chore(deps): bump js-yaml from 4.1.1 to 4.2.0#43
Open
dependabot[bot] wants to merge 1 commit into
Open
Conversation
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.2.0. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/commits) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
📝 WalkthroughWalkthroughThis PR updates the ChangesDependency Updates
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
packages/transpiler/package.json (1)
28-28: ⚡ Quick winAdd targeted regression tests for
js-yaml4.2.0 parsing behavior.Since
transpiledepends onjsYaml.load(...), add tests for frontmatter cases affected by 4.2.0 (e.g., numeric scalars with underscores and merge-heavy YAML) to lock expected behavior before release.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/transpiler/package.json` at line 28, Add regression tests covering js-yaml 4.2.0 parsing edge cases used by our transpiler: create tests that call the transpile entrypoint (or the function that parses frontmatter) and assert the behavior of jsYaml.load(...) for numeric scalars with underscores and merge-heavy YAML documents; include inputs with underscore-containing numbers (e.g. "1_000") and YAML merge keys and assert the resulting JS values match our expected semantics, so future upgrades surface regressions. Target the test files under the transpiler package tests and reference the transpile function (or the specific frontmatter parsing function that invokes jsYaml.load) and the jsYaml.load call in your assertions. Ensure tests are deterministic and document expected behavior in the test names.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/web/package.json`:
- Line 24: The web app's package.json requests js-yaml ^4.2.0 but the app's
pnpm-lock.yaml still pins js-yaml@4.1.1; regenerate or remove the app-specific
lockfile so the lock matches the declared dependency. Update the web app's
pnpm-lock.yaml by running a fresh install (pnpm install) from the app workspace
or delete the app-level pnpm-lock.yaml to rely on the root pnpm-lock.yaml, then
commit the regenerated lockfile so js-yaml resolves to 4.2.0 in standalone
installs; ensure the package.json dependency entry ("js-yaml": "^4.2.0") and the
app lockfile are consistent.
---
Nitpick comments:
In `@packages/transpiler/package.json`:
- Line 28: Add regression tests covering js-yaml 4.2.0 parsing edge cases used
by our transpiler: create tests that call the transpile entrypoint (or the
function that parses frontmatter) and assert the behavior of jsYaml.load(...)
for numeric scalars with underscores and merge-heavy YAML documents; include
inputs with underscore-containing numbers (e.g. "1_000") and YAML merge keys and
assert the resulting JS values match our expected semantics, so future upgrades
surface regressions. Target the test files under the transpiler package tests
and reference the transpile function (or the specific frontmatter parsing
function that invokes jsYaml.load) and the jsYaml.load call in your assertions.
Ensure tests are deterministic and document expected behavior in the test names.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d465effa-fba0-4863-a580-31976d38a50a
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
apps/web/package.jsonpackages/transpiler/package.json
| "codemirror": "^6.0.2", | ||
| "idb": "^8.0.3", | ||
| "js-yaml": "^4.1.0", | ||
| "js-yaml": "^4.2.0", |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify resolved js-yaml versions across lockfiles/manifests
rg -n --glob '**/package.json' '"js-yaml"\s*:\s*"\^?4\.[0-9]+\.[0-9]+"' -C1
rg -n --glob '**/pnpm-lock.yaml' '^\s*js-yaml@' -A3 -B1Repository: OpenDevFlow/md-latex
Length of output: 1340
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect pnpm workspace config and common pnpm config for lockfile handling
ls -la
fd -t f "pnpm-workspace.yaml" -a . || true
rg -n --hidden --no-ignore-vcs "lockfile-dir" . || true
rg -n --hidden --no-ignore-vcs "pnpm-lock\.yaml" . || true
# Check root package manager scripts that might run pnpm from repo root vs from apps/web
fd -t f "package.json" . | head -n 50
rg -n '"(pnpm|corepack|npm)\s+(i|install|ci)"' package.json apps/web/package.json pnpm-workspace.yaml 2>/dev/null || true
# Inspect apps/web package.json for any install hints
if [ -f apps/web/package.json ]; then
cat -n apps/web/package.json | sed -n '1,120p'
fi
# Inspect apps/web lockfile version/resolution context quickly
if [ -f apps/web/pnpm-lock.yaml ]; then
rg -n "js-yaml@4\.1\.1:" apps/web/pnpm-lock.yaml -n -C2 || true
fiRepository: OpenDevFlow/md-latex
Length of output: 3415
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== pnpm-workspace.yaml ==="
cat pnpm-workspace.yaml
echo "=== .npmrc files (lockfile-dir / settings) ==="
fd -t f -a .npmrc -H . || true
fd -t f -a "*.npmrc" . || true
rg -n --hidden --no-ignore-vcs "lockfile-dir" .npmrc . || true
rg -n --hidden --no-ignore-vcs "(store-dir|lockfile-dir|package-manager|pnpm-lock)" .npmrc package.json . || true
echo "=== Look for pnpm install/ci commands referencing apps/web lockfile ==="
rg -n --hidden --no-ignore-vcs "pnpm\s+(i|install|ci)\b|--lockfile-dir|pnpm-lock\.yaml" .github apps package.json pnpm-workspace.yaml turbo.json README.md || true
echo "=== Check if apps/web has its own scripts invoking pnpm from inside apps/web ==="
cat -n apps/web/package.json | sed -n '1,120p'Repository: OpenDevFlow/md-latex
Length of output: 2786
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== .github/workflows/test.yml ==="
cat .github/workflows/test.yml | sed -n '1,120p'
echo "=== .github/workflows/deploy.yml ==="
cat .github/workflows/deploy.yml | sed -n '1,120p'
echo "=== .github/workflows/code-quality.yml ==="
cat .github/workflows/code-quality.yml | sed -n '1,120p'
echo "=== apps/web/README.md ==="
cat -n apps/web/README.md | sed -n '1,120p'
echo "=== README.md install instructions (root) ==="
cat -n README.md | sed -n '40,90p'Repository: OpenDevFlow/md-latex
Length of output: 8748
Stale apps/web/pnpm-lock.yaml (CI likely unaffected due to root lockfile)
apps/web/package.jsonrequestsjs-yaml^4.2.0, butapps/web/pnpm-lock.yamlstill pinsjs-yaml@4.1.1.- GitHub Actions runs
pnpm install --frozen-lockfilefrom the repo root, wherepnpm-lock.yamlalready resolvesjs-yaml@4.2.0, so the bump should apply in CI. - Regenerate
apps/web/pnpm-lock.yaml(or remove it and rely on the root lockfile) to avoid standaloneapps/webinstalls resolvingjs-yaml@4.1.1.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/web/package.json` at line 24, The web app's package.json requests
js-yaml ^4.2.0 but the app's pnpm-lock.yaml still pins js-yaml@4.1.1; regenerate
or remove the app-specific lockfile so the lock matches the declared dependency.
Update the web app's pnpm-lock.yaml by running a fresh install (pnpm install)
from the app workspace or delete the app-level pnpm-lock.yaml to rely on the
root pnpm-lock.yaml, then commit the regenerated lockfile so js-yaml resolves to
4.2.0 in standalone installs; ensure the package.json dependency entry
("js-yaml": "^4.2.0") and the app lockfile are consistent.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps js-yaml from 4.1.1 to 4.2.0.
Changelog
Sourced from js-yaml's changelog.
Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit