chore(deps): bump five npm packages in one branch - #53
Merged
Merged
Conversation
- dependabot opened #51 and #52 for the same week's updates, and both rewrite package.json and the lockfile; merging them one at a time costs a rebase round and a second CI run for one green tree - every version is pinned to what dependabot resolved, so this branch is the two PRs applied together and not a re-resolution: the only other lockfile change is oxlint's platform bindings following 1.81.0 - lucide-react is the sole runtime bump; the rest are types and toolchain, and shadcn is a CLI that never enters the bundle Co-Authored-By: htjulia <htjulia1@gmail.com>
This was referenced Sep 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidates this week's two dependabot PRs into one branch, so the tree is
reviewed and merged once instead of twice.
Closes #51
Closes #52
What moves
lucide-react@types/node@vitejs/plugin-reactoxlintshadcnWhy one branch
Both PRs rewrite
package.jsonandpackage-lock.json. Merging them one at atime makes the second wait for a dependabot rebase and a second CI run to reach
the same tree, and leaves two commits in the history for one week of updates.
The lockfile is dependabot's, not a re-resolution
The two dependabot branches merge onto
mainwith no conflict, and the resultwas installed with
npm ci— nonpm install, so nothing was re-resolvedinside the semver ranges. Every one of the five packages is pinned to exactly
the version dependabot picked. Comparing the whole lockfile against
main, theonly other changes are oxlint's 19 platform binding packages following it to
1.81.0; nothing else changed, and nothing was added or removed.
Verification
On the merged tree, the full local gate:
npm run lint— exit 0, 7 warnings, all the pre-existingonly-export-componentsones. oxlint 1.81.0 reports no new diagnostic; itsbreaking change (react-compiler rules split per category) landed in 1.79.0,
which this repo is already past.
npm run build—tsc -bclean, 481.11 kB / 152.58 kB gzip. This is whatclears
lucide-react: all 22 icons imported across 13 files still resolve,so the minor brought no removal or rename.
npm test— 15 files, 152 tests, all passing.@vitejs/plugin-react6.1.1 makes recoverable React Compiler diagnosticsopt-in behind
compiler.logDiagnostics;vite.config.tsdoes not set thatoption, so the change is inert here.
Known audit finding, unchanged
npm auditreports one moderate advisory onqs6.15.3, pulled in throughshadcn→@modelcontextprotocol/sdk→express. It is already onmainatthe same version and this branch does not move it.
npm audit --omit=devreports 0 — the chain is a dev-only CLI and never enters the bundle.