Repository navigation
build(deps): bump taiki-e/install-action from 2.85.11 to 2.86.2 - #1900
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.85.11 to 2.86.2. - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@7f4eb89...b6b84cf) --- updated-dependencies: - dependency-name: taiki-e/install-action dependency-version: 2.86.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
plumix-marketing | ecc1cb8 | Commit Preview URL Branch Preview URL |
Aug 24 2026, 02:38 PM |
Contributor
nasyrov
added a commit
that referenced
this pull request
Aug 24, 2026
Supersedes the twelve individual Dependabot PRs (#1900-#1903, #1905-#1907, #1910-#1914) with one branch, so the shared lockfile is resolved once instead of twelve conflicting times. Also refreshes every other dependency within its declared range. Three bumps needed real migration rather than a version edit: - TanStack Table v8 -> v9: `useReactTable`/`getCoreRowModel` became `useTable` plus an explicit `tableFeatures` registry, and the public types grew a leading `TFeatures` generic. DataTable now owns that feature set and exports `DataTableColumnDef`, so callers keep naming one generic and the feature registry stays an implementation detail. Column meta moves from a global `declare module` augmentation to the per-table `columnMeta` slot. - markdown-it 15 bundles its own declarations, so `@types/markdown-it` is dropped; the instance type is now a named export separate from the callable default. - react-query 5.102 deprecated `ensureQueryData`/`fetchQuery` in favour of `query()`. Route loaders pass `staleTime: "static"` to keep the existing dedupe semantics. astro is held below 7.2.4 through an `@astrojs/markdown-satteri` cap: 7.2.4 moved to satteri 0.10 while starlight 0.41.7 (newest) still pins satteri ^0.9, and two copies break the docs typecheck. Lift the cap once starlight ships satteri 0.10 support.
nasyrov
added a commit
that referenced
this pull request
Aug 24, 2026
## Supersedes the open Dependabot PRs This PR **supersedes and replaces all twelve open Dependabot PRs**. They all touch `pnpm-lock.yaml`, so merging them one at a time means eleven rebases and eleven lockfile re-resolutions. This resolves the lockfile once. Close once this merges: | PR | Update | Landed here as | | --- | --- | --- | | #1900 | taiki-e/install-action 2.85.11 → 2.86.2 | pin + comment updated | | #1901 | changesets/action 1.9.0 → 2.1.0 | **excluded — see below** | | #1902 | turbo group (2) | `turbo`, `eslint-plugin-turbo` → ^2.10.11 | | #1903 | commitlint group (3) | ^21.2.2 | | #1905 | vite group | lockfile refresh (catalog was already `^8.2.1`) | | #1906 | tiptap group (10) | catalog → ^3.30.1 | | #1907 | tanstack group (3) | catalog; **react-table v8 → v9** | | #1910 | cloudflare group (3) | catalog | | #1911 | prettier group | lockfile refresh (identical diff to #1905) | | #1912 | lingui group (6) | **excluded — see below** | | #1913 | markdown-it 14 → 15 | + `@types/markdown-it` dropped | | #1914 | knip 6.26.0 → 6.32.2 | ^6.32.2 | Everything else was also refreshed within its declared range, so the tree is current rather than just un-blocked. ## Migrations the bumps required Three bumps needed code changes, not a version edit. ### TanStack Table v8 → v9 (#1907) v9 replaces `useReactTable` + `getCoreRowModel()` with `useTable` plus an explicit `tableFeatures` registry, and every public type grew a leading `TFeatures` generic (`ColumnDef<TData>` → `ColumnDef<TFeatures, TData, TValue>`). `DataTable` now owns that registry and exports `DataTableColumnDef<TData>`, so the three call sites keep naming a single generic and the feature set stays an implementation detail of the component. Row selection is the only feature registered; with column visibility off, cells come from `getAllCells()` — the exact counterpart of the header's `getHeaderGroups()`. Column meta moved off the global `declare module "@tanstack/react-table"` augmentation onto v9's per-table `columnMeta` slot, which scopes it to this table instead of every table in the process. Two suppressions became dead and were removed: v9's store-backed instance is React Compiler-compatible, so the `react-hooks/incompatible-library` disable no longer applies, and `data` no longer needs a `readonly` cast. ### markdown-it 14 → 15 (#1913) v15 bundles its own declarations, so `@types/markdown-it` is removed — leaving it would shadow them. The instance type is now a named export separate from the callable default, so the annotation imports `MarkdownIt as MarkdownItInstance`. The comment-rendering security posture is unchanged: `linkify: false` means none of the linkify-it v6 behavior changes apply, and the existing `javascript:`-scheme and `rel="nofollow ugc noopener"` tests still pass. ### react-query 5.102 `query()` (in-range, via #1907's group) 5.102 deprecates `ensureQueryData` and `fetchQuery` in favour of `query()`. The twelve call sites are migrated; route loaders pass `staleTime: "static"` to keep `ensureQueryData`'s dedupe semantics. `staleTime` joins the existing TanStack entries in the lingui `ignoreNames` list, since `"static"` is a sentinel and not user copy. ### changesets/action v1 → v2 (#1901) — deliberately NOT taken This is the one Dependabot PR not folded in, and the reason is worth stating. v2 is only compatible with **Changesets v3** — its README says so directly. The mechanism: v2 stopped scraping `New tag:` out of the publish script's stdout and instead reads published packages from a file named by a `CHANGESETS_OUTPUT` env var it injects. `@changesets/cli` 2.31 contains zero references to that variable, so the file is never written. The failure mode is the dangerous kind. `pnpm release` would publish to npm normally, then the action would find no output file, log a **warning** (not an error), and report `published: false` — so **no git tags and no GitHub releases**. Worse, the `Detect release work` step keys off `git rev-parse refs/tags/$name@$version`, so with tags never pushed it would return `run=true` on every subsequent merge, doing a full cold build and no-op publish each time. Entirely green, silently broken. Moving to `@changesets/cli` v3 is the supported pairing, but v3 changes how peer-dependent packages are bumped — precisely what `onlyUpdatePeerDependentsWhenOutOfRange` in `.changeset/config.json` is tuned around — plus it drops the `prettier` config option and changes private-package versioning. That is a release-pipeline design decision, not a dependency bump, so it belongs in its own PR. **#1901 should stay open.** The action stays at v1.9.0, with the constraint written into `release.yml` so the next person doesn't rediscover it the hard way. ### lingui 6.4 → 6.6 (#1912) — deliberately NOT taken Also excluded, and this one was a live runtime break rather than a latent one. 6.6.0 makes the editor unopenable: the route loader throws `Cannot destructure property 'i18n' of ... as it is null` and the screen renders "Couldn't open the editor". `useLingui()` is reading a context that was never populated. 6.6 made `@babel/core`/`@babel/types` **optional peers** of `@lingui/babel-plugin-lingui-macro`, accepting `^7.20 || ^8`. This workspace resolves both Babel majors, so pnpm builds two peer-keyed `@lingui/react` instances — two React contexts — and the code-split editor chunk gets the one whose provider never mounted. `main` resolves a single `@lingui/react@6.4.0(react@19.2.8)`; with 6.6 there are two. Taking 6.6 means collapsing the workspace onto one Babel major, which has its own blast radius. The catalog pins `>=6.4.0 <6.5.0` — a caret would drift straight back onto 6.6. **#1912 should stay open.** ## astro is capped, in two places `apps/docs` cannot take **astro 7.2.4+**, which pins `@astrojs/markdown-satteri` at exactly `0.3.7` → `satteri ^0.10`, while `@astrojs/starlight` (including 0.41.7, the newest) still pins `satteri ^0.9`. Two `satteri` copies in the tree make `astro check` fail with unrelated-identical-type errors inside starlight's own `markdown-plugins.ts`. Both constraints are required, and I verified each in isolation: - **Override alone** (`"@astrojs/markdown-satteri": ">=0.3.1 <0.3.7"`) dedupes satteri to one copy, but does **not** pin astro — pnpm overrides rewrite the dependent's range rather than constraining resolution, so astro floats to 7.2.5 with an older markdown-satteri grafted underneath it. - **astro cap alone** still resolves two satteri copies: astro 7.2.3 takes markdown-satteri as a *range*, so pnpm picks 0.3.8 → satteri 0.10. Together they land astro on **7.2.3**, whose declared `@astrojs/markdown-satteri` is exactly the `0.3.6` the override yields — a supported pairing rather than a graft, and newer than the 7.1.6 the branch had been sitting on. Lift both once starlight ships `satteri ^0.10` support. Related: `pnpm update` **silently widens these caps**. It rewrote the pre-existing `starlight >=0.41.5 <0.41.7` cap to `^0.41.7` while this branch was being prepared, and later rewrote the new astro cap to `^7.2.3`. Both were caught and restored. ## Verification Every `ci.yml` gate run locally: commitlint, lint, format, typecheck, knip, i18n check + ratchet, publint, attw, test:unit, test:build, and a cold-cache full build. All nine e2e suites pass individually. Running them concurrently contends for ports locally and is not a signal. Three of the four problems in this PR were invisible to the gates I had been running: the changesets and astro defects came from review (neither `release.yml` nor lockfile re-resolution is exercised by PR checks), and the lingui break was caught only by e2e — typecheck, lint, and unit tests were all green while the editor was unopenable.
Contributor
nasyrov
deleted the
dependabot/github_actions/taiki-e/install-action-2.86.2
branch
August 24, 2026 16:36
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps taiki-e/install-action from 2.85.11 to 2.86.2.
Release notes
Sourced from taiki-e/install-action's releases.
... (truncated)
Changelog
Sourced from taiki-e/install-action's changelog.
... (truncated)
Commits
b6b84cfRelease 2.86.2822eb9aUpdateuv@latestto 0.12.55c017c5Update prek manifestf3371b0Update osv-scanner manifestbe4eb9eUpdatemise@latestto 2026.8.6235fcbcUpdatecargo-tarpaulin@latestto 0.37.21d8477eUpdate cargo-llvm-cov manifest288e746Release 2.86.16012fb0Fix oxfmt installationb27e114Release 2.86.0Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)