build(deps-dev): bump the npm-dependencies group across 1 directory with 5 updates - #70
dependabot[bot] wants to merge 1 commit into
Conversation
…ith 5 updates Bumps the npm-dependencies group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.1` | `26.5.0` | | [eslint](https://github.com/eslint/eslint) | `10.9.1` | `10.10.0` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.4.1` | `17.5.0` | | [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.69.0` | `8.70.0` | Updates `@types/node` from 26.4.1 to 26.5.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint` from 10.9.1 to 10.10.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.9.1...v10.10.0) Updates `lint-staged` from 17.4.1 to 17.5.0 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v17.4.1...v17.5.0) Updates `typescript` from 6.0.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v6.0.3...v7.0.2) Updates `typescript-eslint` from 8.69.0 to 8.70.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: eslint dependency-version: 10.10.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: lint-staged dependency-version: 17.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-dependencies - dependency-name: typescript-eslint dependency-version: 8.70.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary
This grouped Dependabot bump (@types/node, eslint, lint-staged, typescript, typescript-eslint) is not installable as-is: bumping typescript to 7.0.2 (a major, TypeScript-Go-based release) falls outside typescript-eslint@8.70.0's own declared peerDependencies.typescript range (>=4.8.4 <6.1.0, unchanged from 8.69.0), and with this repo's save-exact=true + default (non-legacy) peer resolution, that produces a hard ERESOLVE failure on npm ci. This is directly confirmed by the PR's own CI: Commitlint, Typecheck, Lint, and Format all fail at the install step (see inline comment for the exact error).
The other four bumps (@types/node 26.4.1→26.5.0, eslint 10.9.1→10.10.0, lint-staged 17.4.1→17.5.0, typescript-eslint 8.69.0→8.70.0) are routine and unproblematic in isolation — the issue is specifically the typescript major riding along in the same group.
Findings
- 🔴 Blocker
[stack-default]—typescript6.0.3→7.0.2 breaksnpm civia ERESOLVE againsttypescript-eslint's peer range. See inline comment onpackage.json.
Recommendation
Recommend excluding typescript major-version bumps from this Dependabot group (or adding an ignore rule for it) so routine dependency updates aren't blocked on a major TypeScript upgrade that needs typescript-eslint (and this repo's own type-aware lint config) to catch up first.
PR title and description are Dependabot's own standard, complete summary — no changes needed there. No unready-for-review signal in the diff, so draft conversion doesn't apply. This is the first review on this PR, so there are no prior threads to resolve.
| "typescript": "7.0.2", | ||
| "typescript-eslint": "8.70.0" |
There was a problem hiding this comment.
🔴 Blocker [stack-default]
This bumps typescript 6.0.3 → 7.0.2 — a major version, and specifically TypeScript 7's native/Go-based rewrite (the lockfile now pulls in new optional @typescript/typescript-{win32,darwin,linux,freebsd}-* native binary packages). typescript-eslint is only bumped 8.69.0 → 8.70.0 in the same PR, and every @typescript-eslint/* sub-package still declares "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } — unchanged by this release. typescript@6.0.3 satisfied that range; typescript@7.0.2 does not.
Because .npmrc sets save-exact=true with no legacy-peer-deps/strict-peer-deps override, npm's default strict peer resolution applies, and this actually breaks npm ci outright. Confirmed directly from this PR's own CI run — Commitlint, Typecheck, Lint, and Format all fail at the install step with:
npm error ERESOLVE unable to resolve dependency tree
npm error Found: typescript@7.0.2
npm error peer typescript@">=4.8.4 <6.1.0" from typescript-eslint@8.70.0
npm error Conflicting peer dependency: typescript@6.0.3
This isn't a theoretical compatibility risk, it's a PR that cannot be installed as-is. Since the group bundles four routine minor/patch bumps with this one breaking major, the fix is to drop typescript from this update (Dependabot's own major-version separation, or an ignore rule for typescript major versions in this group) and land the other four on their own, rather than blocking all five on a typescript-eslint release that doesn't yet support TypeScript 7.
There was a problem hiding this comment.
This review is against commit 99667f0, which is byte-identical to the commit the prior github-actions[bot] review (CHANGES_REQUESTED) already reviewed — no new commit has been pushed since. Per "read existing feedback first," I have not re-posted a duplicate inline comment; instead I independently re-verified the standing finding rather than trusting it at face value.
