Skip to content

Commit ca0c82c

Browse files
svidgensvidgen
committed
chore(deps): minor and patch dependency updates
- Bump @aws-sdk/* clients from ^3.919.0 to ^3.1080.0 across all packages - Bump @smithy/node-http-handler to ^4.9.3 and @smithy/util-retry to ^4.5.6 - Bump @babel/core from ^7.23.2 to ^7.29.7 - Bump @types/node from ^20.9.0 to ^20.19.43 - Bump semver from ^7.5.4 to ^7.8.5 - Bump proxy-agent from ^6.3.0 to ^6.5.0 - Bump ejs from ^3.1.7 to ^3.1.10 (security patch) - Bump node-fetch from ^2.6.7 to ^2.7.0 - Bump ts-jest from ^29.0.0 to ^29.4.11 - Bump eslint-plugin-import from ^2.22.1 to ^2.32.0 - Bump various @types/* packages to latest patch/minor - Subsumes changes from dependabot PRs #14945, #14946 jstreemap intentionally kept at 1.28.2 per PR #14937.
0 parents  commit ca0c82c

9,375 files changed

Lines changed: 1262891 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.agent-docs/DEPENDABOT.md‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# Dependabot Upgrade Workflow
2+
3+
Guide for handling Dependabot alerts, dependency upgrades, and security fixes.
4+
5+
## Checking Dependabot Alerts
6+
7+
**Prerequisites:** GitHub CLI (`gh`) must be installed and authenticated.
8+
9+
Install:
10+
11+
```bash
12+
# macOS
13+
brew install gh
14+
15+
# Windows
16+
winget install GitHub.cli
17+
18+
# Linux
19+
# See https://github.com/cli/cli#installation
20+
```
21+
22+
Authenticate:
23+
24+
```bash
25+
gh auth login
26+
```
27+
28+
Check alerts:
29+
30+
```bash
31+
npx ts-node scripts/check-dependabot.ts
32+
```
33+
34+
## Workflow for Agents
35+
36+
When asked to handle dependency upgrades, security fixes, or Dependabot issues:
37+
38+
### 1. Check Outstanding Alerts
39+
40+
Run the Dependabot checker to get current alerts.
41+
42+
### 2. Summarize and Categorize
43+
44+
Group alerts into categories:
45+
46+
- **Dependency updates only** - Simple version bumps in package.json
47+
- **Code changes required** - Breaking changes needing code modifications
48+
- **Security fixes** - CVE patches (prioritize by severity: critical > high > medium > low)
49+
50+
Present summary to user with counts per category.
51+
52+
### 3. Ask User for Scope
53+
54+
Confirm what to address:
55+
56+
- All alerts in a single PR?
57+
- Only dependency updates?
58+
- Only security fixes above a certain severity?
59+
- Specific packages?
60+
61+
### 4. Make Changes
62+
63+
For each change:
64+
65+
- Update package.json (or relevant package files)
66+
- Run `yarn install` to update yarn.lock
67+
- Run `yarn build` to verify build succeeds
68+
- Run `yarn test` to verify tests pass
69+
- Fix any breaking changes if needed
70+
71+
### 5. Commit and Push
72+
73+
```bash
74+
git checkout -b dependabot-fixes-YYYY-MM-DD
75+
git add .
76+
git commit -m "fix: address dependabot alerts
77+
78+
- Update package1 to vX.Y.Z
79+
- Update package2 to vX.Y.Z
80+
- Fix breaking changes in ..."
81+
git push origin dependabot-fixes-YYYY-MM-DD
82+
```
83+
84+
### 6. E2E Test
85+
86+
Follow the e2e workflow from AGENTS.md:
87+
88+
```bash
89+
yarn cloud-e2e
90+
yarn e2e-monitor {batchId}
91+
```
92+
93+
### 7. Resolve Errors
94+
95+
- If e2e tests fail due to code issues, fix and repeat from step 4
96+
- If timeouts/quota errors, retry the build
97+
- Ask user for guidance if errors persist after multiple attempts
98+
99+
## Notes
100+
101+
- Always run local tests before pushing
102+
- Group related updates together when possible
103+
- Document breaking changes in commit messages
104+
- Check for peer dependency conflicts after updates

0 commit comments

Comments
 (0)