⬆️ Update patch dependencies - #47
Merged
Merged
Conversation
github-actions
Bot
force-pushed
the
automated/dependency-updates
branch
from
July 22, 2026 04:56
1f59987 to
6975fbb
Compare
soodoku
added a commit
that referenced
this pull request
Aug 7, 2026
…ndabot (#54) * ci: run on Node 22 via .nvmrc instead of Node 18 The locked toolchain requires Node >= 20.19 (vite 8, rolldown 1.1, @vitejs/plugin-react 5, vitest 4, pdfjs-dist 4). On Node 18 `npm test` died at config load with: SyntaxError: The requested module 'node:util' does not provide an export named 'styleText' `styleText` does not exist in Node 18. This is the root cause of both the failing `test` job in ci.yml and the failing "Run tests after updates" step in the nightly dependency-updates job. Pin the version once in .nvmrc and read it via node-version-file in all seven setup-node steps, so local and CI can't drift. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * test: migrate vitest.config.ts to vitest 4, emit lcov coverage vitest 4 removed poolOptions entirely (Tinypool is gone); singleThread and maxThreads collapse into a top-level maxWorkers, and minThreads has no replacement. The stale block was a real `tsc --noEmit` error: vitest.config.ts(24,5): error TS2769: No overload matches this call. 'poolOptions' does not exist in type 'InlineConfig'. Keep isolate: true. The upstream migration note maps singleThread to "maxWorkers: 1, isolate: false", but that is a performance recipe, not a semantic equivalence -- the old config set singleThread AND isolate, and dropping isolation here would share src/test/setup.ts's non-configurable global `process` replacement across files and leak logger.test.ts's console spies (it never calls restoreAllMocks). Also set coverage.reporter to ['text', 'lcov']. vitest's default set is text/html/clover/json, so coverage/lcov.info never existed and the Codecov upload in ci.yml has always been a silent no-op. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * ci: drop the Vercel deploy and Lighthouse jobs deploy-preview, deploy-production, and performance-audit have never executed -- they sit behind `needs: [build]`, and build has been blocked by the failing test job. Fixing the tests would have made them run for the first time and go red. Nothing in this repo deploys to Vercel: the repo has zero secrets, zero variables, and zero environments; there is no vercel.json and no .vercel/; `gh api repos/gojiplus/reader/deployments` returns empty; and README.md, CLAUDE.md, and firebase.json all describe a Firebase project. Vercel appeared nowhere outside this file. performance-audit was broken independently: lighthouserc.json sets startServerReadyPattern to "ready on", which Next 15 never prints (it prints "Ready in ..."), so LHCI would block until its start-server timeout. lighthouserc.json is left in place for manual `npx lhci autorun`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * ci: bump actions to latest, fix codecov input, make type-check a real gate Action bumps (every `uses:` in both workflows): actions/checkout v4 -> v7 actions/setup-node v4 -> v7 actions/upload-artifact v4 -> v7 github/codeql-action/* v3 -> v4 (v3 deprecates Dec 2026) codecov/codecov-action v4 -> v7 peter-evans/create-pull-request v5 -> v8 aquasecurity/trivy-action master -> 0.36.0 This clears the "Node.js 20 is deprecated" annotation on every run, and pinning trivy-action off `master` closes an unpinned-ref supply-chain exposure. codecov-action v5 removed the `file` input in favour of `files`. Left unchanged, v7 would have failed on an unknown input. Verified against the action.yml at v7: there is no `file`. Remove continue-on-error from type-check. The only error it was masking was the vitest.config.ts poolOptions overload, fixed in the previous commit; `npx tsc --noEmit` is now clean. This matters because next.config.ts sets typescript.ignoreBuildErrors, so this job is the repo's only type gate. Exclude .next/cache from the build artifact. The build job has never run to completion, so `path: .next/` has never actually uploaded -- on a Next 15 build that is a few hundred MB of webpack cache for a 1-day retention artifact. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * ci: collapse CodeQL matrix to a single javascript-typescript job GitHub annotated every run: CodeQL language 'javascript' is referenced by more than one entry in the 'language' matrix parameter for job 'codeql-analysis'. This may result in duplicate alerts. They are the same language. The two jobs each spent ~2m40s producing duplicate alerts. javascript-typescript is the canonical single value -- it is what this repo's own code-scanning API reports. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * ci: fix the nightly dependency-updates job, untrack outdated.json Three bugs in one job. 1. `npm outdated --json` prints `{}` when nothing is outdated, and `{}` is 3 bytes, so `[ -s outdated.json ]` was always true and updates_available was effectively hardcoded to true. 2. The job wrote outdated.json into the working tree and then used `git status --porcelain` over the whole tree to decide changes_made, so its own scratch file influenced the answer. 3. Because create-pull-request had no add-paths, that scratch file got swept into the commit. outdated.json is tracked in git today and this workflow has committed it to main five times (#28, #29, #47, ...). Scratch now goes to $RUNNER_TEMP, the {} case is handled, changes_made is scoped to package.json and package-lock.json, and add-paths pins the PR contents to those two files. Also allow workflow_dispatch. Under `if: github.event_name == 'schedule'` this job could not be tested without waiting for 2 AM UTC. `npx --yes` because the log shows npm-check-updates being resolved via an interactive install prompt, and the step is renamed to match what `--target patch` actually does. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * ci: correct trivy tag and make the build artifact non-empty trivy-action tags are v-prefixed from 0.33.0 onward; @0.36.0 does not resolve and failed the Security Scan job at set-up. The build artifact uploaded nothing: ".next" is a dotfile directory and upload-artifact skips hidden paths unless include-hidden-files is set. This was pre-existing -- the build job had never run to completion, so it had never been observed. Verified the path patterns directly against @actions/glob (the library upload-artifact uses): with hidden files included, ".next/" matches 202 entries and the "!.next/cache/" exclusion brings that to 140. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * ci: replace the nightly updater with Dependabot, keep CodeQL weekly The "Security & Updates" workflow had three jobs and only one of them was pulling its weight. - audit-dependencies ran `npm audit` behind continue-on-error and uploaded a JSON report as a 30-day artifact. It could not fail and nothing consumed the artifact -- it just produced the "exit code 1" annotation on every nightly run. - dependency-updates hand-rolled `npm-check-updates` in bash to open a patch-bump PR. Dependabot is already active on this repo and does the same thing with rebasing and conflict handling. The bash version had no rebase story, and its own scratch file kept landing in main. - codeql-analysis is the one worth keeping, but daily is far more often than this repo changes. So: add .github/dependabot.yml covering npm weekly (grouped, so a week of bumps is one or two PRs) plus github-actions weekly -- the latter is what would have flagged the Node 20 deprecation on checkout/setup-node before it became an annotation on every run. Until now Dependabot was only doing security updates from repo settings, with no config file, which is why the bash updater existed at all. The workflow is now CodeQL-only and renamed to match, running Mondays. Its permissions drop to contents: read now that nothing pushes branches. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated dependency update for patch versions.
This PR was automatically created by the dependency update workflow.
Changes
Please review the changes before merging.