Repository navigation
chore(deps): pin dependencies - #881
renovate[bot] wants to merge 1 commit into
Conversation
|
Code ReviewRisk: Low — The dependency changes are isolated to development tooling and pin the listed packages to exact versions; no blocking issues were found. Updates the js-toolkit development dependencies, including version upgrades for documentation, build, styling, and test tooling. The package manifest now uses exact versions for the affected dependencies. Still open from earlier reviews (2 findings):
Review usage: 11,625 in (5,505 cached) / 449 out tokens — $0.0022 (openrouter/openai/gpt-5.6-luna, thinking: low) Reviewed by @weareikko/code-review v0.11.1 for commit b845ba0. Previous review runsPrevious run archived 2026-11-05T11:13:19ZCode ReviewRisk: Low — The dependency pins and version updates are confined to development tooling, with no concrete runtime defect visible in the diff. Updates the js-toolkit development dependencies by pinning previously ranged versions and advancing several toolchain packages. No blocking or actionable issues were found. Still open from earlier reviews (2 findings):
Review usage: 5,508 in / 239 out tokens — $0.0017 (openrouter/openai/gpt-5.6-luna, thinking: low) Reviewed by @weareikko/code-review v0.11.1 for commit 91347f7. Previous run archived 2026-11-05T05:56:57ZCode ReviewRisk: Medium — issues that should be addressed before merge. This change pins several existing dependencies and upgrades others in 1 issue found:
Still open from earlier reviews (2 findings):
Review usage: 46,373 in (37,433 cached) / 862 out tokens — $0.0040 (openrouter/openai/gpt-5.6-luna, thinking: low) Reviewed by @weareikko/code-review v0.11.1 for commit c9164c6. Previous run archived 2026-11-02T03:30:16ZCode ReviewRisk: Low — The dependency changes introduce no demonstrable blocking defect in the reviewed diff and are safe to merge aside from validating the updated toolchain in CI. Pins previously ranged dependencies and updates several development-only packages, including SWC, Vite, Tailwind, VitePress, Playwright, and Vitest. No application runtime dependencies or source code were changed. Still open from earlier reviews (2 findings):
Review usage: 5,504 in (3,066 cached) / 276 out tokens — $0.0010 (openrouter/openai/gpt-5.6-luna, thinking: low) Reviewed by @weareikko/code-review v0.11.1 for commit 0c6e37c. Previous run archived 2026-11-02T03:26:36ZCode ReviewRisk: Low — The dependency version changes are isolated to development tooling and do not introduce an evident production-impacting defect. Pins several previously ranged dependencies and updates a number of development packages to newer fixed versions. No concrete correctness issue is demonstrable from the provided diff. Still open from earlier reviews (2 findings):
Review usage: 5,492 in / 192 out tokens — $0.0016 (openrouter/openai/gpt-5.6-luna, thinking: low) Reviewed by @weareikko/code-review v0.11.1 for commit f929154. Previous run archived 2026-11-01T07:36:24ZCode ReviewRisk: Medium — issues that should be addressed before merge. This MR pins the js-toolkit development dependencies and upgrades several tooling packages. The corresponding root 1 issue found:
Still open from earlier reviews (1 finding):
Review usage: 33,658 in (21,657 cached) / 828 out tokens — $0.0044 (openrouter/openai/gpt-5.6-luna, thinking: low) Reviewed by @weareikko/code-review v0.11.1 for commit 419cef6. Previous run archived 2026-10-29T04:14:41ZCode ReviewRisk: Low — no blocking issues; safe to merge aside from nits. This change pins previously ranged development dependencies and updates several tooling packages to newer versions. One Vitest integration pair is updated without updating the corresponding core package. Still open from earlier reviews (1 finding):
Review usage: 28,212 in (21,083 cached) / 963 out tokens — $0.0034 (openrouter/openai/gpt-5.6-luna, thinking: low) Reviewed by @weareikko/code-review v0.11.0 for commit b0895f2. Previous run archived 2026-10-24T03:46:19ZCode ReviewRisk: Low — The dependency changes do not show a demonstrable runtime or correctness defect, so this is safe to merge. Updates and pins several development dependencies in Still open from earlier reviews (1 finding):
Review usage: 5,512 in / 314 out tokens — $0.0018 (openrouter/openai/gpt-5.6-luna, thinking: low) Reviewed by @weareikko/code-review v0.10.3 for commit d1e5bc6. Previous run archived 2026-10-17T00:01:04ZCode ReviewRisk: Low — The dependency changes are isolated to development tooling and do not introduce a blocking defect. Updates and pins the JavaScript toolkit's development dependencies, including SWC, Vite, VitePress, Tailwind CSS, Vitest browser packages, Playwright, and related tooling. No production dependencies or application source files are changed. Still open from earlier reviews (1 finding):
Review usage: 5,478 in (3,066 cached) / 199 out tokens — $0.0009 (openrouter/openai/gpt-5.6-luna, thinking: low) Reviewed by @weareikko/code-review v0.10.3 for commit 03a1ef2. Previous run archived 2026-10-15T19:16:48ZCode ReviewRisk: Low — The dependency version changes are limited to development tooling and do not introduce a demonstrable runtime or contract defect. Pins previously ranged dependencies and updates several development dependencies to newer fixed versions in Still open from earlier reviews (1 finding):
Review usage: 5,463 in / 294 out tokens — $0.0017 (openrouter/openai/gpt-5.6-luna, thinking: low) Reviewed by @weareikko/code-review v0.10.3 for commit 04cf865. Previous run archived 2026-10-15T02:53:03ZCode ReviewRisk: Low — This dependency-only change has no identified blocking issues and is safe to merge aside from normal upgrade validation. Pins previously ranged dependencies and updates several development tools to newer exact versions, including SWC, Tailwind, Vite, VitePress, Playwright, and related testing packages. Still open from earlier reviews (1 finding):
Review usage: 5,470 in (3,066 cached) / 245 out tokens — $0.0010 (openrouter/openai/gpt-5.6-luna, thinking: low) Reviewed by @weareikko/code-review v0.10.3 for commit d570c54. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| "@rollup/plugin-swc": "^0.4.1", | ||
| "@shikijs/vitepress-twoslash": "4.0.2", | ||
| "@rollup/plugin-swc": "0.4.1", | ||
| "@shikijs/vitepress-twoslash": "4.5.0", |
There was a problem hiding this comment.
issue: Lockfile remains inconsistent with workspace manifest
The workspace entry in package-lock.json still records the previous dependency versions and ranges, including vite: "8.2.1", while this manifest now requires different values. npm ci validates this relationship and exits instead of installing dependencies; regenerate and commit the lockfile.
Confidence: high.
Reviewed by @weareikko/code-review v0.9.9 for commit 4ec4dc7.
03a1ef2 to
d1e5bc6
Compare
b0895f2 to
419cef6
Compare
| "@tailwindcss/vite": "4.2.2", | ||
| "@vitest/browser": "4.1.10", | ||
| "@vitest/browser-playwright": "4.1.10", | ||
| "@rollup/plugin-swc": "0.4.1", |
There was a problem hiding this comment.
issue: Update the lockfile with these dependency changes
The committed package-lock.json still records the old js-toolkit dependency ranges and versions, including @shikijs/vitepress-twoslash at 4.0.2, while this manifest requires 4.5.0 and other updated exact versions. Because the lockfile is stale, npm ci will reject the manifest/lockfile mismatch and clean installs will not use the pinned dependencies; regenerate and commit package-lock.json.
Confidence: high.
Reviewed by @weareikko/code-review v0.11.1 for commit 419cef6.
0c6e37c to
c9164c6
Compare
| "@tailwindcss/vite": "4.2.2", | ||
| "@vitest/browser": "4.1.10", | ||
| "@vitest/browser-playwright": "4.1.10", | ||
| "@rollup/plugin-swc": "0.4.1", |
There was a problem hiding this comment.
issue: Regenerate the lockfile for the updated dependency manifest
The workspace entry in package-lock.json still declares the previous versions and ranges, including @rollup/plugin-swc as ^0.4.1 and vite as 8.2.4, while this manifest changes them. npm ci validates the lockfile against workspace manifests and will reject this mismatch; regenerate package-lock.json and commit the resulting dependency resolutions.
Confidence: high.
Reviewed by @weareikko/code-review v0.11.1 for commit c9164c6.
c9164c6 to
91347f7
Compare
91347f7 to
b845ba0
Compare
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
^0.4.1→0.4.14.0.2→4.6.03.0.0→3.0.1^1.15.47→1.16.224.2.2→4.3.34.3.44.1.10→4.1.124.1.10→4.1.12^7.8.0→7.8.0^1.50.0→1.64.14.2.2→4.3.34.3.40.22.14→0.23.40.23.58.2.4→8.3.58.3.62.0.0-alpha.19→2.0.0-alpha.211.12.0→1.14.0Add the preset
:preserveSemverRangesto your config if you don't want to pin your dependencies.Release Notes
shikijs/shiki (@shikijs/vitepress-twoslash)
v4.6.0Compare Source
🐞 Bug Fixes
ShikiStreamTokenizeroffsets and CRLF handling withcodeToTokens- by @xyrolle in #1335 (f8aba)🏎 Performance
View changes on GitHub
v4.5.0Compare Source
🚀 Features
🐞 Bug Fixes
#and--comments in rose-pine theme - by @anandghegde in #1317 (63e6d)🏎 Performance
View changes on GitHub
v4.4.3Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
v4.4.2Compare Source
🐞 Bug Fixes
🏎 Performance
View changes on GitHub
v4.4.1Compare Source
🚀 Features
View changes on GitHub
v4.4.0Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
v4.3.1Compare Source
🚀 Features
typefield forThemedToken- by @ije in #1293 (585b5)View changes on GitHub
v4.3.0Compare Source
🚀 Features
View changes on GitHub
v4.2.0Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
v4.1.0Compare Source
🐞 Bug Fixes
tsModuletocreateTwoslasher- by @arthurfiorette in #1271 (be89a)View changes on GitHub
studiometa/tailwind-config (@studiometa/tailwind-config)
v3.0.1Compare Source
Changed
## [Unreleased]section with.changelog/fragments checked on pull requests byweareikko/changelog, and release from thepublish-and-releaseworkflow, which bumps the version, folds the fragments intoCHANGELOG.md, tags, publishes to npm and creates the GitHub release (#137)tailwindlabs/tailwindcss (@tailwindcss/vite)
v4.3.3Compare Source
Fixed
--watch --poll[=ms]in@tailwindcss/cliwhen filesystem events are unreliable or unavailable (#20297)bg-[#fff]andbg-[#FFF]→bg-white) (#20298)iframe:focus-visibleoutline styles (#20292)theme('colors.foo')in JS plugins resolves correctly when both--color-fooand--color-foo-barexist (#20299)shadow-sm/12.5,text-shadow-sm/12.5,drop-shadow-sm/12.5, andinset-shadow-sm/12.5(#20302)[data-foo]divas two selectors instead of one (#20303)@tailwindcss/postcssrebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#20310)@tailwindcss/browserand Tailwind Play (#20124)oklch(#20314)--spacing(0)is optimized to0pxinstead of0so it remains a<length>when used incalc(…)(#20319)@parcel/watcheronly when needed in@tailwindcss/cli --watchmode, so one-off builds and--watch --pollwork when@parcel/watchercan't be loaded (#20325)system-uiandui-sans-serifso CJK text respects the page'slangattribute on Windows (#20318)@tailwindcss/upgradefrom rewriting ignored files when run from a subdirectory (#20329)@sourcerules pointing to nested files are scanned when later@sourcerules point to files in parent folders (#20335)@tailwindcss/vitefrom triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#20336)v4.3.2Compare Source
Fixed
auto-rows-*andauto-cols-*utilities (e.g.auto-rows-12andauto-cols-16) (#20229)@tailwindcss/cliin--watchmode from crashing on Windows when@sourcepoints to a directory that doesn't exist (#20242)@tailwindcss/vitefrom crashing in Deno v2.8.x whencontext.parentURLis not a valid URL (#20245)@tailwindcss/cliin--watchmode rebuilds when the input CSS file changes in an ignored directory (#20246)@variantrules used inaddBase(…)to use custom variants defined later (#20247)@tailwindcss/vitefrom crashing during HMR when scanned files or directories are deleted (#20259)font-sizeinstead ofcolordeclarations fortext-[--spacing(…)](#20260)@sourcepatterns from scanning unrelated sibling files and folders (#20263)%]…[%in.tt,.tt2, and.txfiles (#20269)p.text-black[condition](#20269)@position-tryrules from triggering unknown at-rule warnings when optimizing CSS (#20277)--opacitytheme values (#20287)@tailwindcss/postcsswhen used with newer PostCSS patch releases (#20289)v4.3.1Compare Source
Added
--silentoption to suppress output in@tailwindcss/cli(#20100)Fixed
Module#registerHooksinstead ofModule#registeron Node 26+ (#20028)@applyto be used with CSS mixins (#19427)not-*correctly negates@containerqueries, includingstyle(…)queries (#20059)drop-shadow-*color utilities work with custom shadow values containingcalc(…)(#20080)@tailwindcss/vite(#20103)@tailwindcss/webpackcan be installed in Rspack projects without requiringwebpackas a peer dependency (#20027)calc(…)expressions (e.g.px-[calc(1rem+0px)]→px-[calc(1rem+0)]) (#20127)left-[99999px]→left-[99999px], notleft-24999.75) (#20130)@tailwindcss/cliin--watchmode recovers when a tracked dependency is deleted and restored (#20137)@tailwindcss/clibinaries are ignored when scanning for class candidates (#20139)addClass(…)andremoveClass(…)calls (#20198)@variantto be used insideaddBase(#19480)@sourceglobs with symlinks are preserved (#20203)@sourcerules can re-include files excluded by earlier@source notrules (#20203)@utilityrules (#20205)inset-shadow-noneand other inset shadows work correctly (#20208)@sourcedirectories are scanned even when ignored by git (#20214)@sourceglobs ending in**/*preserve dynamic path segments to avoid scanning too many files (#20217)calc(…)divisions when the result would require high precision (e.g.w-[calc(100%/3.5)]→w-[calc(100%/3.5)], notw-[28.571428571428573%]) (#20221)@tailwindcss/postcss(#20228)Changed
0instead ofcalc(var(--spacing) * 0)for spacing utilities likem-0andleft-0(#20196)var(--spacing)instead ofcalc(var(--spacing) * 1)for spacing utilities likem-1andleft-1(#20196)v4.3.0Compare Source
Added
@container-sizeutility (#18901)scrollbar-{auto,thin,none}utilities forscrollbar-width, andscrollbar-thumb-*/scrollbar-track-*color utilities forscrollbar-color(#19981, #20019)scrollbar-gutter-*utilities (#20018)zoom-*utilities (#20020)tab-*utilities (#20022)@variantwith stacked variants (e.g.@variant hover:focus { … }) (#19996)@variantwith compound variants (e.g.@variant hover, focus { … }) (#19996)--default(…)in--value(…)and--modifier(…)for functional@utilitydefinitions (#19989)Fixed
@pluginresolves package JavaScript entries instead of browser CSS entries when using@tailwindcss/vite(#19949)@importand@pluginpaths resolving from the wrong directory when using@tailwindcss/vite(#19965)@variantare processed by@tailwindcss/vite(#19966)basewhenresult.opts.fromis not provided when using@tailwindcss/postcss(#19980)_whitespace in arbitrary values (#19986)w-[calc(100%---spacing(60))]→w-[calc(100%-(--spacing(60)))]) (#19986)-mt-[20in]→mt-[-20in], notmt-[-1920px]) (#19988):has()variants from[&:has(…)]tohas-[…](#19991)styleattributes (e.g.style="flex-grow: 1"→style="flex-grow: 1", notstyle="grow: 1") (#19918)@utilitydefinitions with the same name but different value types (#19777)PluginWithConfigtype fromtailwindcss/pluginto fix errors when inferring plugin config types (#19707)startandendlegacy utilities without values do not generate CSS (#20003)--value(…)is required in functional@utilitydefinitions (#20005)-left-[(var(--a)+var(--b))]) (#20011)v4.2.4Compare Source
Fixed
@importand@pluginstill resolve correctly when using Vite aliases in@tailwindcss/vite(#19947)v4.2.3Compare Source
Fixed
tracking-*utilities by preferring non-negative utilities (e.g.-tracking-tighter→tracking-wider) (#19827)@tailwindcss/webpack(#19723)px-[1.2rem] py-[1.2rem]→p-[1.2rem]) (#19837)border-{t,b}-*intoborder-y-*,border-{l,r}-*intoborder-x-*, andborder-{t,r,b,l}-*intoborder-*(#19842)scroll-m{t,b}-*intoscroll-my-*,scroll-m{l,r}-*intoscroll-mx-*, andscroll-m{t,r,b,l}-*intoscroll-m-*(#19842)scroll-p{t,b}-*intoscroll-py-*,scroll-p{l,r}-*intoscroll-px-*, andscroll-p{t,r,b,l}-*intoscroll-p-*(#19842)overflow-{x,y}-*intooverflow-*(#19842)overscroll-{x,y}-*intooverscroll-*(#19842)--placeholder-colorinstead of--background-colorforplaceholder-*utilities (#19843)config.contentwhen migrating from Tailwind CSS v3 to Tailwind CSS v4 (#19846).envand.env.*to default ignored content files (#19846)overflow-ellipsisintotext-ellipsis(#19849)start-full→inset-s-full,start-auto→inset-s-auto,start-px→inset-s-px, andstart-<number>→inset-s-<number>as well as negative versions (#19849)end-full→inset-e-full,end-auto→inset-e-auto,end-px→inset-e-px, andend-<number>→inset-e-<number>as well as negative versions (#19849)-sign inside the arbitrary value-left-[9rem]→left-[-9rem](#19858)-sign outside the arbitrary valueml-[calc(-1*var(--width))]→-ml-(--width)(#19858)NODE_PATHenvironment variable in standalone CLI (#19617)vitest-dev/vitest (@vitest/browser)
v4.1.12Compare Source
🐞 Bug Fixes
View changes on GitHub
v4.1.11Compare Source
🐞 Bug Fixes
View changes on GitHub
rolldown/tsdown (tsdown)
v0.23.4Compare Source
🚀 Features
platformis ignored for the CJS format - by @sxzz and @sxzzbot in #1111 (58003)🐞 Bug Fixes
?inlineCSS imported from dependencies - by @sxzz and @sxzzbot in #1109 (75a78)🏎 Performance
View changes on GitHub
v0.23.3Compare Source
🐞 Bug Fixes
View changes on GitHub
v0.23.2Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
v0.23.1Compare Source
🐞 Bug Fixes
npm publish --dry-run- by @giaBaoJS in #1076 (83f0c)View changes on GitHub
v0.23.0Compare Source
🧭 Migration Guide
Most users can upgrade directly. Before upgrading, run one final build with
tsdown@0.22.14and resolve all deprecation warnings.bundle: false→unbundle: true;bundle: truecan be removedoutExtension→outExtensionspublicDir/--public-dir→copy/--copyremoveNodeProtocol: true→nodeProtocol: 'strip'injectStyle→css.injectinlineOnly/deps.onlyAllowBundle→deps.onlyBundleskipNodeModulesBundle: true→deps.neverBundle: trueresolveDepSubpathnow defaults tofalse; set it totrueto preserve the previous behaviorrolldown-plugin-dtswas upgraded from0.27.13to0.28.5dts.oxc: true→dts.generator: 'oxc'dts.tsgo: true→dts.generator: 'tsgo';oxcandtsgoobjects now only configure their respective generatorsdts.volarPlugins→dts.customLanguages; rename each language'screatehook tocreateVolarPluginsvue, now throw when combined with an incompatible generatordts.cjsReexportwas removed; dual-format builds now generate CJS declarations in a separate passstricttoesm-only; setprofile: 'strict'to preserve the previous checksbuild()now returns{ bundles, watch }; replaceconst bundles = await build()withconst { bundles } = await build()^22.18.0,^24.11.0, or>=26.0.0rolldown-plugin-dtsnow requires Rolldown 1.2.xtypesandtypesVersionsfallbacks were removed; use TypeScript'sbundler,node16, ornodenextmodule resolution🚨 Breaking Changes
typesandtypesVersionsfields - by @sxzz (be3ea)esm-only- by @sxzz (9b3cf)deps.onlyAllowBundle- by @sxzz (30c55)resolveDepSubpathby default - by @sxzz (d300f)skipNodeModulesBundle- by @sxzz (f2a3d)dts.generatorthe only way to select generator - by @sxzz (eb75f)🚀 Features
css.modules.localsConvention- by @sxzz and @lazerg (b566f)summaryoption to skip per-file size logs - by @lazerg in #1036 (020e9)🐞 Bug Fixes
unplugin-unusedv0.5+ - by @sxzz (53c78)@import- by @lazerg in #1038 (ebee5)resolveDepSubpathwhenneverBundleistrue- by @lazerg in #1053 (4943c)🏎 Performance
asyncDisposepolyfill - by @sxzz (82675)ansiswithutil.styleText- by @sxzz (be6bf)View changes on GitHub
vitejs/vite (vite)
v8.3.5Compare Source
Bug Fixes
server.originto asset URLs (#23683) (52ba877)import.meta.env.*defines in theimport.meta.envobject (#23713) (6019aa7)%inurl()(#23676) (50b382d)Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.