Repository navigation
chore(deps): second October dependency sweep - #6041
Merged
norman-abramovitz merged 4 commits intoOct 21, 2026
Merged
norman-abramovitz merged 4 commits into
norman-abramovitz merged 4 commits into
Conversation
Supersedes cloudfoundry#6013, which bumped the root package.json only. marked is also declared in src/frontend/packages/core/package.json; nothing installs from that file, but scripts/lint-nested-pins.mjs fails lint when it disagrees with root, so both move together. In bun.lock only marked changes, and the result is the same as cloudfoundry#6013's.
Supersedes cloudfoundry#6015; the bun.lock changes are the same as cloudfoundry#6015's. js-yaml 5.5.0 moves its argparse dependency to the 3.x major. argparse is used only by the js-yaml command-line tool (bin/js-yaml.mjs), which nothing in this repo runs; every caller imports js-yaml as a library. The js-yaml copies under @apidevtools/json-schema-ref-parser, cosmiconfig and json-schema-to-typescript keep argparse 2.0.1. The release also rejects ',', ']' and '}' at the start of a block plain scalar, per the YAML spec. Input that relied on the old lenient parse now reports an error instead.
Supersedes cloudfoundry#6040. clock is a direct dependency of the cfapppush plugin. The backend's seven Go modules point at each other through replace directives, so the main module's go.mod follows as well. The update brings golang.org/x/net 0.61.0 into cfapppush, and newer pprof, ginkgo, golang.org/x/mod and golang.org/x/tools into the main module. go mod tidy was run across all seven modules until it made no further changes. The go.mod changes are the same as cloudfoundry#6040's, and no module's go version line moves.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
After #6039 merged, Dependabot rescanned and found three newer releases. It updated two of its existing PRs (#6013, #6015) to the new versions and opened #6040. #6013 fails CI. This PR makes all three updates in one branch, with the fix #6013 needed.
src/frontend/packages/core/package.jsonalso declares marked. Nothing installs from that file, butscripts/lint-nested-pins.mjsfails lint when it disagrees with the rootpackage.json, and Dependabot only edited the root. This commit updates both.bun.lockchanges once.When this merges, Dependabot should close the three PRs it replaces on its own. None of the three is a security update; the repository has no open Dependabot alerts.
js-yaml 5.5.0
argparsedependency from 2.0.1 to 3.0.3, a new major version. argparse is used only by thejs-yamlcommand-line tool (bin/js-yaml.mjs). Nothing in this repo runs that tool; every caller imports js-yaml as a library. The three other copies of js-yaml in the tree, under@apidevtools/json-schema-ref-parser,cosmiconfigandjson-schema-to-typescript, keep argparse 2.0.1.,,]or}is now a parse error. In the UI, js-yaml parses YAML in Kubernetes kube-config registration and the Helm chart values editor; both catch the error and show the YAML as invalid.Notes
scripts/lockdiff.mjs, which lists the packages each change adds or removes. marked changes only marked; js-yaml changes js-yaml and argparse. Bothbun.lockresults are the same as the Dependabot PRs'.replacedirectives, so a version change in one can change what the others resolve. clock is a direct dependency of the cfapppush plugin; its update also bringsgolang.org/x/net0.61.0 into cfapppush, and newer pprof, ginkgo,golang.org/x/modandgolang.org/x/toolsinto the main backend module.go mod tidywas run across all seven modules until it made no further changes in any of them. Thego.modchanges are the same as chore(deps): bump code.cloudfoundry.org/clock from 1.91.0 to 1.92.0 in /src/jetstream in the go group across 1 directory #6040's, and no module'sgoversion line changes.Tests
make check gate: passed.Release note:
changelog.d/0019-dependency-updates.md.AI disclosure (RFC-0047): prepared with AI coding assistance; reviewed by the author.