From c3ae6bbb19c6d2daf1da6e38d966dddf3dc6a30e Mon Sep 17 00:00:00 2001 From: Eden Zimbelman Date: Wed, 15 Jul 2026 12:46:29 -0700 Subject: [PATCH 1/3] chore: track undici-types to the resolved undici version The overrides pin held undici-types at ^7.28.0 while undici is a direct dependency that Dependabot bumps independently. Because undici-types is pulled in transitively by @types/node, the runtime library and its type declarations could drift apart on a major bump. Use the "$undici" override so undici-types always resolves to whatever version undici resolves to, keeping them in lockstep automatically on every future bump. $undici resolves to the current 7.28.0, so the lockfile is unchanged; the behavior only activates when undici bumps. Co-Authored-By: Claude --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index e543e3ab..3445032b 100644 --- a/package.json +++ b/package.json @@ -53,7 +53,7 @@ "undici": "^7.28.0" }, "overrides": { - "undici-types": "^7.28.0" + "undici-types": "$undici" }, "devDependencies": { "@biomejs/biome": "^2.5.4", From dc5e0b0c539c76e7ea950ee98ac99d496044f810 Mon Sep 17 00:00:00 2001 From: Eden Zimbelman Date: Wed, 15 Jul 2026 12:46:48 -0700 Subject: [PATCH 2/3] chore: drop the undici dependabot group The group existed to bump undici and undici-types together in one PR. Now that the "$undici" override resolves undici-types to the undici version automatically, undici can bump as a normal ungrouped PR and the types follow via the override. The group is redundant. Co-Authored-By: Claude --- .github/dependabot.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 95dae5df..6188e456 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,11 +4,6 @@ updates: directory: "/" schedule: interval: "monthly" - groups: - undici: - patterns: - - "undici" - - "undici-types" ignore: - dependency-name: "@types/node" versions: From 97b488a66da2c731ea7c02d21669ee065ddc52ca Mon Sep 17 00:00:00 2001 From: Eden Zimbelman Date: Wed, 15 Jul 2026 12:53:04 -0700 Subject: [PATCH 3/3] ci: re-trigger checks against the retargeted base The failing unit-test run merged this branch against the old base (the undici@8 branch, #648) because the pull/652/merge ref was stale after retargeting the PR to main. Against main (undici@^7.28.0) the committed lockfile satisfies the "$undici" override and npm ci passes. This empty commit regenerates the merge ref so CI runs against main. Co-Authored-By: Claude