Conversation
Bumps the npm-deps group with 5 updates in the /typescript directory: | Package | From | To | | --- | --- | --- | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.5.0` | `25.5.2` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.0` | `4.1.2` | | [msw](https://github.com/mswjs/msw) | `2.12.14` | `2.13.0` | | [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.56.0` | `1.58.0` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `6.0.2` | Updates `@types/node` from 25.5.0 to 25.5.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@vitest/coverage-v8` from 4.1.0 to 4.1.2 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.2/packages/coverage-v8) Updates `msw` from 2.12.14 to 2.13.0 - [Release notes](https://github.com/mswjs/msw/releases) - [Changelog](https://github.com/mswjs/msw/blob/main/CHANGELOG.md) - [Commits](mswjs/msw@v2.12.14...v2.13.0) Updates `oxlint` from 1.56.0 to 1.58.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.58.0/npm/oxlint) Updates `typescript` from 5.9.3 to 6.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v5.9.3...v6.0.2) Updates `vitest` from 4.1.0 to 4.1.2 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.2/packages/vitest) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 25.5.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: msw dependency-version: 2.13.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: oxlint dependency-version: 1.58.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: typescript dependency-version: 6.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-deps - dependency-name: vitest dependency-version: 4.1.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-deps ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 2 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="typescript/package.json">
<violation number="1" location="typescript/package.json:58">
P2: Keep this package on TypeScript 5.x until openapi-typescript adds TS 6 support; this bump moves the generator/build toolchain outside its declared peer range.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
The Dependabot group update bumped typescript to ^6.0.2, but openapi-typescript@7.13.0 still declares peer typescript ^5.x, so npm ci fails to resolve. Revert just the typescript bump (keep the other five: @types/node, @vitest/coverage-v8, msw, oxlint, vitest) and regenerate the lockfile against 5.9.3. Add a temporary dependabot.yml ignore on typescript semver-major bumps so the same mismatch doesn't keep getting proposed. Remove the ignore once openapi-typescript ships TS 6 support (openapi-ts/openapi-typescript#2774).
There was a problem hiding this comment.
Pull request overview
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
This PR updates the TypeScript workspace’s npm dependencies/lockfile and adjusts Dependabot behavior around TypeScript majors.
Changes:
- Bumps the
typescriptdevDependency in/typescriptto^5.9.3. - Refreshes
/typescript/package-lock.jsonto newer resolved versions within existing semver ranges (e.g., vitest/msw/oxlint transitive updates). - Adds a Dependabot ignore rule to suppress TypeScript major updates for
/typescriptpending upstream peer-dep compatibility.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
typescript/package.json |
Updates the declared TypeScript devDependency version range. |
typescript/package-lock.json |
Updates resolved dependency tree versions and metadata from a new lockfile generation. |
.github/dependabot.yml |
Temporarily ignores TypeScript major updates for /typescript (TS 6). |
Files not reviewed (1)
- typescript/package-lock.json: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Node 18 reached end-of-life on 2025-04-30. Currently supported Node releases are 20 (Maintenance LTS until 2026-04-30), 22 (LTS), and 24. Lift the consumer-facing engines floor accordingly. Dev toolchain (oxlint, @inquirer/*, etc.) already requires Node 20.x or newer at the transitive level — that's fine for contributors and separate from the published SDK's runtime contract.
There was a problem hiding this comment.
1 issue found across 1 file (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="typescript/package.json">
<violation number="1" location="typescript/package.json:46">
P2: Keep this workspace on Node 18 unless the repo is intentionally dropping 18 support.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.
Files not reviewed (1)
- typescript/package-lock.json: Language not supported
Comments suppressed due to low confidence (1)
typescript/package-lock.json:25
package.jsonnow setsengines.nodeto>=20.0.0, but the lockfile’s root package metadata still records"engines": { "node": ">=18.0.0" }underpackages[""]. This inconsistency can be confusing and suggests the lockfile wasn’t fully regenerated after the engine bump. Regenerate/update the lockfile so the root package engines field matches the currentpackage.jsonengines constraint.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
jeremy
deleted the
dependabot/npm_and_yarn/typescript/npm-deps-5143fb6454
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
TypeScript bump reverted in
4b81f0a. Thetypescriptbump to6.0.2brokenpm cibecauseopenapi-typescript@7.13.0still declares peertypescript ^5.x. TypeScript stays on^5.9.3here; the other five bumps (@types/node,@vitest/coverage-v8,msw,oxlint,vitest) are retained. Dependabot major TypeScript bumps are temporarily ignored in.github/dependabot.yml— remove that rule once openapi-ts/openapi-typescript#2774 ships TS 6 support.The table below reflects Dependabot's original proposal; the
typescriptrow no longer applies.Bumps the npm-deps group with 5 updates in the /typescript directory:
25.5.025.5.24.1.04.1.22.12.142.13.01.56.01.58.05.9.36.0.2Updates
@types/nodefrom 25.5.0 to 25.5.2Commits
Updates
@vitest/coverage-v8from 4.1.0 to 4.1.2Release notes
Sourced from
@vitest/coverage-v8's releases.Commits
fc6f482chore: release v4.1.21f2d318chore: release v4.1.1aaf9f18fix(coverage): simplify provider types (#9931)Updates
mswfrom 2.12.14 to 2.13.0Release notes
Sourced from msw's releases.
Commits
e79b04fchore(release): v2.13.02b73790feat: use the network source architecture (defineNetwork) (#2650)dd5dc3dchore: ignore*.tsbuildinfofilesef56f84chore: add support for windows builds (#2651)6a8d25dtest(fallback-mode): move worker to the test (#2680)Updates
oxlintfrom 1.56.0 to 1.58.0Release notes
Sourced from oxlint's releases.
... (truncated)
Changelog
Sourced from oxlint's changelog.
... (truncated)
Commits
0384f4brelease(apps): oxlint v1.58.0 && oxfmt v0.43.0 (#20867)91f38fcchore(oxlint): bump min tsgolint version to 0.18.0 (#20800)be3dcc1docs(linter): add note about node version + custom TS plugin (#19381)16516defeat(linter): enhance types forDummyRule(#20751)8b0f61drelease(apps): oxlint v1.57.0 && oxfmt v0.42.0 (#20680)b33fbdeRevert "release(apps): oxlint v1.57.0 && oxfmt v0.42.0 (#20680)"027ce4arelease(apps): oxlint v1.57.0 && oxfmt v0.42.0 (#20680)180dd0fRevert "release(apps): oxlint v1.57.0 && oxfmt v0.42.0 (#20649)"a8f45a8release(apps): oxlint v1.57.0 && oxfmt v0.42.0 (#20649)Updates
typescriptfrom 5.9.3 to 6.0.2Release notes
Sourced from typescript's releases.
Commits
607a22aBump version to 6.0.2 and LKG9e72ab7🤖 Pick PR #63239 (Fix missing lib files in reused pro...) into release-6.0 (#...35ff23d🤖 Pick PR #63163 (Port anyFunctionType subtype fix an...) into release-6.0 (#...e175b69Bump version to 6.0.1-rc and LKGaf4caacUpdate LKG8efd7e8Merge remote-tracking branch 'origin/main' into release-6.0206ed1aDeprecate assert in import() (#63172)e688ac8Update dependencies (#63156)29b300dBump the github-actions group across 1 directory with 2 updates (#63205)0c2c7a3DOM update (#63183)Updates
vitestfrom 4.1.0 to 4.1.2Release notes
Sourced from vitest's releases.
Commits
fc6f482chore: release v4.1.26f97b55feat: disable colors if agent is detected (#9851)b3c992cfix(coverage): correctcoverageConfigDefaultsvalues and types (#9940)7c06598fix: ensure sequential mock/unmock resolution (#9830)f54abadchore: add typo-checker skill and fix typos (#9963)7aa9377fix: don't resolvesetupFilesfrom parent directory (#9960)1f2d318chore: release v4.1.1ebfde79refactor: renamematchesTagsFiltertomatchesTags(#9956)5611500feat(experimental): introduceexperimental.vcsProvider(#9928)eec53d9feat(experimental): exposematchesTagsFilterto test if the current filter ...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsSummary by cubic
Keep
typescripton 5.9.x for compatibility withopenapi-typescript, update test/lint tooling in the/typescriptworkspace, and raise the Node engines floor to >=20.Dependencies
typescript→ 5.9.3 (reverted from 6.x due toopenapi-typescriptpeer pin)vitest→ 4.1.4 and@vitest/coverage-v8→ 4.1.4 (includes flatted CVE resolution)msw→ 2.13.4 (faster handler lookup,defineNetwork)oxlint→ 1.60.0@types/node→ 25.6.0typescriptsemver-major bumps untilopenapi-typescriptsupports TS 6Migration
/typescript("engines.node": ">=20.0.0").oxlint-tsgolint, upgrade it to>=0.18.0.Written for commit aa5b8b9. Summary will update on new commits.