Skip to content

chore(deps): update all direct dependencies to latest#73

Merged
nerdalytics merged 2 commits into
trunkfrom
chore/update-direct-dependencies
Apr 20, 2026
Merged

chore(deps): update all direct dependencies to latest#73
nerdalytics merged 2 commits into
trunkfrom
chore/update-direct-dependencies

Conversation

@nerdalytics
Copy link
Copy Markdown
Owner

Summary

Bump every direct dependency and the toolchain to the latest pinned version. Fix the breaking changes that came with it.

Direct dependencies

Package Before After
@adonisjs/ace 13.4.0 14.1.0
@biomejs/biome 2.3.12 2.4.12
@types/node 25.0.10 25.6.0
binaryen 125.0.0 129.0.0
fast-check 4.5.3 4.7.0
ohm-js 17.3.0 17.5.0
typescript 5.9.3 6.0.3

Toolchain

Tool Before After
node 24.13.0 24.15.0 (LTS)
pnpm 10.28.0 10.33.0

Breaking-change fixes

  • TypeScript 6: baseUrl is now a deprecated-error; removed from tsconfig.json. TS6 is also stricter about auto-loading ambient types, so added "types": ["node"] to keep Node globals (performance) and module declarations (perf_hooks, etc.) resolvable.
  • Binaryen 129: mod.i64.const(low, high) was replaced by mod.i64.const(bigint). Bundled .d.ts still declares the old signature, so added a small i64Const() wrapper plus combine32BitPartsToBigInt() helper (reverses existing splitBigIntTo32BitParts used by the checker).

Side effects

  • pnpm update picomatch -r bumped picomatch 2.3.1 → 2.3.2 in pnpm-lock.yaml, closing the two open Dependabot alerts on trunk (GHSA-c2c7-rcm5-vvqj high, GHSA-3v7f-55p6-f55p medium).
  • Biome 2.4.12 applied formatter/organize-imports auto-fixes in declarations.ts and compile.property.test.ts.

Test plan

  • mise run ci green — build, biome, tsc, tests (857 tests passing)
  • CI on trunk runner green
  • Dependabot alerts auto-close on next scan

Fixes the two open picomatch Dependabot alerts.

Direct deps:
- @adonisjs/ace: 13.4.0 -> 14.1.0
- @biomejs/biome: 2.3.12 -> 2.4.12
- @types/node:   25.0.10 -> 25.6.0
- binaryen:      125.0.0 -> 129.0.0
- fast-check:    4.5.3 -> 4.7.0
- ohm-js:        17.3.0 -> 17.5.0
- typescript:    5.9.3 -> 6.0.3

Tooling:
- node: 24.13.0 -> 24.15.0 (latest LTS)
- pnpm: 10.28.0 -> 10.33.0

Breaking-change fixes:
- tsconfig: drop deprecated baseUrl (TS6 would error);
  add types: ["node"] so Node globals like performance and
  @types/node ambient modules remain visible under stricter TS6
  default resolution.
- codegen: binaryen 129 replaced i64.const(low, high) with
  i64.const(bigint); added i64Const() wrapper that also works
  around the bundled .d.ts still declaring the old signature.
  combine32BitPartsToBigInt() helper added to reverse the
  existing split storage in Inst.arg0/arg1.

Side effects:
- picomatch is now 2.3.2 via pnpm update -r, closing the two
  open Dependabot alerts (high + medium) on trunk.
- biome 2.4.12 applied formatter/organizeImports auto-fixes in
  two files (declarations.ts, compile.property.test.ts).

Verification: mise run ci is green (857 tests passing).
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Apr 20, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​types/​node@​25.0.10 ⏵ 25.6.01001008195100
Updated@​adonisjs/​ace@​13.4.0 ⏵ 14.1.09810083 +192100
Updatedtypescript@​5.9.3 ⏵ 6.0.3100 +110090 +110090
Updatedfast-check@​4.5.3 ⏵ 4.7.010010010091100
Updatedohm-js@​17.3.0 ⏵ 17.5.096 +1100100 +193 +8100
Updatedbinaryen@​125.0.0 ⏵ 129.0.0-nightly.20260419100 +110010097 +8100
Updated@​biomejs/​biome@​2.3.12 ⏵ 2.4.12100 +110010099100

View full report

The stable binaryen@129.0.0 runtime expects i64.const(bigint) but ships
an index.d.ts still declaring the old (low, high) signature. Switching
to nightly 129.0.0-nightly.20260419 picks up the corrected types from
upstream PR AssemblyScript/binaryen.js#120 and lets the i64Const
wrapper go away.

The same nightly carries a separate syntax error in index.d.ts on
the i64.atomic.load8_u signature (missing closing paren), which tsc
cannot parse. Applied via a one-line pnpm patch. Reported upstream:
AssemblyScript/binaryen.js#125.

Temporary: remove both the nightly pin and the patch once a stable
release carrying PR #120 and the load8_u fix is published.
@nerdalytics
Copy link
Copy Markdown
Owner Author

Follow-up commit 126ebde pins binaryen to 129.0.0-nightly.20260419 to pick up the corrected i64.const types from AssemblyScript/binaryen.js#120 and removes the local i64Const wrapper.

The same nightly carries a syntax error in i64.atomic.load8_u that blocks tsc from parsing index.d.ts. Patched locally via pnpm.patchedDependencies (patches/binaryen@129.0.0-nightly.20260419.patch). Reported upstream: AssemblyScript/binaryen.js#125.

Temporary. Remove the nightly pin, the patch file, and the patchedDependencies entry once a stable binaryen release carries both fixes.

@nerdalytics nerdalytics merged commit c551789 into trunk Apr 20, 2026
5 checks passed
@nerdalytics nerdalytics deleted the chore/update-direct-dependencies branch April 20, 2026 11:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant