latest stable versions
- Updated Python development tool version requirements
- Improved local configuration management by updating ignore patterns
Tests
- Enhanced test specifications with improved code quality and linting directives

Walkthrough

This PR updates package dependencies across Node.js and Python environments, adds a runtime file to gitignore, and applies ShellCheck linting directives to a test script. All changes are maintenance-focused without functional code modifications.

Changes

Dependency and Configuration Maintenance

Layer / File(s)	Summary
Node.js dependency version updates `package.json`	`@anthropic-ai/claude-code` is bumped from `^2.1.138` to `^2.1.139`, and multiple dependencies (`@oh-my-pi/pi-coding-agent`, `@oh-my-pi/pi-natives`, `@sourcegraph/amp`, `@traces-sh/traces`, `@upstash/context7-mcp`, `chrome-devtools-mcp`, `droid`, `oxfmt`, `oxlint`, `playwright-chromium`) receive version updates.
Python tool dependency update `pyproject.toml`	The `vllm` minimum version requirement in `dependency-groups.tools` is updated from `>=0.20.0` to `>=0.20.1`.
Development environment configuration `.beads/.gitignore`, `spec/activate_roborev_spec.sh`	The `last_pull` file is added to `.gitignore` to exclude local runtime files from version control. ShellCheck directives are added to the spec script: a `bash` language header and an `SC2016` rule disable annotation for shell linting compliance.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

shunkakinoki/dotfiles#1751: Adds ShellCheck directives to spec/activate_roborev_spec.sh, same file modified here
shunkakinoki/dotfiles#1595: Updates overlapping package.json dependencies (@oh-my-pi/*, @sourcegraph/amp, @traces-sh/traces)
shunkakinoki/dotfiles#1465: Updates pyproject.toml vllm dependency requirement

Suggested labels

dependencies

🐰 Bumping bits with the spring in my hop,
Dependencies dance through the version update crop,
Last_pull tucks away in the gitignore keep,
ShellCheck tweaks ensure the specs run clean and deep! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and accurately summarizes the main changes: dependency updates and addition of shellcheck directives.
Description check	✅ Passed	The description is well-detailed and directly related to the changeset, covering all modifications including dependency updates and configuration changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch shunkakinoki/chore/update-dependencies-2

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist

Code Review

This pull request primarily focuses on dependency management, updating numerous packages across package.json, bun.lock, flake.lock, and pyproject.toml. Key updates include Claude Code, Copilot, OMP, Oxlint, and Playwright. It also introduces minor configuration changes, such as adding last_pull to .gitignore and ShellCheck directives to test scripts. Feedback focuses on the security implications of adding deepsec to trustedDependencies in the lockfile and a version mismatch between Playwright components that could cause runtime or CI issues.

gemini-code-assist · 2026-05-12T07:31:26Z

    "@ccusage/codex",
    "openclaw",
    "clawdhub",
+    "deepsec",


Adding deepsec to trustedDependencies allows the package to execute arbitrary lifecycle scripts (like postinstall) during installation. This is a security-sensitive configuration change that was not explicitly mentioned in the PR description, especially since deepsec was already a dependency without this privilege. Unless deepsec strictly requires these scripts to function (e.g., for compiling native bindings), it is recommended to keep the trusted list as minimal as possible to reduce the attack surface. Additionally, ensure this change is synchronized with the trustedDependencies field in package.json.

gemini-code-assist · 2026-05-12T07:31:26Z

-    "playwright-chromium": ["playwright-chromium@1.59.1", "", { "dependencies": { "playwright-core": "1.59.1" }, "bin": { "playwright": "cli.js" } }, "sha512-aTsPenkxsr9np4vIHuMEND6comqepVvzbL0MwkozFNliwGZjTqrBUQ7TF6Ay1ZIU/e7rcUpGsCTUG+nqwxG2Xw=="],
+    "playwright-chromium": ["playwright-chromium@1.60.0", "", { "dependencies": { "playwright-core": "1.60.0" }, "bin": { "playwright": "cli.js" } }, "sha512-xxz9pc2HIxQW/Qg9ijG2fZOHRT//KhLo0KfvJRa45YYRrcA7ZONoilgJR40SW5pmecb6HkuROaeViXoCaXTZyQ=="],

    "playwright-core": ["playwright-core@1.59.1", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-HBV/RJg81z5BiiZ9yPzIiClYV/QMsDCKUyogwH9p3MCP6IYjUFu/MActgYAvK0oWyV9NlwM3GLBjADyWgydVyg=="],


The top-level playwright-core version (1.59.1) is out of sync with the version required by playwright-chromium (1.60.0). Playwright requires the library and its core driver to have matching versions to ensure compatibility with browser binaries. Having multiple versions of playwright-core in the lockfile (as seen by the addition of the nested playwright-chromium/playwright-core entry in this PR) can lead to issues where the wrong browser version is used or installation fails in CI. Consider updating all Playwright-related dependencies to 1.60.0 to ensure a single, consistent version is used across the project.

cubic-dev-ai

No issues found across 6 files

gemini-code-assist Bot reviewed May 12, 2026

View reviewed changes

cubic-dev-ai Bot reviewed May 12, 2026

View reviewed changes

shunkakinoki merged commit f1fc709 into main May 12, 2026
36 checks passed

shunkakinoki deleted the shunkakinoki/chore/update-dependencies-2 branch May 12, 2026 07:49

Navigation Menu

chore: update dependencies and add shellcheck directives - #1755

chore: update dependencies and add shellcheck directives#1755
shunkakinoki merged 1 commit into
mainfrom
shunkakinoki/chore/update-dependencies-2

shunkakinoki commented May 12, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

indent-zero Bot commented May 12, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented May 12, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot May 12, 2026

Uh oh!

gemini-code-assist Bot May 12, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

shunkakinoki commented May 12, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Key Dependency Updates

Testing

Summary by cubic

Uh oh!

indent-zero Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot May 12, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 12, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

shunkakinoki commented May 12, 2026 •

edited by cubic-dev-ai Bot

Loading

indent-zero Bot commented May 12, 2026 •

edited

Loading

coderabbitai Bot commented May 12, 2026 •

edited

Loading