chore: bump dependencies, pnpm, and coder types to 2.35.3 - #1064
Merged
Conversation
Replaces the 31-entry minimumReleaseAgeExclude list with minimumReleaseAge: 0, leaving Dependabot's cooldown as the single release-quarantine policy. Pins the coder dependency to a commit SHA (supersedes #1053) and moves it to v2.35.3, which requires a new time_til_autostop_notify_ms field on the Template mock.
mtojek
approved these changes
Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
minimumReleaseAge: 0for human updates, leaving Dependabot'scooldownas the single release-quarantine policycodergit dependency to a commit SHA instead of a mutable tag, and move it from v2.34.1 to v2.35.3jsdom29 → 30.0.1,@coder/pixel-storybook0.2.2 → 0.3.0, and the remaining in-range dependenciespnpm/action-setupto v6.0.10 andactions/setup-nodeto v7.0.0 in the composite setup action, aligning it withpublish-extension.yamltypescript-node:24-trixiedigestSupersedes #1053, whose SHA-pin change is included here.
Notes
pnpm 11 defaults
minimumReleaseAgeto 1440 minutes. Dependabot proposes the bumps in this repo and already gates them on age, so the policy now sits at the point of decision instead of firing at install time on versions a human deliberately picked.coder v2.35.3 adds a required
Template.time_til_autostop_notify_ms, so the mock sets it to0(upstream's "notification disabled"). Nothing else broke.