chore(example-apps/react-js): bump the all-deps group across 1 directory with 13 updates#435
Open
dependabot[bot] wants to merge 1 commit into
Conversation
…ory with 13 updates Bumps the all-deps group with 13 updates in the /example-apps/react-js directory: | Package | From | To | | --- | --- | --- | | [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.100.11` | `5.101.0` | | [html-react-parser](https://github.com/remarkablemark/html-react-parser) | `6.1.1` | `6.1.3` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.16.0` | `1.18.0` | | [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.6` | `19.2.7` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.14` | `19.2.17` | | [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.6` | `19.2.7` | | [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.15.1` | `7.17.0` | | [react-tooltip](https://github.com/ReactTooltip/react-tooltip) | `6.0.4` | `6.0.7` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.7` | `4.1.9` | | [eslint](https://github.com/eslint/eslint) | `10.2.1` | `10.5.0` | | [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.2` | `0.5.3` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.14` | `8.0.16` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.7` | `4.1.9` | Updates `@tanstack/react-query` from 5.100.11 to 5.101.0 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.101.0/packages/react-query) Updates `html-react-parser` from 6.1.1 to 6.1.3 - [Release notes](https://github.com/remarkablemark/html-react-parser/releases) - [Changelog](https://github.com/remarkablemark/html-react-parser/blob/master/CHANGELOG.md) - [Commits](remarkablemark/html-react-parser@v6.1.1...v6.1.3) Updates `lucide-react` from 1.16.0 to 1.18.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.18.0/packages/lucide-react) Updates `react` from 19.2.6 to 19.2.7 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react) Updates `@types/react` from 19.2.14 to 19.2.17 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `react-dom` from 19.2.6 to 19.2.7 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-dom) Updates `react-router-dom` from 7.15.1 to 7.17.0 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-dom/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.17.0/packages/react-router-dom) Updates `react-tooltip` from 6.0.4 to 6.0.7 - [Release notes](https://github.com/ReactTooltip/react-tooltip/releases) - [Changelog](https://github.com/ReactTooltip/react-tooltip/blob/master/CHANGELOG.md) - [Commits](ReactTooltip/react-tooltip@v6.0.4...v6.0.7) Updates `@vitest/coverage-v8` from 4.1.7 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/HEAD/packages/coverage-v8) Updates `eslint` from 10.2.1 to 10.5.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.2.1...v10.5.0) Updates `eslint-plugin-react-refresh` from 0.5.2 to 0.5.3 - [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases) - [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md) - [Commits](ArnaudBarre/eslint-plugin-react-refresh@v0.5.2...v0.5.3) Updates `vite` from 8.0.14 to 8.0.16 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) Updates `vitest` from 4.1.7 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/HEAD/packages/vitest) --- updated-dependencies: - dependency-name: "@tanstack/react-query" dependency-version: 5.101.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-deps - dependency-name: html-react-parser dependency-version: 6.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-deps - dependency-name: lucide-react dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-deps - dependency-name: react dependency-version: 19.2.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-deps - dependency-name: "@types/react" dependency-version: 19.2.17 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-deps - dependency-name: react-dom dependency-version: 19.2.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-deps - dependency-name: react-router-dom dependency-version: 7.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-deps - dependency-name: react-tooltip dependency-version: 6.0.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-deps - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-deps - dependency-name: eslint dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-deps - dependency-name: eslint-plugin-react-refresh dependency-version: 0.5.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-deps - dependency-name: vite dependency-version: 8.0.16 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-deps - dependency-name: vitest dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-deps ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Owner
|
@coderabbitai this PR's workflows failed because the pnpm lock file wasn't updated by dependabot. What is the best way to fix this? |
Contributor
|
Tip For best results, initiate chat on the files or code changes.
Option 1: Ask Dependabot to rebase (quickest try)Comment on the PR: This may regenerate the lockfile if Dependabot's pnpm support handles it. However, Dependabot's pnpm lockfile support has historically been unreliable, so this may not work. Option 2: Manually update the lockfile (most reliable)# Check out the Dependabot branch locally
git fetch origin
git checkout dependabot/npm_and_yarn/example-apps/react-js/all-deps-<suffix>
# Navigate to the React app directory and regenerate the lockfile
cd example-apps/react-js
pnpm install
# Commit and push the updated lockfile
git add pnpm-lock.yaml
git commit -m "chore: update pnpm lockfile"
git pushOption 3: Add a CI step to auto-fix (long-term solution)If this is a recurring issue, you can add a workflow step that runs Option 2 is the most reliable for a one-off fix. The root cause is that Dependabot has limited native support for pnpm lockfiles and may only update |
Owner
@coderabbitai create an issue to track the long-term resolution of that as well as get dependabot to open PRs against the |
3 tasks
Contributor
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
gh issue create \
--repo "Ryan-Millard/Img2Num" \
--title "chore: fix Dependabot config — target \`dev\` branch and auto-regenerate pnpm lockfile" \
--assignee "Ryan-Millard" \
--body "## Overview
Two related Dependabot/CI issues were identified in PR `#435` and the discussion in [this comment](https://github.com/Ryan-Millard/Img2Num/pull/435#issuecomment-0):
---
## Problem 1 — Dependabot targets \`main\` instead of \`dev\`
The project uses \`dev\` as an integration buffer before merging into \`main\`, but Dependabot is currently configured to open PRs directly against \`main\`. This bypasses the normal review/integration flow.
**Fix:** Update \`.github/dependabot.yml\` to set \`target-branch: dev\` for all ecosystems.
---
## Problem 2 — Dependabot does not regenerate \`pnpm-lock.yaml\`
Dependabot has [limited native pnpm lockfile support](https://github.com/dependabot/dependabot-core/issues/1736) and only updates \`package.json\`, leaving \`pnpm-lock.yaml\` out of sync. This causes CI workflows to fail on Dependabot PRs.
**Fix options (pick one or combine):**
1. Add a GitHub Actions workflow that triggers on Dependabot PRs, runs \`pnpm install\` in the relevant workspace directory, and commits the updated lockfile back to the branch.
2. Alternatively, use \`--no-frozen-lockfile\` in CI only for Dependabot branches, then commit the result.
A minimal workflow example:
\`\`\`yaml
name: Fix pnpm lockfile on Dependabot PRs
on:
pull_request:
branches: [dev]
jobs:
update-lockfile:
if: github.actor == 'dependabot[bot]'
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- uses: actions/checkout@v4
with:
ref: \${{ github.head_ref }}
token: \${{ secrets.GITHUB_TOKEN }}
- uses: pnpm/action-setup@v4
- uses: actions/setup-node@v4
with:
node-version: lts/*
cache: pnpm
- name: Regenerate lockfile
run: pnpm install --no-frozen-lockfile
working-directory: example-apps/react-js
- name: Commit updated lockfile
run: |
git config user.name 'github-actions[bot]'
git config user.email 'github-actions[bot]`@users.noreply.github.com`'
git add example-apps/react-js/pnpm-lock.yaml
git diff --cached --quiet || git commit -m 'chore: regenerate pnpm lockfile'
git push
\`\`\`
---
## Acceptance Criteria
- [ ] \`.github/dependabot.yml\` updated so all Dependabot PRs target \`dev\`
- [ ] CI workflow (or equivalent) ensures \`pnpm-lock.yaml\` is always in sync on Dependabot PRs
- [ ] Existing Dependabot PRs against \`main\` are closed/redirected after config change
Requested by `@Ryan-Millard` via PR `#435`."Length of output: 2859
It tracks both items with acceptance criteria:
(ᵔ◡ᵔ)🐇 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the all-deps group with 13 updates in the /example-apps/react-js directory:
5.100.115.101.06.1.16.1.31.16.01.18.019.2.619.2.719.2.1419.2.1719.2.619.2.77.15.17.17.06.0.46.0.74.1.74.1.910.2.110.5.00.5.20.5.38.0.148.0.164.1.74.1.9Updates
@tanstack/react-queryfrom 5.100.11 to 5.101.0Release notes
Sourced from @tanstack/react-query's releases.
... (truncated)
Changelog
Sourced from @tanstack/react-query's changelog.
Commits
f3d8d2aci: Version Packages (#10774)532bb29fix(tests): disable local coverage instrumentation (#10776)ba6e7beci: Version Packages (#10767)ed20b6dfix(react): do not go into optimistic fetching state when not subscribed (#10...05cf2bcci: Version Packages (#10758)d423168fix(query-core): use built-in NoInfer for generic indexed-access types (#10593)5ff4f69ci: Version Packages (#10755)Updates
html-react-parserfrom 6.1.1 to 6.1.3Release notes
Sourced from html-react-parser's releases.
Changelog
Sourced from html-react-parser's changelog.
Commits
c7df5c3Merge pull request #2267 from remarkablemark/release-please--branches--master...519e59achore(master): release 6.1.36cec8cabuild(deps): bump html-dom-parser from 7.1.0 to 8.0.0 (#2261)eae73e6build(deps-dev): bump eslint in the eslint group across 1 directory (#2264)0681c1ebuild(deps-dev): bump lint-staged from 17.0.5 to 17.0.7 (#2266)02bbd2dbuild(deps-dev): bump@arethetypeswrong/clifrom 0.18.2 to 0.18.3 (#2265)e650321build(deps-dev): bump the commitlint group with 2 updates (#2263)7309166build(deps-dev): bump eslint-plugin-prettier in the eslint group (#2262)668b359build(deps-dev): bump typescript-eslint in the eslint group (#2260)034837eMerge pull request #2259 from remarkablemark/dependabot/github_actions/github...Updates
lucide-reactfrom 1.16.0 to 1.18.0Release notes
Sourced from lucide-react's releases.
Commits
Updates
reactfrom 19.2.6 to 19.2.7Release notes
Sourced from react's releases.
Commits
6117d7cVersion 19.2.7 (#36591)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.
Updates
@types/reactfrom 19.2.14 to 19.2.17Commits
Updates
react-domfrom 19.2.6 to 19.2.7Release notes
Sourced from react-dom's releases.
Commits
6117d7cVersion 19.2.7 (#36591)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for react-dom since your current version.
Updates
react-router-domfrom 7.15.1 to 7.17.0Changelog
Sourced from react-router-dom's changelog.
Commits
195a0d0Release v7.17.0 (#15145)8984d23Release v7.16.0 (#15105)3ed77afchore: formate96962bfix: remove stale unpkg field from react-router-dom (#15075)Updates
react-tooltipfrom 6.0.4 to 6.0.7Release notes
Sourced from react-tooltip's releases.
Commits
1099ad1chore: bump version 6.0.706fa619docs: update react tooltip version to match 6.x range instead of hard coded2dafd9fMerge pull request #1280 from ReactTooltip/fix/anchor-elements-type53ba78afix: support anchor elements with dataset capability instead of only HTMLElement4cc9054docs: bump react-tooltip version to 6.0.6 for V6 docsd4ab374chore: bump version 6.0.6a125115Merge pull request #1278 from ReactTooltip/fix/delegated-event-listener58511a9fix: delegated event listeneraf0a01achore: bump version 6.0.54c94ab8chore: remove matrix of react versionUpdates
@vitest/coverage-v8from 4.1.7 to 4.1.9Release notes
Sourced from @vitest/coverage-v8's releases.
Commits
Updates
eslintfrom 10.2.1 to 10.5.0Release notes
Sourced from eslint's releases.
... (truncated)
Commits
de3b67210.5.0362a518Build: changelog update for 10.5.05ca8c52feat: correct stack tracking in max-nested-callbacks (#20973)b565783feat: report no-with violations at the with keyword (#20971)2ce032ffeat: report max-lines-per-function violations at function head (#20966)732cb3efeat: report max-nested-callbacks violations at function head (#20967)f9c138afeat: report max-depth violations on keywords (#20943)8ae1b5bdocs: Update READMEca7eb90docs: update Node.js prerequisites to include ICU support (#20962)b18bf58chore: update ecosystem plugins (#20959)Updates
eslint-plugin-react-refreshfrom 0.5.2 to 0.5.3Release notes
Sourced from eslint-plugin-react-refresh's releases.
Changelog
Sourced from eslint-plugin-react-refresh's changelog.
Commits
00818e9v0.5.3 [publish]202fc4aFix PascalCase class exported viaexport { Name }incorrectly treated as Re...Updates
vitefrom 8.0.14 to 8.0.16Release notes
Sourced from vite's releases.
Changelog
Sourced from vite's changelog.
Commits
f94df87release: v8.0.16dc245c7fix: reject windows alternate paths (#22572)50b9512fix(deps): reject UNC paths for launch-editor-middleware (#22571)8d1b019release: v8.0.152686d7dfix(deps): update all non-major dependencies (#22511)3052a67chore(deps): update rolldown-related dependencies (#22566)e3cfb9dfix(optimizer): close the rolldown bundle when write() rejects (#22528)6978a9crefactor: correct logic incollectAllModulesfunction (#22562)646dbedfeat: update rolldown to 1.0.3 (#22538)85a0efffix: capitalize error messages and remove spurious space in parse error (#22488)Updates
vitestfrom 4.1.7 to 4.1.9Release notes
Sourced from vitest's releases.
Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions