Bump @babel/core from 7.29.0 to 7.29.7 in the npm-and-yarn group across 1 directory by dependabot[bot] · Pull Request #289 · rapidsai/jupyterlab-nvdashboard

dependabot · 2026-06-23T20:53:54Z

Bumps the npm-and-yarn group with 1 update in the / directory: @babel/core.

Updates @babel/core from 7.29.0 to 7.29.7

Release notes

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

babel-generator

#18014 Catchup source map position in preserveFormat (@nicolo-ribaudo)

babel-core

#18001 [7.x packport]Improve input source map handling (@JLHwung)

babel-core, babel-generator

#17998 Preserve original identifier names from input sourcemaps (#17992) (@Andarist)

Committers: 3

Huáng Jùnliàng (@JLHwung)

Mateusz Burzyński (@Andarist)

Nicolò Ribaudo (@nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

babel-preset-env

Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

babel-plugin-transform-modules-systemjs

#17974 [7.x backport]fix(systemjs): improve module string name support (@JLHwung)

Committers: 1

Huáng Jùnliàng (@JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

babel-parser

#17923 Support flow extends bound (@JLHwung)

🐛 Bug Fix

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

#17931 fix(decorators): replace super within all removed static elements (@JLHwung)

babel-register

#17915 Fix thread synchronization issues in @babel/register (@liuxingbaoyu)

babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

#17788 Add bugfix plugin for Safari array rest destructuring bug (@JLHwung)

💅 Polish

babel-parser

... (truncated)

Commits

4fba754 v7.29.7
04ea6b2 v7.29.6
99f498a [7.x packport]Improve input source map handling (#18001)
feba0a3 Preserve original identifier names from input sourcemaps (#17992) (#17998)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm-and-yarn group with 1 update in the / directory: [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core). Updates `@babel/core` from 7.29.0 to 7.29.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core) --- updated-dependencies: - dependency-name: "@babel/core" dependency-version: 7.29.7 dependency-type: indirect dependency-group: npm-and-yarn ... Signed-off-by: dependabot[bot] <support@github.com>

copy-pr-bot · 2026-06-23T20:53:57Z

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

jameslamb · 2026-06-23T21:08:50Z

Dependabot keeps opening PRs 1 at a time, despite us wanting them to be grouped. I'm not really sure why and haven't been able to figure it out :/

jameslamb · 2026-06-23T21:08:59Z

/ok to test 44c5d6c

jameslamb · 2026-06-23T21:40:43Z

/ok to test 60f295f

ncclementi · 2026-06-23T23:30:32Z

Dependabot keeps opening PRs 1 at a time, despite us wanting them to be grouped. I'm not really sure why and haven't been able to figure it out :/

I was reading about it, and maybe there is something on the UI security settings that might be overriding this? I'm not sure why this is happening.

jameslamb · 2026-06-24T02:44:02Z

I'm not sure exactly why, but discussion in dependabot/dependabot-core#13919 suggests that removing patterns: "*" fixes this.

We can try that.

jameslamb

Let's not merge this.

I want to test dependabot grouping once #290 is merged. Hoping that once that's in, dependabot will close this PR and open a new one with the 2 package updates it currently wants to make.

We attempted to have `dependabot` group all updates into a single PR in #267 , but seems like it isn't working: #289 (comment) In dependabot/dependabot-core#13919, there's a suggestion that removing `patterns: ["*"]` from the config might help. Let's try it. Authors: - James Lamb (https://github.com/jameslamb) Approvers: - Gil Forsyth (https://github.com/gforsyth) URL: #290

jameslamb · 2026-06-24T15:06:23Z

I tried manually re-running dependabot after #290 but it didn't create a new PR or close this one. Gonna try closing it and running again.

dependabot · 2026-06-24T15:06:26Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

jameslamb · 2026-06-24T20:31:32Z

sigh, dependabot refused to open a new PR because it saw this branch sitting here (I think)

So I've restored this branch and re-opened this.

But it's even more confusing.... now here on this PR I see this:

Your .github/dependabot.yml contained invalid details
Dependabot encountered the following error when parsing your .github/dependabot.yml:

The property '#/updates/0/groups/npm-and-yarn' of type object did not match one or more of the required schemas
Please update the config file to conform with Dependabot's specification.

https://github.com/rapidsai/jupyterlab-nvdashboard/pull/289/checks?check_run_id=83294655025

See #289 (comment) #290 made this project's dependabot configuration invalid. Still not really clear to me what needs to change to enable grouping to work the way we want, but I'm hoping that adding at least one more specific thing to the `npm-and-yarn` rule will help. https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#groups-- is ambiguous about how this is supposed to be formatted.

jameslamb · 2026-06-24T20:49:13Z

Looks like #292 made the config validator happy, at least: https://github.com/rapidsai/jupyterlab-nvdashboard/pull/289/checks?check_run_id=83298943365

jameslamb · 2026-06-24T20:49:25Z

/ok to test 40338ba

jameslamb · 2026-06-24T21:04:20Z

This is a +0, -0 PR (its changes are redundant with #289) but I think we still need to merge it to help dependabot understand that this update was made 🤷🏻

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 23, 2026

dependabot Bot requested a review from a team as a code owner June 23, 2026 20:53

jameslamb approved these changes Jun 23, 2026

View reviewed changes

deduplicate lock file

60f295f

jameslamb mentioned this pull request Jun 24, 2026

dependabot: fix grouping #290

Merged

jameslamb requested changes Jun 24, 2026

View reviewed changes

jameslamb closed this Jun 24, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/npm-and-yarn-1d22a351cb branch June 24, 2026 15:06

jameslamb restored the dependabot/npm_and_yarn/npm-and-yarn-1d22a351cb branch June 24, 2026 20:25

jameslamb reopened this Jun 24, 2026

Merge branch 'main' into dependabot/npm_and_yarn/npm-and-yarn-1d22a351cb

d55e612

jameslamb mentioned this pull request Jun 24, 2026

fix dependabot grouping (again) #292

Merged

Merge branch 'main' into dependabot/npm_and_yarn/npm-and-yarn-1d22a351cb

40338ba

jameslamb approved these changes Jun 24, 2026

View reviewed changes

jameslamb merged commit 7b74980 into main Jun 24, 2026
16 checks passed

jameslamb deleted the dependabot/npm_and_yarn/npm-and-yarn-1d22a351cb branch June 24, 2026 21:04

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 23, 2026

v7.29.7 (2026-05-25)

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

v7.29.4 (2026-05-05)

🐛 Bug Fix

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

Uh oh!

copy-pr-bot Bot commented Jun 23, 2026

Uh oh!

jameslamb commented Jun 23, 2026

Uh oh!

jameslamb commented Jun 23, 2026

Uh oh!

jameslamb commented Jun 23, 2026

Uh oh!

ncclementi commented Jun 23, 2026

Uh oh!

jameslamb commented Jun 24, 2026

Uh oh!

jameslamb left a comment

Choose a reason for hiding this comment

Uh oh!

jameslamb commented Jun 24, 2026

Uh oh!

dependabot Bot commented on behalf of github Jun 24, 2026

Uh oh!

jameslamb commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jameslamb commented Jun 24, 2026

Uh oh!

jameslamb commented Jun 24, 2026

Uh oh!

jameslamb commented Jun 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jameslamb commented Jun 24, 2026 •

edited

Loading