chore(deps): update all non-major dependencies (patch) - #2089
chore(deps): update all non-major dependencies (patch)#2089shunkakinoki wants to merge 1 commit into
Conversation
|
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
Warning Review limit reached
Next review available in: 59 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates several project dependencies across package.json, bun.lock, and pyproject.toml, including @anthropic-ai/claude-code, @github/copilot, @openai/codex, mistral-vibe, and ruff. A critical issue was identified in package.json where platform-specific suffixes were mistakenly omitted from the @openai/codex optional dependency aliases, which would cause redundant downloads of unused platform binaries and lockfile bloat.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| "@openai/codex-darwin-arm64": "npm:@openai/codex@0.144.1", | ||
| "@openai/codex-darwin-x64": "npm:@openai/codex@0.144.1", | ||
| "@openai/codex-linux-arm64": "npm:@openai/codex@0.144.1", | ||
| "@openai/codex-linux-x64": "npm:@openai/codex@0.144.1", | ||
| "@openai/codex-win32-arm64": "npm:@openai/codex@0.144.1", | ||
| "@openai/codex-win32-x64": "npm:@openai/codex@0.144.1" |
There was a problem hiding this comment.
The platform-specific suffixes (e.g., -darwin-arm64, -darwin-x64, etc.) were incorrectly removed from the @openai/codex package aliases during the dependency update. This causes each alias to resolve to the main @openai/codex package, which pulls in all optional dependencies for every platform, leading to massive lockfile bloat and redundant downloads of unused platform binaries.
Please restore the platform-specific suffixes to the package versions.
| "@openai/codex-darwin-arm64": "npm:@openai/codex@0.144.1", | |
| "@openai/codex-darwin-x64": "npm:@openai/codex@0.144.1", | |
| "@openai/codex-linux-arm64": "npm:@openai/codex@0.144.1", | |
| "@openai/codex-linux-x64": "npm:@openai/codex@0.144.1", | |
| "@openai/codex-win32-arm64": "npm:@openai/codex@0.144.1", | |
| "@openai/codex-win32-x64": "npm:@openai/codex@0.144.1" | |
| "@openai/codex-darwin-arm64": "npm:@openai/codex@0.144.1-darwin-arm64", | |
| "@openai/codex-darwin-x64": "npm:@openai/codex@0.144.1-darwin-x64", | |
| "@openai/codex-linux-arm64": "npm:@openai/codex@0.144.1-linux-arm64", | |
| "@openai/codex-linux-x64": "npm:@openai/codex@0.144.1-linux-x64", | |
| "@openai/codex-win32-arm64": "npm:@openai/codex@0.144.1-win32-arm64", | |
| "@openai/codex-win32-x64": "npm:@openai/codex@0.144.1-win32-x64" |
![mesa-dot-dev[bot]](https://avatars.githubusercontent.com/in/1050077?s=60&v=4){kind=small}
There was a problem hiding this comment.
Performed full review of 797139f...fcc82fc
Analysis
• Version resolution drift: Dependencies use caret ranges that resolve to higher-than-declared versions (@anthropic-ai/claude-code resolves to 2.1.212 despite ^2.1.206 specification), reducing predictability of deployed code versus PR intent.
• Unusual @openai/codex lockfile expansion: A simple patch version bump introduced 84 new alias-style entries with cross-package references, suggesting potential structural changes in upstream packaging or Bun resolver behavior that increases supply chain complexity and audit opacity.
• Python version constraint mismatch: Using >= constraints in pyproject.toml allows environments to install untested newer versions, diverging from locked Node.js behavior and creating reproducibility gaps.
• Lockfile determinism not verified: No evidence that the lockfile is stable under bun install --frozen-lockfile, risking non-reproducible builds across environments.
Tip
Help
Slash Commands:
/review- Request a full code review/review latest- Review only changes since the last review/describe- Generate PR description. This will update the PR body or issue comment depending on your configuration/help- Get help with Mesa commands and configuration options
0 files reviewed | 0 comments | Edit Agent Settings • Read Docs
![indent-zero[bot]](https://avatars.githubusercontent.com/in/1426746?s=60&v=4){kind=small}
Mesa DescriptionTL;DRUpdated various non-major Node.js and Python dependencies to their latest minor/patch versions. What changed?
Description generated by Mesa. Update settings |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
a556c56 to
42cbaf0
Compare
Signed-off-by:
42cbaf0 to
6967484
Compare
shunkakinoki
changed the title
Pull request was closed
2 participants
This PR contains the following updates:
>=6.2.3,<7→>=6.2.4,<7>=0.9.12→>=0.9.130.9.20(+6)>=2.19.0→>=2.19.1>=1.7.0→>=1.7.1v46.1.18→v46.1.19v46.1.20>=0.15.20→>=0.15.210.15.22>=5.13.0→>=5.13.1Release Notes
pallets-eco/croniter (croniter)
v6.2.4Compare Source
Bugfixes
fd13d2e, #240;5cd2e46, #238]Graphify-Labs/graphify (graphifyy)
v0.9.13Compare Source
Fix: the query log is now opt-in (off by default) (#1797, thanks @adam-pond-agent).
querylogwrote everyquery/path/explainquestion and corpus path (and full responses ifGRAPHIFY_QUERY_LOG_RESPONSES) to a default-on, unbounded, fail-silent plaintext file at~/.cache/graphify-queries.log— outside any repo's .gitignore/retention, and undocumented, which contradicts graphify's on-device / no-telemetry posture. Logging is now OFF unless you opt in withGRAPHIFY_QUERY_LOG_ENABLE=1(default path) orGRAPHIFY_QUERY_LOG=<path>;GRAPHIFY_QUERY_LOG_DISABLE=1still forces it off. All the query-log env vars are now documented in the README.Fix: a markdown file that went through semantic extraction is no longer duplicated into two disconnected nodes on later
graphify update(#1799, thanks @jerp86). The semantic pass mints<slug>_docwhile the markdown quick-scan mints the bare<slug>, so the file's edges split across two twins (a docs->code path query would dead-end on the bare half; centrality and communities split too).build_from_jsonnow merges the bare quick-scan node into the semantic_docnode when both share the samesource_fileand arefile_type: document, consolidating their edges/hyperedges onto one node. Gated so an unrelated code symbolfooandfoo_docnever merge.Fix: incremental
graphify updateno longer silently evicts nodes for a file that left the scan corpus but still exists on disk (#1795, thanks @CJNA)._reconcile_existing_graphread "source absent from the collected corpus" as "deleted", but that's also what an ignore-rule/filter change looks like (e.g. an upgrade that starts honoring.gitignore) — in one 27k-node graph the first rebuild after such an upgrade mass-evicted 655 nodes whose files were present the whole time. Eviction now fails closed: a corpus-absent source is only evicted whenPath(identity).exists()is False (true deletion), otherwise its nodes/edges/hyperedges are preserved and a loud line reports how many were kept and why. True deletions and renames evict as before; a fullextract --forcestill purges deliberate exclusions.Fix:
build_mergeno longer silently deletes a re-extracted file's fresh nodes when that file is also passed inprune_sources(#1796, thanks @erichkusuki). A file present innew_chunksis being replaced, not deleted, so it's now excluded from the prune set — "replace" wins over a contradictory "delete" of the same source. Previously, following the old edit-workflow (pass the changed file inprune_sources) deleted the just-built concept whenever an edit kept a node's label. Genuine deletions (a file inprune_sourcesbut notnew_chunks) still prune.Fix:
graphify pathresolves each endpoint to the first candidate whose label contains every query token, instead of blindly taking the top-scored node (#1785, thanks @CJNA)._score_nodes' full-query bonus only fires when the query equals/prefixes a label, so a query that is a token subset of the intended label ("Reject-everything judge"vs"Degenerate Reject-Everything Judge") got no bonus and a node prefix-matching one rare token could outscore it — anchoring the path on an unrelated, often disconnected node and yielding a false "No path found". When the top candidate already full-matches (the common case) the pick is unchanged. Applied to both thepathCLI and the MCP shortest-path tool; the close-runner-up ambiguity warning now fires only when the score head is what was actually picked.Fix: the report's "Suggested Questions" weakly-connected-node count now matches its "Knowledge Gaps" count (#1768, thanks @balloon72).
suggest_questions()omitted thefile_type != "rationale"filter thatreport.py's Knowledge Gaps section applies, so the sameGRAPH_REPORT.mdshowed two different numbers for the same concept (e.g. 757 vs 245), making a healthy graph look like it had a major documentation gap. Both computations now use the same filter.Fix: Bash scripts that run each other by execution now get a cross-file edge (#1756, thanks @balloon72).
extract_bashonly linkedsource x.sh/. x.sh; the two most common forms —bash x.shand./x.sh— produced no edge, so execution topology was missing. They now emit acallsedge (contextscript_invocation) to the invoked script's entry node when the target resolves to a real file on disk (script runnersbash/sh/zsh/ksh/dashand bare./x.sh), skipping missing or shadowed targets.Fix: Ruby
.rakefiles are now extracted and participate in Ruby cross-file resolution like.rb(#1784, thanks @krishnateja7)..rakeis plain Ruby but the extension was gated out of seven places (classification, extractor dispatch, the language-name/family maps, theruby_member_callsresolver's suffix set, both.rb-suffix filters inruby_resolution.py, and the build repo-tag map), so every rake task was skipped and its calls were invisible. All seven now include.rake;Widget.tallyfrom a.raketask resolves to its.rbdefinition.Fix: cross-module references to a function now resolve to its definition instead of dangling on a name-only stub (#1781, thanks @EmilNyg).
_rewire_unique_stub_nodesgated merge targets through_is_type_like_definition, which rejects any label ending in)— so function/method defs could never absorb their reference stubs, and "who references this function" returned nothing on the definition node while a sourceless stub held all the edges. Top-level function defs are now eligible rewire targets when the label match is globally unique, gated by a language-family match with the referrers (a Pythonget_dbreference can't bind to a unique Goget_db()) and excluding stubs used as a supertype (inherits/implements/extends— you don't inherit from a function). Types are unchanged.mistralai/mistral-vibe (mistral-vibe)
v2.19.1Compare Source
Added
--disabled-toolsCLI flag to turn off specific tools for a run<tools-dir>/prompts/<name>.mdAGENTS.mdfiles are now surfaced duringread_filetool callsChanged
NO_PROXYFixed
XuehaiPan/nvitop (nvitop)
v1.7.1Compare Source
Added
nvitop.collect_in_backgroundby @XuehaiPan in #218.examples/scripts so each runs directly from its URL withuv runwithout cloning the repository by @XuehaiPan in #224.Fixed
SIGSEGVat interpreter exit where theatexitnvmlShutdown()raced in-flight NVML queries from background threads by @XuehaiPan in #223. Issued by @zengchang233 in #222.renovatebot/github-action (renovatebot/github-action)
v46.1.19Compare Source
Documentation
Miscellaneous Chores
Build System
Continuous Integration
astral-sh/ruff (ruff)
v0.15.21Compare Source
Released on 2026-07-09.
Preview features
--add-ignorefor addingruff:ignorecomments (#26346)flake8-comprehensions] DropC409tuple comprehension preview behavior (#25707)pyupgrade] Lint and fix use of deprecatedabcdecorators (UP051) (#26417)Bug fixes
flake8-implicit-str-concat] FixISC003autofix incorrectly stripping+from comments (#26554)Rule changes
flake8-executable] MarkEXE004fix as unsafe (#26033)flake8-pyi] MarkPYI061fixes as unsafe in Python files (#26533)pydocstyle] Skipoverload-with-docstringin stub files (D418) (#26318)Performance
fits_elementin formatter (#26429)Formatter
--extend-excludetoruff format(#26372)Documentation
flake8-bandit] Fix misleading docstring formako-templates(S702) (#26432)ruff] Fix non-triggering example forif-key-in-dict-del(RUF051) (#26433)Contributors
huggingface/transformers (transformers)
v5.13.1: Patch release v5.13.1Compare Source
Patch release v5.13.1
This patch is focused on enabling
transformersfor the latest release of vllm!Configuration
📅 Schedule: (in timezone UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.