From 40313e267587cac8830b3d360de5b4db91001051 Mon Sep 17 00:00:00 2001 From: Lachlan Collins <1667261+lachlancollins@users.noreply.github.com> Date: Fri, 26 Sep 2025 17:37:23 +1000 Subject: [PATCH 1/5] ci: try e18e/action-dependency-diff --- .github/workflows/check-deps.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 .github/workflows/check-deps.yml diff --git a/.github/workflows/check-deps.yml b/.github/workflows/check-deps.yml new file mode 100644 index 0000000..f216d51 --- /dev/null +++ b/.github/workflows/check-deps.yml @@ -0,0 +1,23 @@ +name: Check Dependencies + +on: + pull_request: + +concurrency: + group: ${{ github.workflow }}-${{ github.event.number || github.ref }} + cancel-in-progress: true + +permissions: + pull-requests: write + +jobs: + check-deps: + name: Check Dependencies + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v5.0.0 + with: + fetch-depth: 0 + - name: Check Dependencies + uses: e18e/action-dependency-diff@main From a1d38417dffaa1909b81bc4fa7516d17a212d0b9 Mon Sep 17 00:00:00 2001 From: Lachlan Collins <1667261+lachlancollins@users.noreply.github.com> Date: Fri, 26 Sep 2025 17:40:44 +1000 Subject: [PATCH 2/5] Try package changes --- .github/workflows/check-deps.yml | 23 ------ .github/workflows/pr.yml | 11 +++ pnpm-lock.yaml | 120 ++++++++++++++++++------------- pnpm-workspace.yaml | 2 +- 4 files changed, 84 insertions(+), 72 deletions(-) delete mode 100644 .github/workflows/check-deps.yml diff --git a/.github/workflows/check-deps.yml b/.github/workflows/check-deps.yml deleted file mode 100644 index f216d51..0000000 --- a/.github/workflows/check-deps.yml +++ /dev/null @@ -1,23 +0,0 @@ -name: Check Dependencies - -on: - pull_request: - -concurrency: - group: ${{ github.workflow }}-${{ github.event.number || github.ref }} - cancel-in-progress: true - -permissions: - pull-requests: write - -jobs: - check-deps: - name: Check Dependencies - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v5.0.0 - with: - fetch-depth: 0 - - name: Check Dependencies - uses: e18e/action-dependency-diff@main diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index a52d59f..92beda1 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -12,6 +12,7 @@ env: permissions: contents: read + pull-requests: write jobs: test: @@ -46,3 +47,13 @@ jobs: run: pnpm run build:all - name: Publish Previews run: pnpx pkg-pr-new publish --pnpm --compact './packages/*' --no-template + check-deps: + name: Check Dependencies + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v5.0.0 + with: + fetch-depth: 0 + - name: Check Dependencies + uses: e18e/action-dependency-diff@main diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 6a028e9..1e8d292 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -133,8 +133,8 @@ catalogs: specifier: ^3.2.4 version: 3.2.4 vue: - specifier: ^3.5.21 - version: 3.5.21 + specifier: ^3.5.22 + version: 3.5.22 vue-eslint-parser: specifier: ^10.2.0 version: 10.2.0 @@ -230,14 +230,14 @@ importers: dependencies: vue: specifier: 'catalog:' - version: 3.5.21(typescript@5.9.2) + version: 3.5.22(typescript@5.9.2) devDependencies: '@tanstack/config': specifier: workspace:* version: link:../../packages/config '@vitejs/plugin-vue': specifier: 'catalog:' - version: 5.2.4(vite@6.3.6(@types/node@24.5.2)(yaml@2.8.1))(vue@3.5.21(typescript@5.9.2)) + version: 5.2.4(vite@6.3.6(@types/node@24.5.2)(yaml@2.8.1))(vue@3.5.22(typescript@5.9.2)) vite: specifier: 'catalog:' version: 6.3.6(@types/node@24.5.2)(yaml@2.8.1) @@ -1378,14 +1378,20 @@ packages: '@vue/compiler-core@3.5.21': resolution: {integrity: sha512-8i+LZ0vf6ZgII5Z9XmUvrCyEzocvWT+TeR2VBUVlzIH6Tyv57E20mPZ1bCS+tbejgUgmjrEh7q/0F0bibskAmw==} + '@vue/compiler-core@3.5.22': + resolution: {integrity: sha512-jQ0pFPmZwTEiRNSb+i9Ow/I/cHv2tXYqsnHKKyCQ08irI2kdF5qmYedmF8si8mA7zepUFmJ2hqzS8CQmNOWOkQ==} + '@vue/compiler-dom@3.5.21': resolution: {integrity: sha512-jNtbu/u97wiyEBJlJ9kmdw7tAr5Vy0Aj5CgQmo+6pxWNQhXZDPsRr1UWPN4v3Zf82s2H3kF51IbzZ4jMWAgPlQ==} - '@vue/compiler-sfc@3.5.21': - resolution: {integrity: sha512-SXlyk6I5eUGBd2v8Ie7tF6ADHE9kCR6mBEuPyH1nUZ0h6Xx6nZI29i12sJKQmzbDyr2tUHMhhTt51Z6blbkTTQ==} + '@vue/compiler-dom@3.5.22': + resolution: {integrity: sha512-W8RknzUM1BLkypvdz10OVsGxnMAuSIZs9Wdx1vzA3mL5fNMN15rhrSCLiTm6blWeACwUwizzPVqGJgOGBEN/hA==} + + '@vue/compiler-sfc@3.5.22': + resolution: {integrity: sha512-tbTR1zKGce4Lj+JLzFXDq36K4vcSZbJ1RBu8FxcDv1IGRz//Dh2EBqksyGVypz3kXpshIfWKGOCcqpSbyGWRJQ==} - '@vue/compiler-ssr@3.5.21': - resolution: {integrity: sha512-vKQ5olH5edFZdf5ZrlEgSO1j1DMA4u23TVK5XR1uMhvwnYvVdDF0nHXJUblL/GvzlShQbjhZZ2uvYmDlAbgo9w==} + '@vue/compiler-ssr@3.5.22': + resolution: {integrity: sha512-GdgyLvg4R+7T8Nk2Mlighx7XGxq/fJf9jaVofc3IL0EPesTE86cP/8DD1lT3h1JeZr2ySBvyqKQJgbS54IX1Ww==} '@vue/compiler-vue2@2.7.16': resolution: {integrity: sha512-qYC3Psj9S/mfu9uVi5WvNZIzq+xnXMhOwbTFKKDD7b1lhpnn71jXSFdTQ+WsIEk0ONCd7VV2IMm7ONl6tbQ86A==} @@ -1398,23 +1404,26 @@ packages: typescript: optional: true - '@vue/reactivity@3.5.21': - resolution: {integrity: sha512-3ah7sa+Cwr9iiYEERt9JfZKPw4A2UlbY8RbbnH2mGCE8NwHkhmlZt2VsH0oDA3P08X3jJd29ohBDtX+TbD9AsA==} + '@vue/reactivity@3.5.22': + resolution: {integrity: sha512-f2Wux4v/Z2pqc9+4SmgZC1p73Z53fyD90NFWXiX9AKVnVBEvLFOWCEgJD3GdGnlxPZt01PSlfmLqbLYzY/Fw4A==} - '@vue/runtime-core@3.5.21': - resolution: {integrity: sha512-+DplQlRS4MXfIf9gfD1BOJpk5RSyGgGXD/R+cumhe8jdjUcq/qlxDawQlSI8hCKupBlvM+3eS1se5xW+SuNAwA==} + '@vue/runtime-core@3.5.22': + resolution: {integrity: sha512-EHo4W/eiYeAzRTN5PCextDUZ0dMs9I8mQ2Fy+OkzvRPUYQEyK9yAjbasrMCXbLNhF7P0OUyivLjIy0yc6VrLJQ==} - '@vue/runtime-dom@3.5.21': - resolution: {integrity: sha512-3M2DZsOFwM5qI15wrMmNF5RJe1+ARijt2HM3TbzBbPSuBHOQpoidE+Pa+XEaVN+czbHf81ETRoG1ltztP2em8w==} + '@vue/runtime-dom@3.5.22': + resolution: {integrity: sha512-Av60jsryAkI023PlN7LsqrfPvwfxOd2yAwtReCjeuugTJTkgrksYJJstg1e12qle0NarkfhfFu1ox2D+cQotww==} - '@vue/server-renderer@3.5.21': - resolution: {integrity: sha512-qr8AqgD3DJPJcGvLcJKQo2tAc8OnXRcfxhOJCPF+fcfn5bBGz7VCcO7t+qETOPxpWK1mgysXvVT/j+xWaHeMWA==} + '@vue/server-renderer@3.5.22': + resolution: {integrity: sha512-gXjo+ao0oHYTSswF+a3KRHZ1WszxIqO7u6XwNHqcqb9JfyIL/pbWrrh/xLv7jeDqla9u+LK7yfZKHih1e1RKAQ==} peerDependencies: - vue: 3.5.21 + vue: 3.5.22 '@vue/shared@3.5.21': resolution: {integrity: sha512-+2k1EQpnYuVuu3N7atWyG3/xoFWIVJZq4Mz8XNOdScFI0etES75fbny/oU4lKWk/577P1zmg0ioYvpGEDZ3DLw==} + '@vue/shared@3.5.22': + resolution: {integrity: sha512-F4yc6palwq3TT0u+FYf0Ns4Tfl9GRFURDN2gWG7L1ecIaS/4fCIuFOjMTnCyjsu/OK6vaDKLCrGAa+KvvH+h4w==} + '@yarnpkg/lockfile@1.1.0': resolution: {integrity: sha512-GpSwvyXOcOOlV70vbnzjj4fW5xW/FdUF6nQEt1ENy7m4ZCczi1+/buVUPAqmGfqznsORNFzUMjctTIp8a9tuCQ==} @@ -3137,8 +3146,8 @@ packages: peerDependencies: eslint: ^8.57.0 || ^9.0.0 - vue@3.5.21: - resolution: {integrity: sha512-xxf9rum9KtOdwdRkiApWL+9hZEMWE90FHh8yS1+KJAiWYh+iGWV1FquPjoO9VUHQ+VIhsCXNNyZ5Sf4++RVZBA==} + vue@3.5.22: + resolution: {integrity: sha512-toaZjQ3a/G/mYaLSbV+QsQhIdMo9x5rrqIpYRObsJ6T/J+RyCSFwN2LHNVH9v8uIcljDNa3QzPVdv3Y6b9hAJQ==} peerDependencies: typescript: '*' peerDependenciesMeta: @@ -4252,10 +4261,10 @@ snapshots: transitivePeerDependencies: - supports-color - '@vitejs/plugin-vue@5.2.4(vite@6.3.6(@types/node@24.5.2)(yaml@2.8.1))(vue@3.5.21(typescript@5.9.2))': + '@vitejs/plugin-vue@5.2.4(vite@6.3.6(@types/node@24.5.2)(yaml@2.8.1))(vue@3.5.22(typescript@5.9.2))': dependencies: vite: 6.3.6(@types/node@24.5.2)(yaml@2.8.1) - vue: 3.5.21(typescript@5.9.2) + vue: 3.5.22(typescript@5.9.2) '@vitest/expect@3.2.4': dependencies: @@ -4319,27 +4328,40 @@ snapshots: estree-walker: 2.0.2 source-map-js: 1.2.1 + '@vue/compiler-core@3.5.22': + dependencies: + '@babel/parser': 7.28.4 + '@vue/shared': 3.5.22 + entities: 4.5.0 + estree-walker: 2.0.2 + source-map-js: 1.2.1 + '@vue/compiler-dom@3.5.21': dependencies: '@vue/compiler-core': 3.5.21 '@vue/shared': 3.5.21 - '@vue/compiler-sfc@3.5.21': + '@vue/compiler-dom@3.5.22': + dependencies: + '@vue/compiler-core': 3.5.22 + '@vue/shared': 3.5.22 + + '@vue/compiler-sfc@3.5.22': dependencies: '@babel/parser': 7.28.4 - '@vue/compiler-core': 3.5.21 - '@vue/compiler-dom': 3.5.21 - '@vue/compiler-ssr': 3.5.21 - '@vue/shared': 3.5.21 + '@vue/compiler-core': 3.5.22 + '@vue/compiler-dom': 3.5.22 + '@vue/compiler-ssr': 3.5.22 + '@vue/shared': 3.5.22 estree-walker: 2.0.2 magic-string: 0.30.19 postcss: 8.5.6 source-map-js: 1.2.1 - '@vue/compiler-ssr@3.5.21': + '@vue/compiler-ssr@3.5.22': dependencies: - '@vue/compiler-dom': 3.5.21 - '@vue/shared': 3.5.21 + '@vue/compiler-dom': 3.5.22 + '@vue/shared': 3.5.22 '@vue/compiler-vue2@2.7.16': dependencies: @@ -4359,30 +4381,32 @@ snapshots: optionalDependencies: typescript: 5.9.2 - '@vue/reactivity@3.5.21': + '@vue/reactivity@3.5.22': dependencies: - '@vue/shared': 3.5.21 + '@vue/shared': 3.5.22 - '@vue/runtime-core@3.5.21': + '@vue/runtime-core@3.5.22': dependencies: - '@vue/reactivity': 3.5.21 - '@vue/shared': 3.5.21 + '@vue/reactivity': 3.5.22 + '@vue/shared': 3.5.22 - '@vue/runtime-dom@3.5.21': + '@vue/runtime-dom@3.5.22': dependencies: - '@vue/reactivity': 3.5.21 - '@vue/runtime-core': 3.5.21 - '@vue/shared': 3.5.21 + '@vue/reactivity': 3.5.22 + '@vue/runtime-core': 3.5.22 + '@vue/shared': 3.5.22 csstype: 3.1.3 - '@vue/server-renderer@3.5.21(vue@3.5.21(typescript@5.9.2))': + '@vue/server-renderer@3.5.22(vue@3.5.22(typescript@5.9.2))': dependencies: - '@vue/compiler-ssr': 3.5.21 - '@vue/shared': 3.5.21 - vue: 3.5.21(typescript@5.9.2) + '@vue/compiler-ssr': 3.5.22 + '@vue/shared': 3.5.22 + vue: 3.5.22(typescript@5.9.2) '@vue/shared@3.5.21': {} + '@vue/shared@3.5.22': {} + '@yarnpkg/lockfile@1.1.0': {} '@yarnpkg/parsers@3.0.2': @@ -6123,13 +6147,13 @@ snapshots: transitivePeerDependencies: - supports-color - vue@3.5.21(typescript@5.9.2): + vue@3.5.22(typescript@5.9.2): dependencies: - '@vue/compiler-dom': 3.5.21 - '@vue/compiler-sfc': 3.5.21 - '@vue/runtime-dom': 3.5.21 - '@vue/server-renderer': 3.5.21(vue@3.5.21(typescript@5.9.2)) - '@vue/shared': 3.5.21 + '@vue/compiler-dom': 3.5.22 + '@vue/compiler-sfc': 3.5.22 + '@vue/runtime-dom': 3.5.22 + '@vue/server-renderer': 3.5.22(vue@3.5.22(typescript@5.9.2)) + '@vue/shared': 3.5.22 optionalDependencies: typescript: 5.9.2 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 230b6c3..62bee3f 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -50,5 +50,5 @@ catalog: vite-plugin-externalize-deps: ^0.9.0 vite-tsconfig-paths: ^5.1.4 vitest: ^3.2.4 - vue: ^3.5.21 + vue: ^3.5.22 vue-eslint-parser: ^10.2.0 From fcc5bea370013808dc4ca8e3413829682c01ac47 Mon Sep 17 00:00:00 2001 From: Lachlan Collins <1667261+lachlancollins@users.noreply.github.com> Date: Fri, 26 Sep 2025 17:42:10 +1000 Subject: [PATCH 3/5] Dedupe --- pnpm-lock.yaml | 28 ++-------------------------- 1 file changed, 2 insertions(+), 26 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 1e8d292..b44f1fd 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -1375,15 +1375,9 @@ packages: '@volar/typescript@2.4.23': resolution: {integrity: sha512-lAB5zJghWxVPqfcStmAP1ZqQacMpe90UrP5RJ3arDyrhy4aCUQqmxPPLB2PWDKugvylmO41ljK7vZ+t6INMTag==} - '@vue/compiler-core@3.5.21': - resolution: {integrity: sha512-8i+LZ0vf6ZgII5Z9XmUvrCyEzocvWT+TeR2VBUVlzIH6Tyv57E20mPZ1bCS+tbejgUgmjrEh7q/0F0bibskAmw==} - '@vue/compiler-core@3.5.22': resolution: {integrity: sha512-jQ0pFPmZwTEiRNSb+i9Ow/I/cHv2tXYqsnHKKyCQ08irI2kdF5qmYedmF8si8mA7zepUFmJ2hqzS8CQmNOWOkQ==} - '@vue/compiler-dom@3.5.21': - resolution: {integrity: sha512-jNtbu/u97wiyEBJlJ9kmdw7tAr5Vy0Aj5CgQmo+6pxWNQhXZDPsRr1UWPN4v3Zf82s2H3kF51IbzZ4jMWAgPlQ==} - '@vue/compiler-dom@3.5.22': resolution: {integrity: sha512-W8RknzUM1BLkypvdz10OVsGxnMAuSIZs9Wdx1vzA3mL5fNMN15rhrSCLiTm6blWeACwUwizzPVqGJgOGBEN/hA==} @@ -1418,9 +1412,6 @@ packages: peerDependencies: vue: 3.5.22 - '@vue/shared@3.5.21': - resolution: {integrity: sha512-+2k1EQpnYuVuu3N7atWyG3/xoFWIVJZq4Mz8XNOdScFI0etES75fbny/oU4lKWk/577P1zmg0ioYvpGEDZ3DLw==} - '@vue/shared@3.5.22': resolution: {integrity: sha512-F4yc6palwq3TT0u+FYf0Ns4Tfl9GRFURDN2gWG7L1ecIaS/4fCIuFOjMTnCyjsu/OK6vaDKLCrGAa+KvvH+h4w==} @@ -4320,14 +4311,6 @@ snapshots: path-browserify: 1.0.1 vscode-uri: 3.1.0 - '@vue/compiler-core@3.5.21': - dependencies: - '@babel/parser': 7.28.4 - '@vue/shared': 3.5.21 - entities: 4.5.0 - estree-walker: 2.0.2 - source-map-js: 1.2.1 - '@vue/compiler-core@3.5.22': dependencies: '@babel/parser': 7.28.4 @@ -4336,11 +4319,6 @@ snapshots: estree-walker: 2.0.2 source-map-js: 1.2.1 - '@vue/compiler-dom@3.5.21': - dependencies: - '@vue/compiler-core': 3.5.21 - '@vue/shared': 3.5.21 - '@vue/compiler-dom@3.5.22': dependencies: '@vue/compiler-core': 3.5.22 @@ -4371,9 +4349,9 @@ snapshots: '@vue/language-core@2.1.6(typescript@5.9.2)': dependencies: '@volar/language-core': 2.4.23 - '@vue/compiler-dom': 3.5.21 + '@vue/compiler-dom': 3.5.22 '@vue/compiler-vue2': 2.7.16 - '@vue/shared': 3.5.21 + '@vue/shared': 3.5.22 computeds: 0.0.1 minimatch: 9.0.5 muggle-string: 0.4.1 @@ -4403,8 +4381,6 @@ snapshots: '@vue/shared': 3.5.22 vue: 3.5.22(typescript@5.9.2) - '@vue/shared@3.5.21': {} - '@vue/shared@3.5.22': {} '@yarnpkg/lockfile@1.1.0': {} From 7879daf1df64566aea2571ed5a6d02366da68291 Mon Sep 17 00:00:00 2001 From: Lachlan Collins <1667261+lachlancollins@users.noreply.github.com> Date: Fri, 26 Sep 2025 17:56:03 +1000 Subject: [PATCH 4/5] Update thresholds --- .github/setup/action.yml | 4 ---- .github/workflows/pr.yml | 7 +++++++ 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/setup/action.yml b/.github/setup/action.yml index 0c41183..4fc888a 100644 --- a/.github/setup/action.yml +++ b/.github/setup/action.yml @@ -3,10 +3,6 @@ description: Action that sets up Node, pnpm, and caching runs: using: composite steps: - - name: Check provenance - uses: danielroe/provenance-action@v0.1.1 - with: - fail-on-downgrade: true - name: Setup pnpm uses: pnpm/action-setup@v4.1.0 - name: Setup Node diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 92beda1..e8a5ac6 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -57,3 +57,10 @@ jobs: fetch-depth: 0 - name: Check Dependencies uses: e18e/action-dependency-diff@main + with: + duplicate-threshold: 2 + size-threshold: 1000000 + - name: Check Provenance + uses: danielroe/provenance-action@v0.1.1 + with: + fail-on-downgrade: true From 2eb50069b1b3918ad5455ca9b558dcad23af7143 Mon Sep 17 00:00:00 2001 From: Lachlan Collins <1667261+lachlancollins@users.noreply.github.com> Date: Fri, 26 Sep 2025 17:59:04 +1000 Subject: [PATCH 5/5] Move provenance out of setup --- .github/workflows/pr.yml | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index e8a5ac6..07af829 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -12,7 +12,6 @@ env: permissions: contents: read - pull-requests: write jobs: test: @@ -47,19 +46,14 @@ jobs: run: pnpm run build:all - name: Publish Previews run: pnpx pkg-pr-new publish --pnpm --compact './packages/*' --no-template - check-deps: - name: Check Dependencies + provenance: + name: Provenance runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v5.0.0 with: fetch-depth: 0 - - name: Check Dependencies - uses: e18e/action-dependency-diff@main - with: - duplicate-threshold: 2 - size-threshold: 1000000 - name: Check Provenance uses: danielroe/provenance-action@v0.1.1 with: