Repository navigation
chore(deps): bump @launchpad-ui/core from 0.49.22 to 0.59.18 in /internal/dev_server/ui - #723
Closed
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/internal/dev_server/ui/launchpad-ui/core-0.59.17
branch
from
July 14, 2026 16:50
63f737b to
1944946
Compare
| "dependencies": { | ||
| "@launchpad-ui/components": "0.4.4", | ||
| "@launchpad-ui/core": "0.49.22", | ||
| "@launchpad-ui/core": "0.59.17", |
There was a problem hiding this comment.
Core bump drops used exports
High Severity
@launchpad-ui/core is raised to 0.59.17, which only re-exports a smaller set of packages (button, drawer, dropdown, form, menu, modal, table, and similar). The dev server UI still imports Box, Stack, Alert, CopyToClipboard, Inline, and Pagination from @launchpad-ui/core, which that release no longer provides, so a normal UI build cannot produce a working bundle after this change.
Reviewed by Cursor Bugbot for commit 1944946. Configure here.
2 of 3 tasks
cursor Bot
pushed a commit
that referenced
this pull request
Oct 6, 2026
npm audit flags each package that depends on a vulnerable package. On #723 it flagged @launchpad-ui/core only through navigation and react-router, whose advisories base has too, and the check asked about a new advisory that does not exist. The check now compares GHSA IDs. Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>
cursor Bot
pushed a commit
that referenced
this pull request
Oct 6, 2026
…old image tags - actions_analysis: evaluate defaults as github.com does. A GHES fallback (github.server_url == 'https://github.com' && X || Y) is X, so the setup-python token default is not a change (#721). The question names the workflows that use the action. - license-changes: one item per package family, which says dev-only build tools: "Accept MPL-2.0 for lightningcss 1.33.0 and 11 lightningcss-* package(s) (dev-only build tools)?" (#779). - verdict.jq: a guard regression or a failing gate already shows that a change reaches ldcli, so the missing discriminating proof is not an incomplete item (#723, #729, #779). - release-snapshot: accept a tagged release image. A conflicting PR is tested at its old head, and trees from before #629 use goreleaser-cross:v1.24.2 instead of a digest (#621). Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>
cursor Bot
pushed a commit
that referenced
this pull request
Oct 6, 2026
New fixtures: #621 (forced x/term update, not grouped, release snapshot on the old tree) and #737 (x/term named only in the Bugbot summary). The #723 fixture expects no audit question and full note coverage. The #779 fixture expects full note coverage, GHSA IDs, and the short license question. The #721 fixture expects no token default in the question. run.sh adds 12 unit tests with stub tools: bot text and <details> in pr-disclosure, forced Go updates, npm audit advisory IDs, note coverage (partial CHANGELOG, missing tag, release scan past 3 pages), the license family question, impact proof with a guard regression, and the govulncheck levels. Each one fails on the code before this change. Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>
Contributor
|
@dependabot rebase |
Bumps [@launchpad-ui/core](https://github.com/launchdarkly/launchpad-ui/tree/HEAD/packages/core) from 0.49.22 to 0.59.18. - [Release notes](https://github.com/launchdarkly/launchpad-ui/releases) - [Changelog](https://github.com/launchdarkly/launchpad-ui/blob/main/packages/core/CHANGELOG.md) - [Commits](https://github.com/launchdarkly/launchpad-ui/commits/@launchpad-ui/core@0.59.18/packages/core) --- updated-dependencies: - dependency-name: "@launchpad-ui/core" dependency-version: 0.59.17 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/internal/dev_server/ui/launchpad-ui/core-0.59.17
branch
from
October 19, 2026 20:02
1944946 to
fc0d0f4
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.
There are 3 total unresolved issues (including 1 from previous review).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit fc0d0f4. Configure here.
| "dependencies": { | ||
| "@launchpad-ui/components": "0.4.4", | ||
| "@launchpad-ui/core": "0.49.22", | ||
| "@launchpad-ui/core": "0.59.18", |
There was a problem hiding this comment.
Core requires React 19
High Severity
@launchpad-ui/core 0.59.18 and its nested packages declare react and react-dom peers as ^19, but this app still pins react and react-dom at 18.3.1. Components from the new core may fail at runtime or install with unresolved peer conflicts.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit fc0d0f4. Configure here.
| "dependencies": { | ||
| "@launchpad-ui/components": "0.4.4", | ||
| "@launchpad-ui/core": "0.49.22", | ||
| "@launchpad-ui/core": "0.59.18", |
There was a problem hiding this comment.
Token CSS lags core components
Medium Severity
New core packages depend on @launchpad-ui/tokens 0.19.0, but the app still depends on tokens 0.11.3 and imports that older CSS. Core components can resolve variables that the loaded stylesheet does not define, so layout and theme styles can break.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit fc0d0f4. Configure here.
Dependency verification: BLOCKRisk tier high (peer-deps, ui-design-system) · ecosystems: npm-ui · head Since the last verdict (2026-10-06, head
|
| Package | From | To | Change | Ecosystem | Tier |
|---|---|---|---|---|---|
@launchpad-ui/core |
0.49.22 | 0.59.18 | minor (0.x: breaking allowed) | npm-ui | high |
112 transitive update(s)
The verifier listed 14 core subpackages as removed. They moved under node_modules/@launchpad-ui/core/node_modules/, so this list shows their new versions.
@emotion/hash0.9.2 → ∅ (removed)@floating-ui/core1.6.0 → 1.8.0 (minor)@floating-ui/dom1.6.1 → 1.7.4 (minor)@floating-ui/utils0.2.7 → 0.2.12 (patch)@internationalized/date3.5.5 → 3.12.4 (minor)@internationalized/number3.5.3 → 3.6.9 (minor)@internationalized/string3.2.3 → 3.2.10 (patch)@launchpad-ui/alert0.9.30 → ∅ (removed)@launchpad-ui/avatar0.6.39 → ∅ (removed)@launchpad-ui/banner0.10.39 → ∅ (removed)@launchpad-ui/box0.1.18 → ∅ (removed)@launchpad-ui/button0.12.26 → 0.15.22 (major, moved under@launchpad-ui/core)@launchpad-ui/card0.2.46 → ∅ (removed)@launchpad-ui/chip0.9.39 → ∅ (removed)@launchpad-ui/clipboard0.11.46 → ∅ (removed)@launchpad-ui/collapsible0.1.70 → ∅ (removed)@launchpad-ui/columns0.1.27 → ∅ (removed)@launchpad-ui/counter0.4.21 → ∅ (removed)@launchpad-ui/data-table0.2.28 → ∅ (removed)@launchpad-ui/drawer0.5.46 → 0.9.22 (major, moved under@launchpad-ui/core)@launchpad-ui/dropdown0.6.120 → 0.10.20 (major, moved under@launchpad-ui/core)@launchpad-ui/filter0.7.31 → 0.11.21 (major, moved under@launchpad-ui/core)@launchpad-ui/focus-trap0.1.23 → 0.5.6 (major, moved under@launchpad-ui/core)@launchpad-ui/form0.11.31 → 0.15.21 (major, moved under@launchpad-ui/core)@launchpad-ui/inline0.1.27 → ∅ (removed)@launchpad-ui/inline-edit0.3.31 → ∅ (removed)@launchpad-ui/markdown0.5.24 → ∅ (removed)@launchpad-ui/menu0.13.31 → 0.16.22 (major, moved under@launchpad-ui/core)@launchpad-ui/modal0.17.46 → 0.21.22 (major, moved under@launchpad-ui/core)@launchpad-ui/navigation0.12.46 → 0.17.4 (major, moved under@launchpad-ui/core)@launchpad-ui/overlay0.3.30 → 0.6.5 (major, moved under@launchpad-ui/core)@launchpad-ui/pagination0.4.46 → ∅ (removed)@launchpad-ui/popover0.11.30 → 0.14.11 (major, moved under@launchpad-ui/core)@launchpad-ui/portal0.1.5 → 0.4.5 (major, moved under@launchpad-ui/core)@launchpad-ui/progress0.5.52 → ∅ (removed)@launchpad-ui/progress-bubbles0.7.30 → ∅ (removed)@launchpad-ui/select0.4.46 → ∅ (removed)@launchpad-ui/slider0.5.21 → ∅ (removed)@launchpad-ui/snackbar0.5.27 → ∅ (removed)@launchpad-ui/split-button0.10.31 → ∅ (removed)@launchpad-ui/stack0.1.27 → ∅ (removed)@launchpad-ui/tab-list0.5.29 → ∅ (removed)@launchpad-ui/table0.6.22 → 0.9.10 (major, moved under@launchpad-ui/core)@launchpad-ui/tag0.3.46 → ∅ (removed)@launchpad-ui/toast0.3.40 → ∅ (removed)@launchpad-ui/toggle0.7.29 → ∅ (removed)@launchpad-ui/tooltip0.9.19 → 0.12.9 (major, moved under@launchpad-ui/core)@launchpad-ui/types0.1.1 → ∅ (removed)@launchpad-ui/vars0.2.24 → ∅ (removed)@radix-ui/react-compose-refs1.1.0 → 1.1.2 (patch)@radix-ui/react-slot1.1.0 → 1.2.3 (minor)@types/dompurify3.0.5 → ∅ (removed)@types/trusted-types2.0.7 → ∅ (removed)@vanilla-extract/css1.15.5 → ∅ (removed)@vanilla-extract/dynamic2.1.0 → ∅ (removed)@vanilla-extract/private1.0.6 → ∅ (removed)@vanilla-extract/recipes0.5.5 → ∅ (removed)agent-base7.1.1 → ∅ (removed)aria-hidden∅ → 1.2.6 (added)asynckit0.4.0 → ∅ (removed)- …
What the verifier checked
| Check | Result | Summary |
|---|---|---|
| PR merges cleanly and changes only dependency files | pass | Merges cleanly into main; only dependency manifests changed |
| CI results on the PR head | FAIL | Failing on PR head fc0d0f4: ci (failure), dev-server UI (failure in 1 job(s)) |
| No dependency goes to a lower version than base | pass | No downgrades |
| Upstream release notes and diff of each direct update | pass (note) | Upstream notes cover the full range for 1 of 1 direct update(s); notes mention: breaking (1), deprecation (1), security (1). The impact review must cover them |
| Transitive dependency changes (new, removed, major, install scripts) | pass (note) | npm-ui: 25 changed (16 major), 12 added, 85 removed |
| Licenses of new and changed dependencies | pass | All 37 added or changed dependencies use a license in the policy, with no license change |
| npm ci resolves (no ERESOLVE or peer conflicts) | FAIL (passes on base) | npm ci fails with ERESOLVE peer conflict: peer react@"^19" from @launchpad-ui/core@0.59.18 |
| UI lint (eslint) | not run | npm ci failed, so eslint did not run |
| UI format (prettier --check) | not run | npm ci failed, so prettier did not run |
| UI tests (vitest) | not run | npm ci failed, so the tests did not run |
| UI builds, and the committed dist/ is current | not run | npm ci failed, so the build did not run |
| npm ls: the dependency tree is valid (peers satisfied) | not run | npm ci failed, so npm ls did not run |
| npm audit (runtime dependencies): no new advisories | pass | No new advisories (base 25, PR 5 advisories) |
| The updated UI dependencies are used | pass | All updated direct dependencies are used |
| Binary smoke test: --version, help for all commands, dev-server serves the UI and API | pass | --version, --help for 419 commands, dev-server UI and API all OK. It embeds the committed dist/, built with core 0.49.22 |
Optional checks that did not run: ui-npm-ls.
Generated checks
A generated check counts only when it fails on the old version and passes on the new one. 0 of 5 proven. All five are guards, so none of them is proof. Four pass on base and fail on the PR, and each of these failures is a block. The fifth (lint and format) passes on both sides.
