Skip to content

chore(deps-dev): bump jsdom from 29.1.1 to 30.0.1 - #3412

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/jsdom-30.0.1
Open

chore(deps-dev): bump jsdom from 29.1.1 to 30.0.1#3412
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/jsdom-30.0.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps jsdom from 29.1.1 to 30.0.1.

Release notes

Sourced from jsdom's releases.

v30.0.1

  • Fixed getComputedStyle() with calc() and other functions throwing an exception, which regressed in v30.0.0. (@​asamuzaK)
  • Sped up up range operations on large documents (@​leonidaz)

v30.0.0

Breaking changes:

  • Node.js minimum version raised to ^22.22.2 || ^24.15.0 || >=26.0.0.

Other changes:

  • Added CSS.escape() and CSS.supports() functions. (@​asamuzaK)
  • Added 'background-position-x' and 'background-position-y' CSS properties. (@​olagokemills)
  • Fixed getComputedStyle() to convert length values into pixels. (@​asamuzaK)
  • Fixed CSS function serialization, e.g., in the return value of getPropertyValue(). (@​asamuzaK)
  • Fixed the type of error thrown by document.evaluate() (@​dokson)
Commits
  • 6584485 30.0.1
  • 0c51df6 Update dependencies and dev dependencies
  • 32adb34 Bump @​asamuzakjp/dom-selector
  • 70f014a Speed up range operations on large documents
  • 250d7ee Partially fix getComputedStyle with calc()
  • 20a01fc 30.0.0
  • 8c8e583 Precompute WPT expectation matches
  • f32245c Bump Node.js floor and dependencies
  • 03ef23b Add background-position longhands
  • ded056f Test CSS.escape() with numeric IDs
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 5, 2026
@vercel

vercel Bot commented Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
clawhub Ready Ready Preview Aug 11, 2026 5:58pm

Request Review

@openclaw-barnacle openclaw-barnacle Bot added the triage: risky-infra Candidate: infra/CI/release change needs maintainer review. label Aug 5, 2026
@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P3 Low-priority cleanup, docs, polish, ergonomics, or speculative work. labels Aug 5, 2026
@clawsweeper

clawsweeper Bot commented Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs changes before merge. Reviewed August 11, 2026, 2:03 PM ET / 18:03 UTC.

ClawSweeper review

What this changes

The PR upgrades the development-only jsdom test environment from 29.1.1 to 30.0.1 and refreshes Bun’s resolved dependency graph.

Merge readiness

⛔ Blocked by patch quality or review findings - 7 items remain

Keep open: the refreshed branch still removes the recorded SHA-512 digest for the unchanged Carapace Git dependency, so the jsdom-only update is not safe to merge yet.

Priority: P2
Reviewed head: a30aeac49d70cbe4738e9367a30fbe674b5a3768

Review scores

Measure Result What it means
Overall readiness 🧂 unranked krab (1/6) PR readiness rating was derived from proof quality, review findings, security review, and reviewer confidence.
Proof confidence 🌊 off-meta tidepool Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Patch quality 🧂 unranked krab (1/6) Security review found an item that needs attention.

Verification

Check Result Evidence
Real behavior Not applicable Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Evidence reviewed 4 items Unrelated integrity metadata removal: The PR changes the jsdom resolution but also removes the fourth SHA-512 field from the unchanged @openclaw/carapace Git dependency; current main retains that field.
Frozen-lockfile CI contract: The shared CI setup installs dependencies with --frozen-lockfile, so the reviewed lockfile is the dependency-resolution and verification record used by CI.
Test-runtime dependency: Current main declares jsdom 29.1.1 as a direct development dependency; the proposed manifest update is therefore limited to the test environment.
Findings 1 actionable finding [P2] Retain Carapace’s lockfile integrity digest
Security Needs attention Carapace integrity digest is removed: The proposed Bun lockfile deletes the SHA-512 value for the unchanged @openclaw/carapace Git package, expanding the dependency update beyond jsdom and reducing retained integrity metadata.

How this fits together

ClawHub’s Vitest suite uses jsdom to emulate browser APIs for frontend tests. Bun resolves that test dependency graph from package.json and bun.lock before CI runs the suite.

flowchart LR
  A[Package manifest] --> B[Bun lockfile]
  B --> C[Installed test dependencies]
  C --> D[Vitest jsdom environment]
  D --> E[Frontend tests]
Loading

Before merge

  • Retain Carapace’s lockfile integrity digest (P2) - This jsdom update removes the SHA-512 field for the unchanged Carapace Git dependency. Current main records that digest, so the clean merge would weaken dependency verification outside this PR’s stated scope; restore the identical field before merging.
  • Resolve security concern: Carapace integrity digest is removed - The proposed Bun lockfile deletes the SHA-512 value for the unchanged @openclaw/carapace Git package, expanding the dependency update beyond jsdom and reducing retained integrity metadata.
  • Resolve merge risk (P1) - Merging would retain an unrelated removal of the SHA-512 metadata for the pinned Carapace Git dependency.
  • Resolve merge risk (P1) - The PR body contains release notes only; it does not show an after-fix jsdom test run on the proposed dependency graph.
  • Complete next step (P2) - The remaining blocker is a narrow mechanical lockfile repair, although real behavior proof must still be supplied before merge.
  • Improve patch quality - Resolve the security review concern or explain why the changed path is safe.
  • Improve patch quality - Address the highest-priority review finding and re-run the changed-surface validation.

Findings

  • [P2] Retain Carapace’s lockfile integrity digest — bun.lock:448
  • [medium] Carapace integrity digest is removed — bun.lock:448
Agent review details

Security

Needs attention: The lockfile diff weakens recorded verification metadata for an unchanged Git dependency.

Review metrics

Metric Value Why it matters
Dependency surface 2 files; +17/-17 The direct dependency bump is small, but the lockfile includes an unrelated integrity-metadata deletion.

Merge-risk options

Maintainer options:

  1. Preserve the existing Git-package digest (recommended)
    Restore the unchanged Carapace SHA-512 field and provide after-fix frozen-install and test evidence before merging the jsdom update.

Technical review

Best possible solution:

Keep the jsdom upgrade narrow by restoring the unchanged Carapace digest, then attach a redacted successful frozen-install and jsdom-backed test run before merge.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency-maintenance PR, not a reported product failure.

Is this the best way to solve the issue?

No: the jsdom update is a reasonable path, but the unrelated deletion of existing Carapace integrity metadata must be reversed first.

Full review comments:

  • [P2] Retain Carapace’s lockfile integrity digest — bun.lock:448
    This jsdom update removes the SHA-512 field for the unchanged Carapace Git dependency. Current main records that digest, so the clean merge would weaken dependency verification outside this PR’s stated scope; restore the identical field before merging.
    Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against e29b59c7eb22.

Labels

Label changes:

  • add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
  • remove rating: 🦐 gold shrimp: Current PR rating is rating: 🧂 unranked krab, so this older rating label is no longer current.

Label justifications:

  • P2: This major development-test dependency upgrade can affect repository test behavior but does not directly alter production runtime behavior.
  • merge-risk: 🚨 security-boundary: The proposed lockfile removes verification metadata for an unchanged Git dependency.
  • rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
  • status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.

Evidence

Security concerns:

  • [medium] Carapace integrity digest is removed — bun.lock:448
    The proposed Bun lockfile deletes the SHA-512 value for the unchanged @openclaw/carapace Git package, expanding the dependency update beyond jsdom and reducing retained integrity metadata.
    Confidence: 0.99

Acceptance criteria:

  • [P1] bun install --frozen-lockfile.
  • [P1] bun run ci:unit.

What I checked:

  • Unrelated integrity metadata removal: The PR changes the jsdom resolution but also removes the fourth SHA-512 field from the unchanged @openclaw/carapace Git dependency; current main retains that field. (bun.lock:448, a30aeac49d70)
  • Frozen-lockfile CI contract: The shared CI setup installs dependencies with --frozen-lockfile, so the reviewed lockfile is the dependency-resolution and verification record used by CI. (.github/actions/setup-bun/action.yml:15, e29b59c7eb22)
  • Test-runtime dependency: Current main declares jsdom 29.1.1 as a direct development dependency; the proposed manifest update is therefore limited to the test environment. (package.json:173, e29b59c7eb22)
  • Area provenance: Recent history identifies Patrick Erichsen’s Carapace upgrade as the relevant prior dependency-lockfile work; the current branch is not on main because main still resolves jsdom 29.1.1. (bun.lock:452, 2c7c40f001be)

Likely related people:

  • Patrick Erichsen: Authored the recent Carapace upgrade and several adjacent package/lockfile updates on current main. (role: recent dependency-lockfile contributor; confidence: high; commits: 2c7c40f001be, 109384dcb8f0; files: package.json, bun.lock)
  • Vincent Koc: Authored the retrying frozen-lockfile install workflow that consumes this lockfile in CI. (role: CI dependency-install contributor; confidence: medium; commits: 74113da8a9fa; files: .github/actions/setup-bun/action.yml)

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)
  • reviewed 2026-08-05T16:10:08.431Z sha e2ac22a :: needs maintainer review before merge. :: none
  • reviewed 2026-08-05T17:58:35.527Z sha e2ac22a :: needs changes before merge. :: [P2] Retain Carapace’s lockfile integrity digest

@clawsweeper clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 security-boundary 🚨 Merging this PR could weaken sandboxing, authorization, credentials, or sensitive data. and removed rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P3 Low-priority cleanup, docs, polish, ergonomics, or speculative work. labels Aug 5, 2026
@dependabot
chore(deps-dev): bump jsdom from 29.1.1 to 30.0.1
a30aeac 
Bumps [jsdom](https://github.com/jsdom/jsdom) from 29.1.1 to 30.0.1.
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v29.1.1...v30.0.1)

---
updated-dependencies:
- dependency-name: jsdom
  dependency-version: 30.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/bun/jsdom-30.0.1 branch from e2ac22a to a30aeac Compare August 11, 2026 17:54
@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. and removed rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. labels Aug 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code merge-risk: 🚨 security-boundary 🚨 Merging this PR could weaken sandboxing, authorization, credentials, or sensitive data. P2 Normal backlog priority with limited blast radius. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. triage: risky-infra Candidate: infra/CI/release change needs maintainer review.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants