chore(deps): bump lucide-react from 1.16.0 to 1.41.0 in /src/frontend - #773
dependabot[bot] wants to merge 2 commits into
Conversation
Bumps [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) from 1.16.0 to 1.41.0. - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.41.0/packages/lucide-react) --- updated-dependencies: - dependency-name: lucide-react dependency-version: 1.41.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
…lucide-react-1.41.0
|
PR #773 bumps lucide-react to 1.41.0, and JFrog's curation/Xray service blocks the download: npm notice package lucide-react:1.41.0 download was blocked by jfrog packages Root cause: a 7-day "immaturity" cooldown policy. lucide-react 1.41.0 was only 5 days old at run time, so curation refused to serve it (a supply-chain safeguard against freshly-published/compromised versions). It's not a CVE or a real security finding — just a maturity gate. Fixes
Worth noting — this is now a pattern Both #779 and #773 are the same underlying issue: Dependabot proposes versions faster than the Databricks JFrog registry will serve them (mirror sync lag on #779, curation cooldown here). You'll keep hitting this on fresh releases. Mitigation worth considering: add a cooldown setting to dependabot.yml so Dependabot waits N days after a release before opening the PR — e.g. cooldown: { default-days: 7 } to match JFrog's maturity window. That would have avoided both of these. Resolution: Wait a few more days. |
|
@dependabot rebase |
|
Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry! If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request |
|
A newer version of lucide-react exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged. |
1 participant
Bumps lucide-react from 1.16.0 to 1.41.0.
Release notes
Sourced from lucide-react's releases.
... (truncated)
Commits
75b5516chore(dev): upgrade ESLint to latest compatible stack (v10) (#4378)0f8d48btest(packages): updates unit test snapshots with face-slightly-smiling (#4676)f229f83chore(depedencies): Update dependencies (#4553)5ff536eci(release.yml): Fix workflow and removeversionscripts in package scripts...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)