🔴 Blocker [policy] — verified, still standing: the prior inline comment on package.json (bumping typescript 6.0.3 → 7.0.2 while leaving typescript-eslint at a version whose peerDependencies.typescript range is >=4.8.4 <6.1.0) is correct and unresolved. I confirmed this independently rather than assuming the earlier automated review was right:
- Grepped the
package-lock.jsondiff directly: everytypescript-eslintsub-package'speerDependenciesentry (@typescript-eslint/scope-manager, etc.) still declares">=4.8.4 <6.1.0"after the bump to 8.70.0 — unchanged from before the PR. - Read
.npmrcdirectly: it contains onlysave-exact=true, with nolegacy-peer-depsorstrict-peer-deps=falseoverride, so npm's default strict peer-dependency resolution applies. - Together these mean
npm ciwill fail withERESOLVEon this lockfile as committed, which matches the CI failure the prior review already quoted.
This is a Dependabot grouped update (npm-dependencies, 5 packages in one PR/commit), so the fix isn't editing a line in this diff — it's excluding typescript from the group (or capping it below 7) in .github/dependabot.yml so a typescript-eslint-incompatible major doesn't get bundled with routine minor/patch bumps again. @claude fix this won't resolve it by itself since the incompatibility is between two upstream packages' own declared version ranges, not something in this repo's code — the actionable fix is a Dependabot config change (or a typescript-eslint bump to a release that accepts TS 7, once one exists) outside this PR.
PR title/description: build(deps-dev): bump the npm-dependencies group across 1 directory with 5 updates is Dependabot's own standard, accurate title for a grouped update — no correction needed.
No other findings in scope. Requesting changes for the same reason as the prior review: this PR should not merge as-is, since it will fail npm ci.
|
🗜️ Headroom context compression
|
Bumps the npm-dependencies group with 5 updates in the / directory:
26.4.126.5.010.9.110.10.017.4.117.5.06.0.37.0.28.69.08.70.0Updates
@types/nodefrom 26.4.1 to 26.5.0Commits
Updates
eslintfrom 10.9.1 to 10.10.0Release notes
Sourced from eslint's releases.
Commits
3f20a5710.10.0f4e5284Build: changelog update for 10.10.0bb47dc6fix: update dependency file-entry-cache to v11 (#20801)427ac0afix: use format strings in debug calls (#21247)b3d876bchore: disable npm audit in ecosystem tests (#21306)9d81532fix: support__proto__in/* exported */comments (#21261)264b434feat: adddandvflags tono-unexpected-multiline(#21305)1696682ci: restore EMFILE test on Node.js 26 (#21297)2c7f5d6chore: update github/codeql-action action to v4.37.9 (#21296)87e0a08fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282)Updates
lint-stagedfrom 17.4.1 to 17.5.0Release notes
Sourced from lint-staged's releases.
Changelog
Sourced from lint-staged's changelog.
Commits
dcb59f6Merge pull request #1846 from lint-staged/changeset-release/main9c8c6dcchore(changeset): release586466fMerge pull request #1849 from lint-staged/improve-intent-to-add45eda5frefactor: improve--intent-to-adddetection26372e3Merge pull request #1848 from lint-staged/fix-color-detectiond718cccfix: honor FORCE_COLOR/NO_COLOR env variables in non-TTY streamsbe78a51Merge pull request #1847 from lint-staged/intent-to-addf9063b7feat: refuse to run when files were staged with--intent-to-adda767299Merge pull request #1845 from lint-staged/updates61ffd25style: add VS Code extension configUpdates
typescriptfrom 6.0.3 to 7.0.2Release notes
Sourced from typescript's releases.
Commits
1e4744dMerge branch 'main' into ts7-releasea5a219cmicrosoft/typescript-go#4558ecfe30dUpdate status localization5de25b5Hide executable name in TypeScript statusd7ce74aShow bundled TypeScript version for packaged servers29be66aCorrect TS 7 release version to 7.0.2ed2bd1bMerge branch 'main' into ts7-release8873075Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...9427131Set up stable / nightly extension split, other prep (microsoft/typescript-go#...d4eaca5microsoft/typescript-go#4549Maintainer changes
This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.
Updates
typescript-eslintfrom 8.69.0 to 8.70.0Release notes
Sourced from typescript-eslint's releases.
Changelog
Sourced from typescript-eslint's changelog.
Commits
7ee7608chore(release): publish 8.70.04586535fix(eslint-plugin): [no-deprecated] report deprecated imported values used in...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions