Skip to content

fix(deps): update package dependencies#36

Merged
fbosch merged 6 commits intomasterfrom
fix/dependency-updates
Apr 10, 2026
Merged

fix(deps): update package dependencies#36
fbosch merged 6 commits intomasterfrom
fix/dependency-updates

Conversation

@fbosch
Copy link
Copy Markdown
Owner

@fbosch fbosch commented Apr 10, 2026

Summary

  • update direct runtime and development dependencies to current releases in package.json
  • refresh pnpm-lock.yaml to align with the updated dependency graph
  • keep TypeScript at 5.9.3 for compatibility with current project config/tooling while still updating other packages

Validation

  • pnpm typecheck
  • pnpm test

Summary by CodeRabbit

  • Chores
    • Updated development dependencies to latest versions, including Biome (v2.4.11), Bumpp, Lint-staged, and other npm packages.
    • Enhanced development workflow with additional pre-commit linting checks.
    • Refactored test formatting for improved code organization.

Copilot AI review requested due to automatic review settings April 10, 2026 07:53
@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Apr 10, 2026

Warning

Rate limit exceeded

@fbosch has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 16 minutes and 45 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 16 minutes and 45 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 67e5fe25-eae5-4171-aa0d-70cb2ac9b332

📥 Commits

Reviewing files that changed from the base of the PR and between dc2c118 and f7c6839.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (1)
  • package.json
📝 Walkthrough

Walkthrough

Updated Biome schema reference and npm dependencies to newer versions, modified git hook commands to include linting on pre-commit and added pre-push linting, simplified a guard condition in the sync command using optional chaining, and reformatted test function syntax.

Changes

Cohort / File(s) Summary
Tooling & Configuration
biome.json, package.json
Updated Biome schema from 2.3.14 to 2.4.11; bumped dependencies including @biomejs/biome, @clack/prompts, @types/node, bumpp, jiti, lint-staged, and others; pinned log-update to exact version 7.0.2; added pnpm lint to pre-commit hook and created new pre-push hook with pnpm lint.
Source Code
src/commands/sync.ts
Simplified guard condition in runNext closure from !job && !job.source to !job?.source using optional chaining.
Test Updates
tests/targets.test.js
Reformatted test invocation syntax for "applyTargetDir uses relative symlink targets on non-Windows" test; logic and assertions unchanged.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐰 Versions hop and deps take flight,
Biome shines at 2.4.11 bright!
Optional chains make code more neat,
Git hooks sync to the pre-commit beat,
Tests align in tidy rows—
Where quality grows, the codebase flows! ✨

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title 'fix(deps): update package dependencies' accurately describes the main change—updating multiple npm dependencies across package.json and related configuration files.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/dependency-updates

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new bot commented Apr 10, 2026

Open in StackBlitz

npx https://pkg.pr.new/docs-cache@36

commit: f7c6839

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6abb890852

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

package.json Outdated
Comment on lines +96 to +100
"cac": "^7.0.0",
"cli-truncate": "^6.0.0",
"execa": "^9.6.1",
"fast-glob": "^3.3.2",
"log-update": "^7.0.2",
"fast-glob": "^3.3.3",
"log-update": "^8.0.0",
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Preserve declared Node support when upgrading runtime deps

These runtime dependency bumps effectively drop compatibility below the package's declared engines.node floor: pnpm-lock.yaml now resolves cac@7.0.0 with node >=20.19.0 and both cli-truncate@6.0.0 and log-update@8.0.0 with node >=22, while package.json still claims >=18. In environments that rely on the advertised engine range (for example Node 18/20 users installing the CLI), this can cause install or runtime failures when argument parsing/output code imports these packages, so the dependency versions or declared engine range need to be aligned.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the project’s runtime/dev dependencies to newer releases and refreshes the pnpm lockfile to reflect the new dependency graph, while keeping TypeScript at 5.9.3.

Changes:

  • Bumped several direct runtime dependencies (e.g., @clack/prompts, cac, cli-truncate, log-update, fast-glob).
  • Updated dev tooling dependencies (e.g., @biomejs/biome, c8, lint-staged, size-limit, @types/node).
  • Regenerated pnpm-lock.yaml to match the updated dependency set.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File Description
package.json Updates direct dependency/version ranges for runtime and dev tooling.
pnpm-lock.yaml Refreshes the resolved dependency tree and metadata to match updated versions.
Files not reviewed (1)
  • pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

package.json Outdated
Comment on lines +95 to +100
"@clack/prompts": "^1.2.0",
"cac": "^7.0.0",
"cli-truncate": "^6.0.0",
"execa": "^9.6.1",
"fast-glob": "^3.3.2",
"log-update": "^7.0.2",
"fast-glob": "^3.3.3",
"log-update": "^8.0.0",
Copy link

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These dependency bumps introduce stricter Node.js engine requirements (e.g. cli-truncate@6 and log-update@8 require Node >=22; cac@7 / bumpp@11 require Node >=20.19). This conflicts with the repo’s declared engines.node (currently >=18) and the CI workflow that still runs on Node 18, so installs/tests will fail there. Either (a) keep Node 18 support by pinning to dependency versions that still support it, or (b) bump engines.node and update CI/release docs to match the new minimum (likely >=22).

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
package.json (1)

106-118: ⚠️ Potential issue | 🟠 Major

Update outdated development dependencies.

Two packages are not at their latest versions:

  • c8: Currently ^10.1.3, latest is 11.0.0
  • typescript: Currently ^5.9.3, latest is 6.0.2

The remaining 11 packages are current. Note that both typescript 6.0.2 and c8 11.0.0 are major version upgrades—ensure compatibility and test thoroughly after updating.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 106 - 118, Update the two outdated devDependencies
in package.json by bumping "c8" from ^10.1.3 to ^11.0.0 and "typescript" from
^5.9.3 to ^6.0.2; after changing those dependency strings, regenerate the
lockfile (npm/yarn/pnpm install) and run the test suite and typechecks to catch
breaking changes introduced by the major upgrades, and if needed adjust
TypeScript config or c8 usage in scripts (look for references to "typescript"
and "c8" in package.json scripts and any tsconfig.json settings).
🧹 Nitpick comments (1)
package.json (1)

132-133: Consider the duplication of lint execution.

The current git hook configuration runs pnpm lint multiple times:

  1. In pre-commit: runs pnpm lint explicitly
  2. In pre-commit: runs pnpm lint-staged which invokes biome check on staged files (line 137)
  3. In pre-push: runs pnpm lint again

Since lint-staged already checks staged files and pre-push runs a full lint, the explicit pnpm lint in pre-commit may be redundant. Consider whether this duplication is intentional for your workflow or if it could be streamlined.

♻️ Proposed simplification

If the intent is to lint staged files on commit and run a full lint on push:

 "simple-git-hooks": {
-  "pre-commit": "pnpm lint && pnpm lint-staged && pnpm typecheck",
+  "pre-commit": "pnpm lint-staged && pnpm typecheck",
   "pre-push": "pnpm lint"
 }
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 132 - 133, The package.json git hook scripts
duplicate lint runs: "pre-commit" currently runs both "pnpm lint" and "pnpm
lint-staged" (which calls biome check), and "pre-push" runs "pnpm lint" again;
to streamline, decide on one of two fixes and apply it in package.json: either
remove the explicit "pnpm lint" from "pre-commit" so commits only run "pnpm
lint-staged" (staged checks) and keep "pre-push": "pnpm lint" for full linting
on push, or conversely remove "pnpm lint-staged" and let "pre-commit" run the
full "pnpm lint" (and keep or adjust "pre-push"); update the "pre-commit" and/or
"pre-push" script entries accordingly to eliminate the redundant "pnpm lint"
invocation while retaining the desired staged vs full lint behavior (references:
the "pre-commit" and "pre-push" script keys, the "pnpm lint" and "pnpm
lint-staged"/"biome check" commands).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@package.json`:
- Around line 106-118: Update the two outdated devDependencies in package.json
by bumping "c8" from ^10.1.3 to ^11.0.0 and "typescript" from ^5.9.3 to ^6.0.2;
after changing those dependency strings, regenerate the lockfile (npm/yarn/pnpm
install) and run the test suite and typechecks to catch breaking changes
introduced by the major upgrades, and if needed adjust TypeScript config or c8
usage in scripts (look for references to "typescript" and "c8" in package.json
scripts and any tsconfig.json settings).

---

Nitpick comments:
In `@package.json`:
- Around line 132-133: The package.json git hook scripts duplicate lint runs:
"pre-commit" currently runs both "pnpm lint" and "pnpm lint-staged" (which calls
biome check), and "pre-push" runs "pnpm lint" again; to streamline, decide on
one of two fixes and apply it in package.json: either remove the explicit "pnpm
lint" from "pre-commit" so commits only run "pnpm lint-staged" (staged checks)
and keep "pre-push": "pnpm lint" for full linting on push, or conversely remove
"pnpm lint-staged" and let "pre-commit" run the full "pnpm lint" (and keep or
adjust "pre-push"); update the "pre-commit" and/or "pre-push" script entries
accordingly to eliminate the redundant "pnpm lint" invocation while retaining
the desired staged vs full lint behavior (references: the "pre-commit" and
"pre-push" script keys, the "pnpm lint" and "pnpm lint-staged"/"biome check"
commands).

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1287aefa-88c7-4b05-9b25-8848e68804b5

📥 Commits

Reviewing files that changed from the base of the PR and between 3d4f310 and dc2c118.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (4)
  • biome.json
  • package.json
  • src/commands/sync.ts
  • tests/targets.test.js

@fbosch fbosch merged commit 5dc2d42 into master Apr 10, 2026
16 checks passed
@fbosch fbosch deleted the fix/dependency-updates branch April 10, 2026 08:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants