Skip to content

chore(deps): batch-consolidate patch/minor/security Renovate updates - #1033

Merged
ByronDWall merged 31 commits into
mainfrom
chore/renovate-batch-consolidation
Aug 10, 2026
Merged

chore(deps): batch-consolidate patch/minor/security Renovate updates#1033
ByronDWall merged 31 commits into
mainfrom
chore/renovate-batch-consolidation

Conversation

@ByronDWall

@ByronDWall ByronDWall commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

This PR consolidates all open Renovate patch/minor/security PRs into a single branch with one commit per dependency, so they can be merged and tested together instead of as separate PRs.

Dependencies bumped

Dependency Old → New Source PR
actions/checkout (GH Action) v6.0.3 → v6.1.0 #1031
pnpm/action-setup (GH Action) v4.2.0 → v4.4.0 #1031
tsx 4.21.0 → 4.23.11 #1031
prettier / prettier-jest 3.7.4 → 3.9.6 #1031
@commercetools/platform-sdk 8.18.0 → 8.27.0 #1031
@babel/runtime 7.28.4 → 7.29.7 #1030
@babel/runtime-corejs3 7.28.4 → 7.29.7 #1030
@commercetools-frontend/babel-preset-mc-app 24.12.0 → 24.13.0 #1029
@commercetools-frontend/eslint-config-mc-app 24.12.0 → 24.13.0 #1029
@commercetools-frontend/mc-scripts 24.12.0 → 24.13.0 #1029
pnpm (packageManager) 11.10.0 → 11.20.0 #1028
squirrelly 9.1.0 → 9.1.1 #1027
@types/lodash 4.17.21 → 4.17.25 #1026
@preconstruct/cli 2.8.12 → 2.8.13 #1025
babel-plugin-module-resolver 5.0.2 → 5.0.3 #1024
dotenv 17.2.3 → 17.4.2 #1024
lodash [security] 4.17.23 → 4.18.1 #1023
@babel/core [security] 7.29.0 → 7.29.6 #1022

Each dependency above has its own commit on this branch. A commit regenerates pnpm-lock.yaml from the bumped manifests (pnpm install, which completed cleanly with no resolution conflicts).

Superseded PRs (close after this merges)

Round 2: Rate-Limited / Awaiting Schedule items (from Dependency Dashboard #93)

The Dependency Dashboard (#93) also listed 16 rate-limited items with no PR yet. These have been triaged and, where safe (patch/minor or [security]), added to this same branch as additional commits.

Newly included

Dependency Old → New Rate-limited group
jest 30.2.0 → 30.4.2 "update all jest packages" (jest, jest-fail-on-console)
jest-fail-on-console 3.3.3 → 3.3.4 "update all jest packages" (jest, jest-fail-on-console)
@types/node 24.10.9 → 24.13.3 "update all node.js updates" (@types/node, actions/setup-node)
actions/setup-node (GH Action) v6.4.0 → v6.5.0 "update all node.js updates" (@types/node, actions/setup-node)
@changesets/changelog-github 0.5.2 → 0.7.0 "update changesets" (@changesets/changelog-github, @changesets/cli)
@changesets/cli 2.29.8 → 2.31.1 "update changesets" (@changesets/changelog-github, @changesets/cli)
@faker-js/faker 10.3.0 → 10.5.0 "update dependency @faker-js/faker to v10.5.0"

A final commit regenerates pnpm-lock.yaml to cover this second round of bumps.

Excluded (major version bump, left as-is)

Dependency / group Version jump Reason
actions/checkout action v6 → v7 Major bump; excluded per major-version policy
actions/setup-node action v6.4.0 → v7.0.0 Major bump (separate rate-limited item from the v6.5.0 minor bump above); excluded per major-version policy
pnpm/action-setup action v4.2.0 → v6.0.10 Major bump (v4 → v6); excluded per major-version policy
all application-kit packages (@commercetools-frontend/application-config, @commercetools-frontend/babel-preset-mc-app, @commercetools-frontend/constants, @commercetools-frontend/eslint-config-mc-app, @commercetools-frontend/mc-scripts) 24.x → v27 Major bump (24 → 27); explicitly tagged "(major)"; excluded per major-version policy
all babel packages (major) (@babel/runtime, @babel/runtime-corejs3, babel-jest) @babel/runtime + @babel/runtime-corejs3 7.x → 8.0.0; babel-jest 29.7.0 → 30.4.1 Explicitly tagged "(major)"; genuine major jumps; excluded per major-version policy
all git workflow tools (major) (@commitlint/cli, @commitlint/config-conventional, lint-staged) @commitlint/cli 19.8.1 → 21.2.1; @commitlint/config-conventional 19.8.1 → 21.2.0; lint-staged 15.5.2 → 17.3.0 Explicitly tagged "(major)"; genuine major jumps; excluded per major-version policy
all graphql-codegen packages (major) (@graphql-codegen/add, @graphql-codegen/cli, @graphql-codegen/introspection, @graphql-codegen/typescript, @graphql-codegen/typescript-graphql-files-modules, @graphql-codegen/typescript-operations, @graphql-codegen/typescript-resolvers) 5.x/4.x/3.x → 6.x/7.x (all major jumps) Explicitly tagged "(major)"; excluded per major-version policy
all jest packages (major) (@types/jest, jest-extended, jest-watch-typeahead) @types/jest 29.5.14 → 30.0.0; jest-extended 6.0.0 → 7.0.0; jest-watch-typeahead 2.2.2 → 3.0.1 Explicitly tagged "(major)"; genuine major jumps; excluded per major-version policy
all linting packages (major) (eslint, eslint-formatter-pretty) eslint 8.57.1 → 10.8.0; eslint-formatter-pretty 5.0.0 → 7.1.0 Explicitly tagged "(major)"; genuine major jumps; excluded per major-version policy
@commercetools/platform-sdk 8.x (this branch already carries 8.27.0) → v9 Major bump; excluded per major-version policy
find-up 7.0.0 → v8.0.0 Major bump; excluded per major-version policy
lock file maintenance n/a Not a real dependency; covered by this branch's lockfile-regeneration commits

Needs manual review

None. All 16 rate-limited/awaiting-schedule items were confidently classified (7 included, 8 excluded as major, 1 "lock file maintenance" skipped as not a real dependency).

@ByronDWall
ByronDWall requested a review from a team as a code owner August 10, 2026 17:28
@changeset-bot

changeset-bot Bot commented Aug 10, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: a260ed8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@ByronDWall

Copy link
Copy Markdown
Contributor Author

Follow-up: fixed the @commercetools/platform-sdk 8.18.0 → 8.27.0 typecheck regression

The SDK bump in this batch added new required fields to several types that our hand-written fixture generators/fields-configs hadn't caught up with, so pnpm typecheck was red on CI. Pushed 5 fix commits restoring green:

  • fix(cart-discount) — added recurringOrderScope (RecurringOrderScope union: AnyOrder | ApplicableRecurrencePolicies | NonRecurringOrdersOnly | RecurringOrdersOnly), varying across all 4 variants via f.helpers.arrayElement, mirroring the existing value field's pattern.
  • fix(cart) — added purchaseOrderNumber (Cart + CartDraft, string, reusing the Order model's existing generator), freezeStrategy (new enum via oneOf, values declared manually since GraphQL doesn't expose this enum yet), lock (optional, defaults to null like sibling rarely-populated fields), warnings (optional array, defaults to []), and reservation on LineItem (optional ReservationReference, generated the same way as the sibling supplyChannel/distributionChannel reference fields).
  • fix(customer) — added customerGroupAssignments (new multi-group replacement for customerGroup), defaults to [] mirroring the existing customerGroup: null default.
  • fix(inventory-entry) — added reservationExpirationInMinutes and stockLevels to both InventoryEntry and InventoryEntryDraft REST configs, defaulting to null to match what the GraphQL configs already had.
  • fix(project) — added discounts and inventory as real nested config objects (not just null), matching the existing cdnContainerConfiguration inline-object precedent in that file.

Verified locally: pnpm typecheck clean, pnpm build succeeds, pnpm test 535/535 suites and 1691/1691 tests pass (42/42 snapshots, no snapshot updates needed), pnpm lint 2820/2820 pass. Also spot-checked generated output for each new field to confirm nested references build to real objects rather than leaking unbuilt builder proxies.

… up with platform-sdk 8.27.0 types

CartDiscount now requires recurringOrderScope (RecurringOrderScope union:
AnyOrder | ApplicableRecurrencePolicies | NonRecurringOrdersOnly |
RecurringOrdersOnly). Mirrors the existing 'value' field's arrayElement
pattern to vary across the union, building a real recurrence-policy
reference for the ApplicableRecurrencePolicies variant.
…nings, reservation generators to keep up with platform-sdk 8.27.0 types

- CartDraft/Cart: purchaseOrderNumber (string, mirrors the order model's
  existing generator pattern).
- Cart: freezeStrategy (new FreezeStrategy enum, no GraphQL equivalent yet
  so values are declared manually against the SDK type, matching the
  precedent in cart-discount-value-absolute/constants.ts), lock (optional
  CartLock, defaults to null like sibling rarely-populated fields), warnings
  (optional WarningObject[], defaults to empty array like sibling arrays).
- LineItem: reservation (optional ReservationReference), generated the same
  way as the sibling supplyChannel/distributionChannel reference fields.
… up with platform-sdk 8.27.0 types

Customer now requires customerGroupAssignments (CustomerGroupAssignment[]),
the new multi-group replacement for the single customerGroup field. Defaults
to an empty array, mirroring the existing customerGroup: null default (no
group assigned by default).
…ckLevels generators to keep up with platform-sdk 8.27.0 types

Both InventoryEntry and InventoryEntryDraft now require
reservationExpirationInMinutes and stockLevels (InventoryEntryStockLevels).
Both are optional in the SDK type and rarely populated, so the REST configs
default them to null, matching the GraphQL configs which already set the
same defaults for these fields.
…with platform-sdk 8.27.0 types

Project now requires discounts (DiscountsConfiguration) and inventory
(InventoryConfiguration), both previously optional/absent. Generated as
real nested config objects (discountCombinationMode via oneOf over the
BestDeal/Stacking enum, inventory's reservationExpirationInMinutes/
releaseExpiredReservations via faker), matching the existing
cdnContainerConfiguration inline-object precedent in this file rather than
defaulting to null.
@ByronDWall
ByronDWall force-pushed the chore/renovate-batch-consolidation branch from 6cb6490 to a260ed8 Compare August 10, 2026 19:51
@ByronDWall

Copy link
Copy Markdown
Contributor Author

Rebased this branch onto current main to resolve a merge conflict.

Cause of the conflict: main picked up #1035 ("bump pnpm to 11.17.0 and hold future updates"), which pins packageManager to pnpm@11.17.0 and adds a Renovate rule disabling further pnpm updates (11.19.0/11.20.0 have a known deploy: legacy regression, pnpm/pnpm#13618). This overlapped with this branch's own chore(deps): update pnpm to v11.20.0 commit, which bumped to the exact version main is holding back.

Resolution: skipped the now-superseded update pnpm to v11.20.0 commit during the rebase (keeping main's 11.17.0 pin and the new Renovate hold rule intact). All other commits in this batch (dependency bumps, lockfile regenerations, and the platform-sdk 8.27.0 typecheck fixes in standalone/src/models/**) applied cleanly with no further conflicts.

Verification after rebase (all passing):

  • pnpm install — clean, no lockfile drift
  • pnpm typecheck — pass
  • pnpm build — pass
  • pnpm test — 535 suites / 1691 tests passed
  • pnpm lint — 2820 suites passed

Force-pushed the rebased branch; PR now reports mergeable: MERGEABLE.

@ByronDWall
ByronDWall merged commit 681d12e into main Aug 10, 2026
5 checks passed
@ByronDWall
ByronDWall deleted the chore/renovate-batch-consolidation branch August 10, 2026 20:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants