build(deps-dev): bump the npm-dependencies group across 1 directory with 5 updates - #70
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| "typescript": "7.0.2", | ||
| "typescript-eslint": "8.70.0" |
There was a problem hiding this comment.
🔴 Blocker [stack-default]
This bumps typescript 6.0.3 → 7.0.2 — a major version, and specifically TypeScript 7's native/Go-based rewrite (the lockfile now pulls in new optional @typescript/typescript-{win32,darwin,linux,freebsd}-* native binary packages). typescript-eslint is only bumped 8.69.0 → 8.70.0 in the same PR, and every @typescript-eslint/* sub-package still declares "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } — unchanged by this release. typescript@6.0.3 satisfied that range; typescript@7.0.2 does not.
Because .npmrc sets save-exact=true with no legacy-peer-deps/strict-peer-deps override, npm's default strict peer resolution applies, and this actually breaks npm ci outright. Confirmed directly from this PR's own CI run — Commitlint, Typecheck, Lint, and Format all fail at the install step with:
npm error ERESOLVE unable to resolve dependency tree
npm error Found: typescript@7.0.2
npm error peer typescript@">=4.8.4 <6.1.0" from typescript-eslint@8.70.0
npm error Conflicting peer dependency: typescript@6.0.3
This isn't a theoretical compatibility risk, it's a PR that cannot be installed as-is. Since the group bundles four routine minor/patch bumps with this one breaking major, the fix is to drop typescript from this update (Dependabot's own major-version separation, or an ignore rule for typescript major versions in this group) and land the other four on their own, rather than blocking all five on a typescript-eslint release that doesn't yet support TypeScript 7.
…ith 5 updates Bumps the npm-dependencies group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.1` | `26.5.1` | | [eslint](https://github.com/eslint/eslint) | `10.9.1` | `10.10.0` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.4.1` | `17.5.1` | | [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.69.0` | `8.70.0` | Updates `@types/node` from 26.4.1 to 26.5.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint` from 10.9.1 to 10.10.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.9.1...v10.10.0) Updates `lint-staged` from 17.4.1 to 17.5.1 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v17.4.1...v17.5.1) Updates `typescript` from 6.0.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v6.0.3...v7.0.2) Updates `typescript-eslint` from 8.69.0 to 8.70.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: eslint dependency-version: 10.10.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: lint-staged dependency-version: 17.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-dependencies - dependency-name: typescript-eslint dependency-version: 8.70.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
99667f0 to
cf12ddb
Compare
Superseded by re-review on the latest commit.
There was a problem hiding this comment.
Re-review on latest commit (cf12ddb)
This branch was rebased onto main and the Dependabot group picked up a couple of patch-level reshuffles (@types/node → 26.5.1, lint-staged → 17.5.1) since the last review, so I independently re-verified everything below against the current head rather than trusting the prior conclusions.
🔴 Blocker [policy] — this bump breaks npm ci
package.json bumps typescript 6.0.3 → 7.0.2 (a major version), but typescript-eslint is only bumped to 8.70.0, whose every sub-package in package-lock.json still declares "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } — unchanged from 8.69.0. .npmrc sets only save-exact=true, with no legacy-peer-deps/strict-peer-deps=false override, so npm's default strict peer resolution applies and npm ci fails outright with ERESOLVE.
Confirmed directly against this commit, not inferred from the diff alone:
- CI run
35236697825'shead_shais exactlycf12ddbe284055aa0ff96786167beb9cddcbf460(this commit). - The Typecheck (job
105254326430) and Commitlint (job105254326459) job logs both show the identicalnpm ciERESOLVEfailure at the install step. Commitlint,Typecheck,Lint,Format, and the aggregatingRequired Checksgate all showFAILUREas a direct consequence — not independent failures.
This is the same finding raised by the two prior reviews on this PR; it stands unchanged and unaddressed on this commit (the version numbers it cites — typescript/typescript-eslint — weren't touched by the rebase's patch reshuffle), so I'm not duplicating the existing inline comment on package.json:40 — see that thread for the same detail.
This isn't fixable within this diff. typescript-eslint doesn't have a released version supporting TypeScript 7 yet at group-bump time, so the real fix is upstream of this PR: either exclude/cap typescript major bumps from this Dependabot group (or split it into its own group), or wait for typescript-eslint to publish a compatible release before this group bump can land. Per this repo's own Dependabot pipeline (DEPENDABOT_AUTOMERGE_LEVELS defaults to patch,minor), a major-level bump like this is expected to not auto-merge, and CI failure here confirms that's the right outcome.
Title / description
Dependabot's standard auto-generated title and body (build(deps-dev): bump the npm-dependencies group across 1 directory with 5 updates, with per-package changelog/commit links) are accurate and complete for what this PR actually does — no correction needed.
Housekeeping
The two prior CHANGES_REQUESTED reviews from this bot on an earlier commit were superseded (bodies cleared, dismissed) as part of this re-review, since their content is fully re-stated above against the current head.
|
🗜️ Headroom context compression
|
Bumps the npm-dependencies group with 5 updates in the / directory:
26.4.126.5.110.9.110.10.017.4.117.5.16.0.37.0.28.69.08.70.0Updates
@types/nodefrom 26.4.1 to 26.5.1Commits
Updates
eslintfrom 10.9.1 to 10.10.0Release notes
Sourced from eslint's releases.
Commits
3f20a5710.10.0f4e5284Build: changelog update for 10.10.0bb47dc6fix: update dependency file-entry-cache to v11 (#20801)427ac0afix: use format strings in debug calls (#21247)b3d876bchore: disable npm audit in ecosystem tests (#21306)9d81532fix: support__proto__in/* exported */comments (#21261)264b434feat: adddandvflags tono-unexpected-multiline(#21305)1696682ci: restore EMFILE test on Node.js 26 (#21297)2c7f5d6chore: update github/codeql-action action to v4.37.9 (#21296)87e0a08fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282)Updates
lint-stagedfrom 17.4.1 to 17.5.1Release notes
Sourced from lint-staged's releases.
Changelog
Sourced from lint-staged's changelog.
Commits
f8b1ab1Merge pull request #1853 from lint-staged/changeset-release/main3b54961chore(changeset): release09317ffMerge pull request #1852 from lint-staged/fix-ambient-declarationbfcca94fix: changedefineConfigsignature fromconstto afunctiondcb59f6Merge pull request #1846 from lint-staged/changeset-release/main9c8c6dcchore(changeset): release586466fMerge pull request #1849 from lint-staged/improve-intent-to-add45eda5frefactor: improve--intent-to-adddetection26372e3Merge pull request #1848 from lint-staged/fix-color-detectiond718cccfix: honor FORCE_COLOR/NO_COLOR env variables in non-TTY streamsUpdates
typescriptfrom 6.0.3 to 7.0.2Release notes
Sourced from typescript's releases.
Commits
1e4744dMerge branch 'main' into ts7-releasea5a219cmicrosoft/typescript-go#4558ecfe30dUpdate status localization5de25b5Hide executable name in TypeScript statusd7ce74aShow bundled TypeScript version for packaged servers29be66aCorrect TS 7 release version to 7.0.2ed2bd1bMerge branch 'main' into ts7-release8873075Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...9427131Set up stable / nightly extension split, other prep (microsoft/typescript-go#...d4eaca5microsoft/typescript-go#4549Maintainer changes
This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.
Updates
typescript-eslintfrom 8.69.0 to 8.70.0Release notes
Sourced from typescript-eslint's releases.
Changelog
Sourced from typescript-eslint's changelog.
Commits
7ee7608chore(release): publish 8.70.04586535fix(eslint-plugin): [no-deprecated] report deprecated imported values used in...