| Check | Kind | Base | PR | Outcome |
|---|---|---|---|---|
The dev-server UI type-checks against the locked @launchpad-ui/core |
guard | pass | fail | REGRESSION (passes on base, fails on PR) |
vite builds the dev-server UI bundle against the locked @launchpad-ui/core |
guard | pass | fail | REGRESSION (passes on base, fails on PR) |
The dev-server UI renders against the locked @launchpad-ui/core (vitest render smoke test) |
guard | pass | fail | REGRESSION (passes on base, fails on PR) |
| The vitest environment that vitest.config.ts names (jsdom) is in the locked tree | guard | pass | fail | REGRESSION (passes on base, fails on PR) |
| UI lint (eslint) and format (prettier --check) pass in a --legacy-peer-deps install | guard | pass | pass | holds on both |
Impact review
The new head (fc0d0f4, a Dependabot rebase) locks @launchpad-ui/core 0.59.18, not 0.59.17. 0.59.18 changes only the React peer from exactly 19.2.6 to ^19 and the upstream build tooling, so the earlier blocks remain. The UI pins React 18.3.1, so npm ci still fails with ERESOLVE. Core removed all six names that the UI imports from it (Box, Stack, Inline, Alert, CopyToClipboard, Pagination), so 13 files do not type-check and the components are undefined at runtime. This run found two more breakages in the locked tree. framer-motion 12.23.22 (pinned by core's drawer, modal, and popover) resolves motion-dom 12.43.0, which no longer exports activeAnimations, so the bundle does not build and the core module does not load. jsdom leaves the tree with @launchpad-ui/markdown, so npm test cannot start. Core 0.59.18 has nothing that the UI still uses.
@launchpad-ui/core0.49.22..0.59.18: 0.50.0 to 0.56.0 remove most component packages from core: 0.52.0 pagination, 0.53.0 clipboard, 0.54.0 markdown, 0.55.0 alert, inline, and stack, 0.56.0 inline-edit and Box. 0.57.0 changes the react and react-dom peers from ^18 || ^19 to exactly 19.1.0, and later versions pin 19.2.6. 0.59.17 upgrades react-aria-components to 1.17.0. 0.59.18 changes the react and react-dom peers from exactly 19.2.6 to ^19 and replaces the upstream build plugin. It changes no public API. The security note (0.56.1) is a React Router update inside core's navigation package, which the UI does not use. The UI imports react-router 7.18.2 directly. (breaking) (source)- Used in:
internal/dev_server/ui/src/App.tsx,internal/dev_server/ui/src/ContextEditor.tsx,internal/dev_server/ui/src/DebugSessionEventsPage.tsx,internal/dev_server/ui/src/DebugSessionsPage.tsx,internal/dev_server/ui/src/EnvironmentSelector.tsx,internal/dev_server/ui/src/EventsTable.tsx,internal/dev_server/ui/src/Flag.tsx,internal/dev_server/ui/src/Flags.tsx,internal/dev_server/ui/src/FlagsPage.tsx,internal/dev_server/ui/src/ProjectEditor.tsx,internal/dev_server/ui/src/ProjectSelector.tsx,internal/dev_server/ui/src/SubmitButton.tsx,internal/dev_server/ui/src/Sync.tsx,internal/dev_server/ui/vitest.config.ts - Upstream behavior changes that reach ldcli: yes
- Note: The binary smoke test passes because it embeds the committed dist/, which was built on main with core 0.49.22. It does not exercise core 0.59.18. The generated vite build is the check for a new bundle. (logs/pr/binary-smoke.log)
- Note: npm audit (runtime dependencies) shows no new advisory. The PR removes 20 dompurify advisories, because dompurify came only through
@launchpad-ui/markdown> isomorphic-dompurify. Removing@launchpad-ui/coregives the same result. (logs/pr/ui-npm-audit.log)
Check details
pr-state
- Branch is 1 commit(s) behind
main. The checks ran on the PR merged into the currentmain.
ci-status
Workflows that PR CI must run on fc0d0f4, and their runs on that commit:
| Workflow | Event | Run | Result |
|---|---|---|---|
.github/workflows/dependency-scan.yml |
pull_request | 39315926918 2026-10-19 | pass: success |
.github/workflows/dev-server-ui.yml |
pull_request | 39315926852 2026-10-19 | FAIL: failure in 1 job(s) |
.github/workflows/go.yml |
pull_request | 39315926986 2026-10-19 | pass: success |
.github/workflows/lint-pr-title.yml |
pull_request_target | 39315969961 2026-10-19 | pass: success |
- Check
Cursor Bugbot: neutral - Check
Require additional human oversight on bot PRs: success - Check
semgrep-cloud-platform/scan: success
upstream-changes
@launchpad-ui/core0.49.22 → 0.59.18: launchdarkly/launchpad-ui, 549 commits, 300 files, notes: packages/core/CHANGELOG.md, full range, mentions: breaking (8), security (2), deprecation (1)
transitive-changes
- npm-ui (package-lock.json): 25 changed, 12 added, 85 removed
@floating-ui/core1.6.0 → 1.8.0 (minor)@floating-ui/dom1.6.1 → 1.7.4 (minor)@floating-ui/utils0.2.7 → 0.2.12 (patch)@internationalized/date3.5.5 → 3.12.4 (minor)@internationalized/number3.5.3 → 3.6.9 (minor)@internationalized/string3.2.3 → 3.2.10 (patch)@launchpad-ui/button0.12.26 → 0.15.22 (major)@launchpad-ui/core0.49.22 → 0.59.18 (major)@launchpad-ui/drawer0.5.46 → 0.9.22 (major)@launchpad-ui/dropdown0.6.120 → 0.10.20 (major)@launchpad-ui/filter0.7.31 → 0.11.21 (major)@launchpad-ui/focus-trap0.1.23 → 0.5.6 (major)@launchpad-ui/form0.11.31 → 0.15.21 (major)@launchpad-ui/menu0.13.31 → 0.16.22 (major)@launchpad-ui/modal0.17.46 → 0.21.22 (major)@launchpad-ui/navigation0.12.46 → 0.17.4 (major)@launchpad-ui/overlay0.3.30 → 0.6.5 (major)@launchpad-ui/popover0.11.30 → 0.14.11 (major)@launchpad-ui/portal0.1.5 → 0.4.5 (major)@launchpad-ui/table0.6.22 → 0.9.10 (major)@launchpad-ui/tooltip0.9.19 → 0.12.9 (major)@radix-ui/react-compose-refs1.1.0 → 1.1.2 (patch)@radix-ui/react-slot1.1.0 → 1.2.3 (minor)framer-motion11.3.0 → 12.23.22 (major)use-sync-external-store1.2.2 → 1.7.0 (minor)- added
@launchpad-ui/icons@0.26.7 - added
@launchpad-ui/tokens@0.19.0 - added
@react-aria/utils@3.34.1 - added
@react-types/shared@3.37.0 - added
aria-hidden@1.2.6 - added
classix@2.2.0 - added
motion-dom@12.43.0 - added
motion-utils@12.39.0 - added
react-aria@3.50.0 - added
react-aria@3.53.1 - added
react-stately@3.48.0 - added
react-stately@3.51.0 - removed
@emotion/hash@0.9.2 - removed
@launchpad-ui/alert@0.9.30 - removed
@launchpad-ui/avatar@0.6.39 - removed
@launchpad-ui/banner@0.10.39 - removed
@launchpad-ui/box@0.1.18 - removed
@launchpad-ui/card@0.2.46 - removed
@launchpad-ui/chip@0.9.39 - removed
@launchpad-ui/clipboard@0.11.46 - removed
@launchpad-ui/collapsible@0.1.70 - removed
@launchpad-ui/columns@0.1.27 - removed
@launchpad-ui/counter@0.4.21 - removed
@launchpad-ui/data-table@0.2.28 - removed
@launchpad-ui/inline-edit@0.3.31 - removed
@launchpad-ui/inline@0.1.27 - removed
@launchpad-ui/markdown@0.5.24 - removed
@launchpad-ui/pagination@0.4.46 - removed
@launchpad-ui/progress-bubbles@0.7.30 - removed
@launchpad-ui/progress@0.5.52 - removed
@launchpad-ui/select@0.4.46 - removed
@launchpad-ui/slider@0.5.21
license-changes
@floating-ui/core@1.8.0: MIT@floating-ui/dom@1.7.4: MIT@floating-ui/utils@0.2.12: MIT@internationalized/date@3.12.4: Apache-2.0@internationalized/number@3.6.9: Apache-2.0@internationalized/string@3.2.10: Apache-2.0@launchpad-ui/button@0.15.22: Apache-2.0@launchpad-ui/core@0.59.18: Apache-2.0@launchpad-ui/drawer@0.9.22: Apache-2.0@launchpad-ui/dropdown@0.10.20: Apache-2.0@launchpad-ui/filter@0.11.21: Apache-2.0@launchpad-ui/focus-trap@0.5.6: Apache-2.0@launchpad-ui/form@0.15.21: Apache-2.0@launchpad-ui/icons@0.26.7: Apache-2.0@launchpad-ui/menu@0.16.22: Apache-2.0@launchpad-ui/modal@0.21.22: Apache-2.0@launchpad-ui/navigation@0.17.4: Apache-2.0@launchpad-ui/overlay@0.6.5: Apache-2.0@launchpad-ui/popover@0.14.11: Apache-2.0@launchpad-ui/portal@0.4.5: Apache-2.0@launchpad-ui/table@0.9.10: Apache-2.0@launchpad-ui/tokens@0.19.0: Apache-2.0@launchpad-ui/tooltip@0.12.9: Apache-2.0@radix-ui/react-compose-refs@1.1.2: MIT@radix-ui/react-slot@1.2.3: MIT@react-aria/utils@3.34.1: Apache-2.0@react-types/shared@3.37.0: Apache-2.0aria-hidden@1.2.6: MITclassix@2.2.0: MITframer-motion@12.23.22: MITmotion-dom@12.43.0: MITmotion-utils@12.39.0: MITreact-aria@3.50.0: Apache-2.0react-aria@3.53.1: Apache-2.0react-stately@3.48.0: Apache-2.0react-stately@3.51.0: Apache-2.0use-sync-external-store@1.7.0: MIT
ui-npm-ci
- node v22.22.2, npm 10.9.7. CI uses
node-version: lts/*.
npm error code ERESOLVE
npm error Conflicting peer dependency: react@19.3.1
npm error Could not resolve dependency:
npm error ERESOLVE could not resolve
npm error Found: react@18.3.1
npm error peer react@"18.3.1" from @launchpad-ui/components@0.4.4
npm error peer react@"^19" from @launchpad-ui/core@0.59.18
npm error peer react@"^19" from @launchpad-ui/core@0.59.18
npm error While resolving: @launchpad-ui/core@0.59.18
ui-npm-audit
- Advisories resolved by this PR: GHSA-39q2-94rc-95cp (dompurify, moderate), GHSA-55q2-fjhq-7xh7 (dompurify, moderate), GHSA-6688-9rhm-gjv2 (dompurify, low), GHSA-76mc-f452-cxcm (dompurify, moderate), GHSA-c2j3-45gr-mqc4 (dompurify, low), GHSA-cj63-jhhr-wcxv (dompurify, moderate), GHSA-cjmm-f4jc-qw8r (dompurify, moderate), GHSA-cmwh-pvxp-8882 (dompurify, moderate), GHSA-crv5-9vww-q3g8 (dompurify, moderate), GHSA-gvmj-g25r-r7wr (dompurify, low), GHSA-h7mw-gpvr-xq4m (dompurify, moderate), GHSA-h8r8-wccr-v5f2 (dompurify, moderate), GHSA-hpcv-96wg-7vj8 (dompurify, moderate), GHSA-r47g-fvhr-h676 (dompurify, moderate), GHSA-rp9w-3fw7-7cwq (dompurify, moderate), GHSA-v2wj-7wpq-c8vv (dompurify, moderate), GHSA-v8jm-5vwx-cfxm (dompurify, moderate), GHSA-v9jr-rg53-9pgp (dompurify, moderate), GHSA-vxr8-fq34-vvx9 (dompurify, low), GHSA-x4vx-rjvf-j5p4 (dompurify, low)
ui-dep-usage
@launchpad-ui/coreis imported by the UI
binary-smoke
ldcli --version: ldcli version dev- dev-server served /ui/ (1160 KB) and /dev/projects (
[])
generated: ui-typechecks-with-locked-core
@launchpad-ui/core 0.59.18: tsc -b reports 30 error(s) in 13 file(s). Missing exports: Alert,Box,CopyToClipboard,Inline,Pagination,Stack
generated: ui-vite-build-with-locked-core
@launchpad-ui/core 0.59.18: vite build failed: node_modules/framer-motion/dist/es/projection/node/create-projection-node.mjs (1:133): "activeAnimations" is not exported by "node_modules/motion-dom/dist/es/index.mjs", imported by "node_modules/framer-motion/dist/es/projection/node/create-projection-node.mjs
The locked tree pairs framer-motion 12.23.22 with motion-dom 12.43.0. With motion-dom held at 12.23.28 (diagnostic only), the next vite error is: src/Flag.tsx (27:14): "Inline" is not exported by "node_modules/@launchpad-ui/core/dist/index.es.js", imported by "src/Flag.tsx".
generated: ui-render-smoke
The locked tree has no jsdom (see ui-test-environment-installed). This check linked jsdom@25.0.0 into its scratch copy only.
@launchpad-ui/core 0.59.18, names imported by src/: Alert,Box,CopyToClipboard,Inline,Pagination,Stack
Locked tree: vitest Tests no tests; the test file did not load: SyntaxError: The requested module 'motion-dom' does not provide an export named 'activeAnimations'
Diagnostic only, motion-dom held at 12.23.28: vitest Tests 3 failed (3); first error: Error: Uncaught [Error: Element type is invalid: expected a string (for built-in components) or a class/function (for composite components) but got: undefined. You likely forgot to export your compone; failed: every name that src/ imports from @launchpad-ui/core exists at runtime;renders the submit button in its loading state (Box, Inline);renders the app shell and the debug-sessions error alert (Box, Alert); undefined at runtime in @launchpad-ui/core: Alert,Box,CopyToClipboard,Inline,Pagination,Stack
generated: ui-test-environment-installed
vitest.config.ts: environment: 'jsdom'. package.json declares jsdom: no. Locked jsdom: none
generated: ui-lint-format-legacy-install
eslint (npm run lint): clean
prettier 3.8.4 --check: clean
Generated by scripts/dependency-pr/verify.sh (profile full) at 2026-10-20T03:11:19Z. The verifier does not approve or merge.
cursor Bot
pushed a commit
that referenced
this pull request
Oct 20, 2026
… ldcli PRs Bare npm scopes such as @launchpad-ui/core and @types/react-window became GitHub mentions (#723), and an upstream #258 linked to ldcli PR #258 (#621). render-comment.sh now sends its Markdown through comment_safe.py, which puts bare @-tokens and raw <...> text in backticks outside code. A bare #N in an impact review changelog entry becomes owner/repo#N, with the repository from the entry URL or the upstream-changes report. The upstream commit subjects get the same prefix. Co-authored-by: rniebla <rniebla@launchdarkly.com>
Contributor
Author
|
Superseded by #891. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/internal/dev_server/ui/launchpad-ui/core-0.59.17
branch
October 20, 2026 04:55
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps @launchpad-ui/core from 0.49.22 to 0.59.18.
Release notes
Sourced from @launchpad-ui/core's releases.
Changelog
Sourced from @launchpad-ui/core's changelog.
... (truncated)
Commits
b789eb9chore: version packages (#1977)dd83557chore: reformat repository with oxfmt (#1971)a0bb548chore: relax exact peer pins and adopt react-router 8 (#1965)551cf4cchore: version packages (#1899)9e0dbf9chore: upgrade react-aria-components to 1.17.0 and migrate to subpath imports...ad1f5a4chore: version packages (#1880)ec7d9c8chore: version packages (#1877)64ef294chore: version packages (#1866)1037a62chore: version packages (#1859)0ae55e0chore: version packages (#1855)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@launchpad-ui/coresince your current version.Note
Overview
Bumps
@launchpad-ui/corefrom0.49.22to0.59.18in the dev server UI (package.json+ lockfile only).The new core release pulls in a slimmer component set and newer transitive deps (e.g. framer-motion 12, updated Floating UI and React Aria stacks, nested LaunchPad tokens/icons versions). Several old top-level LaunchPad packages and vanilla-extract / jsdom-related trees drop out of the lockfile. The app still pins React 18.3.1 while nested core packages declare
react/react-dom^19peers—worth a quick UI smoke test after install.Reviewed by Cursor Bugbot for commit fc0d0f4. Bugbot is set up for automated code reviews on this repo. Configure here.