chore(deps): bump @astrojs/react from 6.0.4 to 6.0.5 in /web in the all-minor-patch group across 1 directory - #101
Conversation
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
The latest updates on your projects. Learn more about Vercel for GitHub. 2 Skipped Deployments
|
🔒 Dependency Audit Failed — 0 HIGH/CRITICAL vulnerability(s)No structured data available — see workflow logs. To resolve: upgrade the affected packages or add an accepted-risk entry to Allowlist format{
"GHSA-xxxx-xxxx-xxxx": {
"reason": "No fix available; mitigated by WAF rule #123",
"expires": "2026-12-31"
}
} |
🟢 Rampart Security Gate — CLEAN
Totals: 0 critical · 0 high · 0 medium · 0 low Mode: |
|
@dependabot rebase |
ae801cc to
1c32769
Compare
🔒 Dependency Audit Failed — 0 HIGH/CRITICAL vulnerability(s)No structured data available — see workflow logs. To resolve: upgrade the affected packages or add an accepted-risk entry to Allowlist format{
"GHSA-xxxx-xxxx-xxxx": {
"reason": "No fix available; mitigated by WAF rule #123",
"expires": "2026-12-31"
}
} |
|
@dependabot rebase |
Bumps the all-minor-patch group with 1 update in the /web directory: [@astrojs/react](https://github.com/withastro/astro/tree/HEAD/packages/integrations/react). Updates `@astrojs/react` from 6.0.4 to 6.0.5 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/react/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/react@6.0.5/packages/integrations/react) --- updated-dependencies: - dependency-name: "@astrojs/react" dependency-version: 6.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
1c32769 to
50d76e2
Compare
🔒 Dependency Audit Failed — 0 HIGH/CRITICAL vulnerability(s)No structured data available — see workflow logs. To resolve: upgrade the affected packages or add an accepted-risk entry to Allowlist format{
"GHSA-xxxx-xxxx-xxxx": {
"reason": "No fix available; mitigated by WAF rule #123",
"expires": "2026-12-31"
}
} |
1 similar comment
🔒 Dependency Audit Failed — 0 HIGH/CRITICAL vulnerability(s)No structured data available — see workflow logs. To resolve: upgrade the affected packages or add an accepted-risk entry to Allowlist format{
"GHSA-xxxx-xxxx-xxxx": {
"reason": "No fix available; mitigated by WAF rule #123",
"expires": "2026-12-31"
}
} |
…lockfile Takes the contents of dependabot #101 (web: @astrojs/react 6.0.4 -> 6.0.5) and 19.2.8, tailwindcss, @astrojs/check, @types/react, @types/react-dom). The bumps themselves were never the problem - both PRs failed because they updated a member manifest against a member lockfile that pnpm does not use. Now that 0b69f05 has left one lockfile at the workspace root, the same changes resolve cleanly: pnpm install --frozen-lockfile passes, which is the exact command that was failing in CI. Verified locally: frozen install clean, web builds, org builds (35 pages). Note this only touches react in org/, which is a browser Astro app. The workspace-wide react version is deliberately untouched - mobile/ and tv/ are in this workspace too.
|
Superseded by db0d4f3 on main, which applies these exact bumps against the workspace root lockfile. These PRs could not pass as-authored: they updated a member package.json while dependabot.yml pointed at /web and /org as standalone projects, so CI's |
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
1 participant
Bumps the all-minor-patch group with 1 update in the /web directory: @astrojs/react.
Updates
@astrojs/reactfrom 6.0.4 to 6.0.5Release notes
Sourced from @astrojs/react's releases.
Changelog
Sourced from @astrojs/react's changelog.
Commits
2fdf731[ci] release (#17849)