chore(deps): Bump vue-router from 4.6.3 to 4.6.4#46
chore(deps): Bump vue-router from 4.6.3 to 4.6.4#46dependabot[bot] wants to merge 1 commit intomasterfrom
Conversation
dependabot
bot
added
dependencies
There was a problem hiding this comment.
Pull request overview
This PR updates the vue-router dependency, but contains several critical issues. While the PR title indicates a bump from 4.6.3 to 4.6.4, the actual change is from 4.5.1 to 4.6.4. More critically, the package-lock.json contains widespread incorrect "peer": true markings for direct dependencies including vue, nuxt, and vue-router itself, which could cause dependency resolution problems during installation.
Key changes:
- Updates vue-router version in package.json and package-lock.json
- Adds "peer": true flags to 17 packages in package-lock.json (problematic)
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Updates vue-router from ^4.5.1 to ^4.6.4 (not 4.6.3 to 4.6.4 as described) |
| package-lock.json | Updates vue-router version and integrity hash, but incorrectly adds "peer": true to multiple direct dependencies |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "tailwindcss": "^4.1.17", | ||
| "vue": "^3.5.20", | ||
| "vue-router": "^4.5.1" | ||
| "vue-router": "^4.6.4" |
There was a problem hiding this comment.
The PR title and description indicate this is bumping vue-router from 4.6.3 to 4.6.4, but the actual change shows the version is being updated from "^4.5.1" to "^4.6.4". This is a larger version jump than described (from 4.5.1 to 4.6.4, not 4.6.3 to 4.6.4). The PR description and title should accurately reflect the actual version change being made.
dependabot
bot
force-pushed
the
dependabot/npm_and_yarn/vue-router-4.6.4
branch
from
7ed9e77 to
a1d60ac
Compare
Bumps [vue-router](https://github.com/vuejs/router) from 4.6.3 to 4.6.4. - [Release notes](https://github.com/vuejs/router/releases) - [Commits](vuejs/router@v4.6.3...v4.6.4) --- updated-dependencies: - dependency-name: vue-router dependency-version: 4.6.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
force-pushed
the
dependabot/npm_and_yarn/vue-router-4.6.4
branch
from
a1d60ac to
2071c40
Compare
Bumps vue-router from 4.6.3 to 4.6.4.
Release notes
Sourced from vue-router's releases.
Commits
47b95barelease: vue-router@4.6.4492f75cchore: up tsdown322ef6cchore: up tsdownc000450chore: up tsdown5e43a9dci: fix747f562build: extra stuff1fef52dbuild: remove old depsaf48853build: use conventionalcommits convention84f2431chore: ensure node versioned7a6ceci: setup trusted publishingMaintainer changes
This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for vue-router since your current version.
You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)