Repository navigation
build(deps): bump markdown-it from 14.3.0 to 15.0.0 - #1913
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [markdown-it](https://github.com/markdown-it/markdown-it) from 14.3.0 to 15.0.0. - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@14.3.0...15.0.0) --- updated-dependencies: - dependency-name: markdown-it dependency-version: 15.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
plumix-marketing | c415005 | Commit Preview URL Branch Preview URL |
Aug 24 2026, 02:58 PM |
Contributor
nasyrov
added a commit
that referenced
this pull request
Aug 24, 2026
## Supersedes the open Dependabot PRs This PR **supersedes and replaces all twelve open Dependabot PRs**. They all touch `pnpm-lock.yaml`, so merging them one at a time means eleven rebases and eleven lockfile re-resolutions. This resolves the lockfile once. Close once this merges: | PR | Update | Landed here as | | --- | --- | --- | | #1900 | taiki-e/install-action 2.85.11 → 2.86.2 | pin + comment updated | | #1901 | changesets/action 1.9.0 → 2.1.0 | **excluded — see below** | | #1902 | turbo group (2) | `turbo`, `eslint-plugin-turbo` → ^2.10.11 | | #1903 | commitlint group (3) | ^21.2.2 | | #1905 | vite group | lockfile refresh (catalog was already `^8.2.1`) | | #1906 | tiptap group (10) | catalog → ^3.30.1 | | #1907 | tanstack group (3) | catalog; **react-table v8 → v9** | | #1910 | cloudflare group (3) | catalog | | #1911 | prettier group | lockfile refresh (identical diff to #1905) | | #1912 | lingui group (6) | **excluded — see below** | | #1913 | markdown-it 14 → 15 | + `@types/markdown-it` dropped | | #1914 | knip 6.26.0 → 6.32.2 | ^6.32.2 | Everything else was also refreshed within its declared range, so the tree is current rather than just un-blocked. ## Migrations the bumps required Three bumps needed code changes, not a version edit. ### TanStack Table v8 → v9 (#1907) v9 replaces `useReactTable` + `getCoreRowModel()` with `useTable` plus an explicit `tableFeatures` registry, and every public type grew a leading `TFeatures` generic (`ColumnDef<TData>` → `ColumnDef<TFeatures, TData, TValue>`). `DataTable` now owns that registry and exports `DataTableColumnDef<TData>`, so the three call sites keep naming a single generic and the feature set stays an implementation detail of the component. Row selection is the only feature registered; with column visibility off, cells come from `getAllCells()` — the exact counterpart of the header's `getHeaderGroups()`. Column meta moved off the global `declare module "@tanstack/react-table"` augmentation onto v9's per-table `columnMeta` slot, which scopes it to this table instead of every table in the process. Two suppressions became dead and were removed: v9's store-backed instance is React Compiler-compatible, so the `react-hooks/incompatible-library` disable no longer applies, and `data` no longer needs a `readonly` cast. ### markdown-it 14 → 15 (#1913) v15 bundles its own declarations, so `@types/markdown-it` is removed — leaving it would shadow them. The instance type is now a named export separate from the callable default, so the annotation imports `MarkdownIt as MarkdownItInstance`. The comment-rendering security posture is unchanged: `linkify: false` means none of the linkify-it v6 behavior changes apply, and the existing `javascript:`-scheme and `rel="nofollow ugc noopener"` tests still pass. ### react-query 5.102 `query()` (in-range, via #1907's group) 5.102 deprecates `ensureQueryData` and `fetchQuery` in favour of `query()`. The twelve call sites are migrated; route loaders pass `staleTime: "static"` to keep `ensureQueryData`'s dedupe semantics. `staleTime` joins the existing TanStack entries in the lingui `ignoreNames` list, since `"static"` is a sentinel and not user copy. ### changesets/action v1 → v2 (#1901) — deliberately NOT taken This is the one Dependabot PR not folded in, and the reason is worth stating. v2 is only compatible with **Changesets v3** — its README says so directly. The mechanism: v2 stopped scraping `New tag:` out of the publish script's stdout and instead reads published packages from a file named by a `CHANGESETS_OUTPUT` env var it injects. `@changesets/cli` 2.31 contains zero references to that variable, so the file is never written. The failure mode is the dangerous kind. `pnpm release` would publish to npm normally, then the action would find no output file, log a **warning** (not an error), and report `published: false` — so **no git tags and no GitHub releases**. Worse, the `Detect release work` step keys off `git rev-parse refs/tags/$name@$version`, so with tags never pushed it would return `run=true` on every subsequent merge, doing a full cold build and no-op publish each time. Entirely green, silently broken. Moving to `@changesets/cli` v3 is the supported pairing, but v3 changes how peer-dependent packages are bumped — precisely what `onlyUpdatePeerDependentsWhenOutOfRange` in `.changeset/config.json` is tuned around — plus it drops the `prettier` config option and changes private-package versioning. That is a release-pipeline design decision, not a dependency bump, so it belongs in its own PR. **#1901 should stay open.** The action stays at v1.9.0, with the constraint written into `release.yml` so the next person doesn't rediscover it the hard way. ### lingui 6.4 → 6.6 (#1912) — deliberately NOT taken Also excluded, and this one was a live runtime break rather than a latent one. 6.6.0 makes the editor unopenable: the route loader throws `Cannot destructure property 'i18n' of ... as it is null` and the screen renders "Couldn't open the editor". `useLingui()` is reading a context that was never populated. 6.6 made `@babel/core`/`@babel/types` **optional peers** of `@lingui/babel-plugin-lingui-macro`, accepting `^7.20 || ^8`. This workspace resolves both Babel majors, so pnpm builds two peer-keyed `@lingui/react` instances — two React contexts — and the code-split editor chunk gets the one whose provider never mounted. `main` resolves a single `@lingui/react@6.4.0(react@19.2.8)`; with 6.6 there are two. Taking 6.6 means collapsing the workspace onto one Babel major, which has its own blast radius. The catalog pins `>=6.4.0 <6.5.0` — a caret would drift straight back onto 6.6. **#1912 should stay open.** ## astro is capped, in two places `apps/docs` cannot take **astro 7.2.4+**, which pins `@astrojs/markdown-satteri` at exactly `0.3.7` → `satteri ^0.10`, while `@astrojs/starlight` (including 0.41.7, the newest) still pins `satteri ^0.9`. Two `satteri` copies in the tree make `astro check` fail with unrelated-identical-type errors inside starlight's own `markdown-plugins.ts`. Both constraints are required, and I verified each in isolation: - **Override alone** (`"@astrojs/markdown-satteri": ">=0.3.1 <0.3.7"`) dedupes satteri to one copy, but does **not** pin astro — pnpm overrides rewrite the dependent's range rather than constraining resolution, so astro floats to 7.2.5 with an older markdown-satteri grafted underneath it. - **astro cap alone** still resolves two satteri copies: astro 7.2.3 takes markdown-satteri as a *range*, so pnpm picks 0.3.8 → satteri 0.10. Together they land astro on **7.2.3**, whose declared `@astrojs/markdown-satteri` is exactly the `0.3.6` the override yields — a supported pairing rather than a graft, and newer than the 7.1.6 the branch had been sitting on. Lift both once starlight ships `satteri ^0.10` support. Related: `pnpm update` **silently widens these caps**. It rewrote the pre-existing `starlight >=0.41.5 <0.41.7` cap to `^0.41.7` while this branch was being prepared, and later rewrote the new astro cap to `^7.2.3`. Both were caught and restored. ## Verification Every `ci.yml` gate run locally: commitlint, lint, format, typecheck, knip, i18n check + ratchet, publint, attw, test:unit, test:build, and a cold-cache full build. All nine e2e suites pass individually. Running them concurrently contends for ports locally and is not a signal. Three of the four problems in this PR were invisible to the gates I had been running: the changesets and astro defects came from review (neither `release.yml` nor lockfile re-resolution is exercised by PR checks), and the lingui break was caught only by e2e — typecheck, lint, and unit tests were all green while the editor was unopenable.
Contributor
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps markdown-it from 14.3.0 to 15.0.0.
Changelog
Sourced from markdown-it's changelog.
Commits
157b33b15..0.0 releasedf73cb76doc: rename files3bc8e2dAdd TS types2620dceUpdate contribution guidelines and issue templates7d365fedoc: migration info5c9b7ceUpdate changelog5a996d5doc: fix@exampletags displayf5083f4doc: continue restructuring & theme fixing54289c4Show inlinecodecontent in imagealttag #1142974e2d7text_joinrule fix: process imagealtcontent too (fixes lost escapes and...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)