Bump the npm_and_yarn group across 1 directory with 12 updates - #9
Bump the npm_and_yarn group across 1 directory with 12 updates#9dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the npm_and_yarn group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.4.5` | `7.29.7` | | [minimist](https://github.com/minimistjs/minimist) | `1.2.0` | `1.2.8` | | [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.1.2` | `4.7.9` | | [braces](https://github.com/micromatch/braces) | `2.3.2` | `3.0.3` | | [eslint-utils](https://github.com/mysticatea/eslint-utils) | `1.3.1` | `1.4.3` | | [flatted](https://github.com/WebReflection/flatted) | `2.0.0` | `3.4.2` | | [lodash](https://github.com/lodash/lodash) | `4.17.11` | `4.18.1` | Updates `@babel/traverse` from 7.4.5 to 7.29.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-traverse) Updates `minimist` from 1.2.0 to 1.2.8 - [Changelog](https://github.com/minimistjs/minimist/blob/main/CHANGELOG.md) - [Commits](minimistjs/minimist@v1.2.0...v1.2.8) Updates `handlebars` from 4.1.2 to 4.7.9 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.1.2...v4.7.9) Updates `braces` from 2.3.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](https://github.com/micromatch/braces/commits/3.0.3) Updates `eslint-utils` from 1.3.1 to 1.4.3 - [Release notes](https://github.com/mysticatea/eslint-utils/releases) - [Commits](mysticatea/eslint-utils@v1.3.1...v1.4.3) Updates `flatted` from 2.0.0 to 3.4.2 - [Commits](WebReflection/flatted@v2.0.0...v3.4.2) Updates `fsevents` from 1.2.9 to 2.3.3 - [Release notes](https://github.com/fsevents/fsevents/releases) - [Commits](fsevents/fsevents@v1.2.9...v2.3.3) Updates `minimatch` from 3.0.4 to 3.1.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.0.4...v3.1.5) Updates `json5` from 2.1.0 to 2.2.3 - [Release notes](https://github.com/json5/json5/releases) - [Changelog](https://github.com/json5/json5/blob/main/CHANGELOG.md) - [Commits](json5/json5@v2.1.0...v2.2.3) Updates `lodash` from 4.17.11 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.11...4.18.1) Updates `y18n` from 4.0.0 to 5.0.8 - [Release notes](https://github.com/yargs/y18n/releases) - [Changelog](https://github.com/yargs/y18n/blob/master/CHANGELOG.md) - [Commits](yargs/y18n@v4.0.0...v5.0.8) Updates `yargs-parser` from 11.1.1 to 21.1.1 - [Release notes](https://github.com/yargs/yargs-parser/releases) - [Changelog](https://github.com/yargs/yargs-parser/blob/main/CHANGELOG.md) - [Commits](yargs/yargs-parser@v11.1.1...yargs-parser-v21.1.1) --- updated-dependencies: - dependency-name: "@babel/traverse" dependency-version: 7.29.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimist dependency-version: 1.2.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: handlebars dependency-version: 4.7.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: braces dependency-version: 3.0.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: eslint-utils dependency-version: 1.4.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fsevents dependency-version: 2.3.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: json5 dependency-version: 2.2.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: y18n dependency-version: 5.0.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: yargs-parser dependency-version: 21.1.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
📝 WalkthroughWalkthroughChangesDevelopment tooling updates
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
CI failed: The CI build failed because the deprecated `actions/setup-ruby@v1` action is unable to locate the requested Ruby version 2.6.x on the updated runner environment.OverviewThe build failed in the setup phase due to an infrastructure and configuration mismatch; the repository is using a deprecated action to fetch an end-of-life Ruby version that is no longer supported on current runners. FailuresRuby Version Resolution Failure (confidence: high)
Summary
Code Review 🚫 Blocked 0 resolved / 2 findingsDependency group update is blocked because the ESLint 6 to 10 migration is incompatible with current .eslintrc configurations and the Jest 30 upgrade presents a significant risk of breaking existing test suites. 🚨 Bug: ESLint 6→10 bump breaks lint: legacy .eslintrc unsupportedpackage.json bumps Keep ESLint on v6 to remain compatible with .eslintrc and eslint-config-airbnb ^17.
|
| Auto-apply | Compact |
|
|
Important
Your trial ends in 3 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.
Was this helpful? React with 👍 / 👎 | Gitar
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
| "@babel/preset-env": "^7.4.5", | ||
| "@types/jest": "^24.0.15", | ||
| "eslint": "^6.0.1", | ||
| "eslint": "^10.7.0", |
There was a problem hiding this comment.
🚨 Bug: ESLint 6→10 bump breaks lint: legacy .eslintrc unsupported
package.json bumps eslint from ^6.0.1 to ^10.7.0, but the repo configures ESLint via a legacy .eslintrc file and eslint-config-airbnb ^17.1.0 (whose peerDependency is eslint ^5||^6). ESLint 9 deprecated eslintrc in favor of flat config and ESLint 10 removes eslintrc support entirely, so npm run lint/npm run ci will fail, and airbnb's peer dependency will not resolve. This change is also unrelated to the PR's stated transitive security updates. Revert the eslint bump (keep ^6.0.1), or perform a proper migration to flat config with a compatible airbnb config in a separate, intentional PR.
Keep ESLint on v6 to remain compatible with .eslintrc and eslint-config-airbnb ^17.:
"eslint": "^6.0.1",
- Apply fix
Check the box to apply the fix or reply for a change | Was this helpful? React with 👍 / 👎
| @@ -36,14 +36,14 @@ | |||
| "@babel/cli": "^7.4.4", | |||
| "@babel/preset-env": "^7.4.5", | |||
| "@types/jest": "^24.0.15", | |||
There was a problem hiding this comment.
⚠️ Bug: Jest 24→30 major bump may break tests; @types/jest stale
package.json bumps jest from ^24.8.0 to ^30.4.2 — five major versions — while @types/jest remains ^24.0.15 and eslint-plugin-jest stays ^22.7.1. Jest 25–30 introduced breaking changes (jsdom no longer bundled by default, config/API changes), which can break the existing jest test run, and the type/plugin versions no longer match the runtime. This is also outside the PR's stated transitive security-update scope. Either revert to a compatible Jest version or bump Jest, @types/jest, and eslint-plugin-jest together in a dedicated, tested PR.
Was this helpful? React with 👍 / 👎
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Around line 39-45: Align the eslint dependency in package.json with the
repository’s existing .eslintrc, eslint-config-airbnb, and pinned eslint-plugin
versions by pinning ESLint to a compatible major (up to 6). Do not introduce
ESLint 10 unless the lint configuration and all related plugins are migrated
together.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 15d4d525-4211-47c9-ae62-197e04ad045f
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (1)
package.json
| "eslint": "^10.7.0", | ||
| "eslint-config-airbnb": "^17.1.0", | ||
| "eslint-plugin-import": "^2.18.0", | ||
| "eslint-plugin-jest": "^22.7.1", | ||
| "eslint-plugin-jsx-a11y": "^6.2.1", | ||
| "eslint-plugin-react": "^7.14.2", | ||
| "husky": "^2.5.0", |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
rg -n --hidden --glob '!node_modules/**' \
'(^|/)\.eslintrc|eslintConfig|eslint\.config' .
npm view eslint-config-airbnb@17.1.0 peerDependencies
npm view eslint-plugin-import@2.18.0 peerDependencies
npm view eslint-plugin-jest@22.7.1 peerDependencies
npm view eslint-plugin-react@7.14.2 peerDependenciesRepository: big-main/javascript-algorithms
Length of output: 1002
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Map the lint config files and relevant package metadata.
git ls-files | rg '(^|/)(package\.json|\.eslintrc.*|eslint\.config\.[cm]?[jt]s|\.eslintignore|jest\.config\.[cm]?[jt]s|jest\.config\.js)$' || true
printf '\n--- package.json (relevant sections) ---\n'
cat -n package.json | sed -n '1,140p'
for f in $(git ls-files | rg '(^|/)\.eslintrc.*$|(^|/)eslint\.config\.[cm]?[jt]s$|(^|/)jest\.config\.[cm]?[jt]s$|(^|/)jest\.config\.js$'); do
printf '\n--- %s ---\n' "$f"
wc -l "$f"
cat -n "$f"
doneRepository: big-main/javascript-algorithms
Length of output: 3621
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Resolve the exact peer ranges for the upgraded ESLint package and installed plugins,
# and inspect whether a flat-config file exists.
npm view eslint@10.7.0 peerDependencies peerDependenciesMeta
npm view eslint-config-airbnb@17.1.0 peerDependencies
npm view eslint-plugin-import@2.18.0 peerDependencies
npm view eslint-plugin-jest@22.7.1 peerDependencies
npm view eslint-plugin-jsx-a11y@6.2.1 peerDependencies
npm view eslint-plugin-react@7.14.2 peerDependenciesRepository: big-main/javascript-algorithms
Length of output: 1414
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the dependency block and lint-related scripts in package.json.
python3 - <<'PY'
from pathlib import Path
import json
p = Path("package.json")
data = json.loads(p.read_text())
print("--- scripts ---")
for k, v in data.get("scripts", {}).items():
if "lint" in k or "eslint" in v:
print(f"{k}: {v}")
print("\n--- devDependencies (eslint-related) ---")
for k, v in data.get("devDependencies", {}).items():
if k.startswith("eslint") or k in {"husky"}:
print(f"{k}: {v}")
PY
printf '\n--- eslint / jest config files present ---\n'
git ls-files | rg '(^|/)(\.eslintrc.*|eslint\.config\.[cm]?[jt]s|jest\.config\.[cm]?[jt]s|jest\.config\.js)$' || trueRepository: big-main/javascript-algorithms
Length of output: 494
Keep ESLint on a compatible major or migrate the lint config together — this repo still uses .eslintrc, and eslint-config-airbnb plus the pinned eslint-plugin-* versions only support ESLint up to 6, so eslint@10.7.0 will break npm run lint. Upgrade the config/plugins to flat config first, or pin ESLint to a compatible version.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` around lines 39 - 45, Align the eslint dependency in
package.json with the repository’s existing .eslintrc, eslint-config-airbnb, and
pinned eslint-plugin versions by pinning ESLint to a compatible major (up to 6).
Do not introduce ESLint 10 unless the lint configuration and all related plugins
are migrated together.
Bumps the npm_and_yarn group with 7 updates in the / directory:
7.4.57.29.71.2.01.2.84.1.24.7.92.3.23.0.31.3.11.4.32.0.03.4.24.17.114.18.1Updates
@babel/traversefrom 7.4.5 to 7.29.7Release notes
Sourced from @babel/traverse's releases.
... (truncated)
Commits
4fba754v7.29.7aa8394ev7.29.084366a8fix(traverse): provide a hub when traversing a File or Program and no parentP...229eb45[7.x backport] fix: Rename switch discriminant references when body creates s...d7f4008v7.28.6905bc22fix: lint errors in main branch (#17612)a03e2b6fix:path.evaluatecorrectly returnsconfident(#17584)aac2c37chore: Use Gulpfile.mts (#17579)65c4a6b[Babel 8] fix: Improvetraversetypes (#17574)99dcba5chore: enable some ts-eslint rules (#17592)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@babel/traversesince your current version.Updates
minimistfrom 1.2.0 to 1.2.8Changelog
Sourced from minimist's changelog.
... (truncated)
Commits
6901ee2v1.2.8a026794Merge tag 'v0.2.3'c0b2661v0.2.363b8fee[Fix] Fix long option followed by single dash (#17)72239e6[Tests] Remove duplicate test (#12)34b0f1c[eslint] fix indentation3226afa[Dev Deps] add missingnpmignoredev dep098873c[Dev Deps] update@ljharb/eslint-config,aud9ec4d27[Fix] Fix long option followed by single dashba92fe6[actions] Avoid 0.6 tests due to build failuresMaintainer changes
This version was pushed to npm by ljharb, a new releaser for minimist since your current version.
Install script changes
This version adds
prepublishscript that runs during installation. Review the package contents before updating.Updates
handlebarsfrom 4.1.2 to 4.7.9Release notes
Sourced from handlebars's releases.
Changelog
Sourced from handlebars's changelog.
... (truncated)
Commits
dce542cv4.7.98a41389Update release notes68d8df5Fix security issuesb2a0831Fix browser tests9f98c16Fix release script45443b4Revert "Improve partial indenting performance"8841a5fFix CI errors with lintinge0137c2fix: enable shell mode for spawn to resolve Windows EINVAL issuee914d60Improve rendering performance7de4b41Upgrade GitHub Actions checkout and setup-node on 4.x branchMaintainer changes
This version was pushed to npm by jaylinski, a new releaser for handlebars since your current version.
Updates
bracesfrom 2.3.2 to 3.0.3Changelog
Sourced from braces's changelog.
Commits
Updates
eslint-utilsfrom 1.3.1 to 1.4.3Release notes
Sourced from eslint-utils's releases.
Commits
23f4ddc🔖 1.4.38f9e481🐛 fix reference tracker false positive6633278⚒ fix test scripts7c8e67c⚒ fix build scripts41ff95e⚒ update dependencies4942012⚒ fix build scriptsf1c8d02⚒ update build scriptsa88598aCreate FUNDING.yml4e1bc071.4.2e4cb014🐛 add null testUpdates
flattedfrom 2.0.0 to 3.4.2Commits
3bf09093.4.2885ddccfix CWE-13210bdba70added flatted-view to the benchmark2a02dce3.4.1fba4e8fMerge pull request #89 from WebReflection/python-fix5fe8648added "when in Rome" also a test for PHP53517adsome minor improvementb3e2a0cFixing recursion issue in Python tooc4b46dbAdd SECURITY.md for security policy and reportingf86d071Create dependabot.yml for version updatesUpdates
fseventsfrom 1.2.9 to 2.3.3Release notes
Sourced from fsevents's releases.
... (truncated)
Commits
2db891eRelease v2.3.38ec87bfUpdate nodejs.yml (#392)c20c3afreadme63709dfMerge pull request #384 from aleksanb/subdirsa77340fHandle MustScanSubDirs for large projects66be519Update README.md (#371)2f2a858Update README.md (#364)a7f5d00Release v2.3.2fab136afix: issue #355 (#356)328ae39Release v2.3.1Install script changes
This version adds
installscript that runs during installation. Review the package contents before updating.Updates
minimatchfrom 3.0.4 to 3.1.5Commits
7bba9783.1.5bd25942docs: add warning about ReDoS1a9c27cfix partial matching of globstar patterns1a2e0843.1.4ae24656update lockfileb100374limit recursion for **, improve perf considerably26ffeaalockfile update9eca892lock node version to 1400c323b3.1.330486b2update CI matrix and actionsUpdates
json5from 2.1.0 to 2.2.3Release notes
Sourced from json5's releases.
Changelog
Sourced from json5's changelog.
... (truncated)
Commits
c3a75242.2.394fd06ddocs: update CHANGELOG for v2.2.33b8cebfdocs(security): use GitHub security advisoriesf0fd9e1docs: publish a security policy6a91a05docs(template): bug -> bug report14f8cb12.2.210cc7cadocs: update CHANGELOG for v2.2.27774c10fix: add proto to objects and arraysedde30aReadme: slight tweak to intro97286f8Improve example in readmeUpdates
lodashfrom 4.17.11 to 4.18.1Release notes
Sourced from lodash's releases.
Commits
cb0b9b9release(patch): bump main to 4.18.1 (#6177)75535f5chore: prune stale advisory refs (#6170)62e91bcdocs: remove n_ Node.js < 6 REPL note from README (#6165)59be2derelease(minor): bump to 4.18.0 (#6161)af63457fix: broken tests for _.template 879aaa91073a76fix: linting issues879aaa9fix: validate imports keys in _.templatefe8d32efix: block prototype pollution in baseUnset via constructor/prototype traversal18ba0a3refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)b819080ci: add dist sync validation workflow (#6137)Updates
y18nfrom 4.0.0 to 5.0.8Release notes
Sourced from y18n's releases.
Changelog
Sourced from y18n's changelog.
... (truncated)
Commits
58a9a3cchore: release 5.0.8 (#129)b1c215afix(deno): force modern release for Denoe73fb19chore: release 5.0.7 (#123)d3f2560fix(deno): force release for deno (#121)e9fda61chore: release 5.0.6 (#118)6966fa9fix(webpack): skip readFileSync if not defined (#117)c755582docs: add entry for v4.0.1 (#114)2d4c56cchore(deps): update dependency standardx to v6 (#110)b64ae70chore: release 5.0.5 (#109)a9ac604fix: address prototype pollution issue (#108)Maintainer changes
This version was pushed to npm by oss-bot, a new releaser for y18n since your current version.
Install script changes
This version adds
preparescript that runs during installation. Review the package contents before updating.Updates
yargs-parserfrom 11.1.1 to 21.1.1Release notes
Sourced from yargs-parser's releases.
... (truncated)
Changelog
Sourced from yargs-parser's changelog.