chore(deps): bump marked from 9.1.6 to 18.0.7 in /infra - #1567
chore(deps): bump marked from 9.1.6 to 18.0.7 in /infra#1567dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [marked](https://github.com/markedjs/marked) from 9.1.6 to 18.0.7. - [Release notes](https://github.com/markedjs/marked/releases) - [Commits](markedjs/marked@v9.1.6...v18.0.7) --- updated-dependencies: - dependency-name: marked dependency-version: 18.0.7 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b7b6cbb2a0
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| "hash-wasm": "4.12.0", | ||
| "mammoth": "^1.11.0", | ||
| "marked": "^9.0.0", | ||
| "marked": "^18.0.7", |
There was a problem hiding this comment.
This changes only infra/package.json, but infra/bun.lock still lists the workspace dependency as marked: "^9.0.0" and resolves marked@9.1.6. The cdk-validate workflow installs infra dependencies with cd infra && bun install --frozen-lockfile (.github/workflows/ci.yml lines 415-418), so this commit will fail that install because the lockfile no longer matches the manifest, and the security bump is not actually reproducible until the updated lockfile is committed.
Useful? React with 👍 / 👎.
|
🤖 pr-fix routine: blocked —
|
| File | marked |
|---|---|
infra/package.json (line 51) |
^18.0.7 ← bumped by this PR |
infra/bun.lock (line 1125) |
marked@9.1.6 ← not regenerated |
Nothing about the failure is specific to marked; it is a pure lockfile-drift signature.
Why this routine can't fix it (re-verified this fire, not assumed)
The fix is mechanical — bun install in /infra, commit infra/bun.lock — but is impossible from the routine sandbox:
bun installin/infrafails outright:error: GET https://registry.npmjs.org/marked - 403→marked@^18.0.7 failed to resolve.registry.npmjs.orgreturns 403 both directly and forced through the agent proxy. The proxy README classifies this as an organization egress-policy denial and directs that it be reported rather than routed around — so no mirror or alternate-registry workaround.- The local Bun cache is empty (0 entries) and neither
node_modules/norinfra/node_modules/exists, so nothing resolves offline either.
Hand-writing the lockfile would mean fabricating SHA-512 integrity hashes, which I won't do.
Corrected scope of the backlog
Every open Dependabot PR that bumps a JS dependency is blocked on this one mechanical step — in both lockfiles:
- Root
bun.lock: chore(deps): bump the minor-and-patch group with 2 updates #1568, chore(deps): bump @ai-sdk/react from 3.0.242 to 4.0.47 #1569, chore(deps): bump ai from 6.0.240 to 7.0.44 #1570, chore(deps-dev): bump @testing-library/jest-dom from 6.10.0 to 7.0.0 #1571, chore(deps): bump @ai-sdk/amazon-bedrock from 4.0.145 to 5.0.38 #1572, chore(deps): bump @ai-sdk/google from 3.0.103 to 4.0.29 #1573, chore(deps): bump @ai-sdk/openai from 3.0.90 to 4.0.25 #1574, chore(deps): bump @ai-sdk/mcp from 1.0.52 to 2.0.20 #1575, chore(deps): bump @ai-sdk/azure from 3.0.95 to 4.0.26 #1576 infra/bun.lock: build(deps-dev): bump @types/node from 26.1.1 to 26.1.2 in /infra in the minor-and-patch group across 1 directory #1566, chore(deps): bump marked from 9.1.6 to 18.0.7 in /infra #1567 ← previously mis-triaged as unaffected
Genuinely unaffected: #1562 and #1564 — they only touch .github/workflows/**, carry no lockfile, and are fully green right now.
What a human needs to do
- This PR (works today):
git checkout dependabot/npm_and_yarn/infra/dev/marked-18.0.7 && cd infra && bun install && git add bun.lock && git commit && git push - Systemic (clears all 11): have CI regenerate and commit both lockfiles on Dependabot branches, or relax
--frozen-lockfilefor Dependabot-authored branches.⚠️ Both changes live under.github/workflows/**, which this routine is forbidden from editing — autonomous runs cannot approve workflow-file changes.
Separate concern once the lockfile is valid
marked 9.1.6 → 18.0.7 is a nine-major-version jump. Green CI here should not be read as an automatic merge signal — marked v10+ removed the deprecated callback/async API and changed marked.parse() return typing, so whatever renders Markdown in /infra wants a real read before merging.
The routine will not pick this PR up again until someone removes the pr-fix-stuck label.
Generated by Claude Code
krishagel
added
the
pr-fix-stuck
Claude
1 participant
Bumps marked from 9.1.6 to 18.0.7.
Release notes
Sourced from marked's releases.
... (truncated)
Commits
a8971a1chore(release): 18.0.7 [skip ci]d899c2echore(deps): bump actions/setup-node from 6 to 7 (#4025)7fbf82echore(deps-dev): bump semantic-release from 25.0.7 to 25.0.8 (#4026)738edf2chore(deps-dev): bump brace-expansion from 5.0.2 to 5.0.6 (#4027)9154f8ffix: Avoid O(n^2) masked source rebuild in inline tokenizer (#4017)f945fc5fix: Avoid O(n^2) backtracking in HTML block close and tilde interrupt regexe...3f144a0fix: keep empty list after blockquote as a sibling block (#4004)0de7188fix: preserve code spans adjacent to tildes (#4012)f056437fix: Recognize setext headings whose first line starts with # (#4015)12bfa94chore(deps-dev): bump semantic-release from 25.0.5 to 25.0.7 (#4020)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for marked since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)