Skip to content

chore(deps): update the nine direct dependencies Dependabot cannot bump - #427

Merged
Vivswan merged 2 commits into
mainfrom
chore/deps-bump
Oct 4, 2026
Merged

Vivswan merged 2 commits into
mainfrom
chore/deps-bump

Conversation

@Vivswan

@Vivswan Vivswan commented Oct 4, 2026 •

Copy link
Copy Markdown
Owner

What this changes

Package Before After
zod 4.5.4 4.6.5
yaml 2.9.0 2.9.1
@biomejs/biome 2.5.11 2.5.15
@types/bun 1.4.0 1.4.2
@types/node 26.4.1 26.6.4
knip 6.34.0 6.39.0
lefthook 2.1.12 2.1.16
oxc-parser 0.147.0 0.152.0
publint 0.3.24 0.3.25

How

  • Nine direct dependencies move to their latest exact pins by hand, since Dependabot's bun updater cannot read lockfile v2.
  • zod 4.6 copies each string-format check's name into the JSON Schema format keyword, so .includes() emitted format: "includes". The generator now drops every format keyword with one rule, and the published schema stays byte-identical.
  • biome.json names the new biome version.

Proof

  • Schema control: without the generator change the published schema gained one line and the format test went red; with it, byte-identical to before.
  • Gates: typecheck, lint, knip, lint:arch, and build:schema clean; 2003 tests green; the cross-model review converged.
Technical details
  • Line accounting: scripts +8 -13, config +10 -10 (package.json, biome.json); bun.lock (+100 -58) is generated and left out.
  • Reviewer note (Copilot): the format strip is generic on purpose; test/published-schema.test.ts promises zero format keywords, and the pattern zod emits beside each one is the real grammar.
  • Upstream: since zod 4.6.0 (#6554) toJSONSchema emits format: "includes", and by the same path starts_with and ends_with, which JSON Schema does not define; no issue is filed yet.
  • Files: package.json, bun.lock, .github/scripts/gen-settings-schema.ts, biome.json.

…der lockfile v2

yaml 2.9.0 -> 2.9.1
@biomejs/biome 2.5.11 -> 2.5.15
@types/bun 1.4.0 -> 1.4.2
@types/node 26.4.1 -> 26.6.4
knip 6.34.0 -> 6.39.0
lefthook 2.1.12 -> 2.1.16
oxc-parser 0.147.0 -> 0.152.0
publint 0.3.24 -> 0.3.25

Dependabot's bun updater has rejected this repository's bun.lock since 2026-09-02 ("Unsupported bun.lock 'lockfileVersion' 2"), so none of these moved on their own. zod stays at 4.5.4: 4.6.x emits format: "includes" into the generated JSON Schema, which the published-schema tests refuse.
…oes not define

zod 4.6.0 (#6554, "derive JSON Schema constraints by folding checks in the converter") copies every string_format check's name into the emitted format keyword, so z.string().includes() now publishes format: "includes", a name JSON Schema does not define and ajv ignores with a warning. The generator stripped two named formats (url, date/datetime) and let this third one through; it now deletes the keyword wherever zod emits it, which is the promise test/published-schema.test.ts already makes.

Control: lib/settings.schema.json built under zod 4.5.4 and under 4.6.5 with this change are byte-identical (zero format keywords); under 4.6.5 without it the only difference is one added "format": "includes" line on AutolinkConfig.url_template.

zod 4.5.4 -> 4.6.5
biome.json $schema 2.5.11 -> 2.5.15 (biome ci reported the mismatch as an info)
Copilot AI balanced review requested due to automatic review settings October 4, 2026 21:55

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

The dependency, lockfile, configuration, and schema-generator changes are consistent and covered by existing schema tests.

Review effort: Balanced
Findings: None

What changed in this PR

Updates nine direct dependencies while preserving published settings-schema behavior after the Zod upgrade.

Changes:

  • Updates runtime and development dependency pins.
  • Regenerates the Bun lockfile.
  • Removes all Zod-generated format keywords from the published schema.
File Description
package.json Updates nine dependency pins.
bun.lock Locks updated direct and transitive dependencies.
biome.json Aligns the schema URL with Biome 2.5.15.
.github/​scripts/​gen-settings-schema.ts Generalizes removal of incompatible JSON Schema formats.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@github-actions

github-actions Bot commented Oct 4, 2026

Copy link
Copy Markdown
Contributor

File size check

0 over a hard cap (fails), 33 warning(s).

File Size Tier Cap
.github/scripts/gen-inputs-table.ts:54 11 comment lines warn 10
.github/scripts/generated.ts:28 191 chars warn 150
.github/scripts/release-pipeline.ts:7 156 chars warn 150
.github/scripts/release-pipeline.ts:458 151 chars warn 150
.github/scripts/release-pipeline.ts:1252 153 chars warn 150
.github/scripts/release-pipeline.ts:1 35 comment lines (header) warn 25
.github/scripts/release-pipeline.ts:454 14 comment lines warn 10
.github/workflows/post-green.yml:29 153 chars warn 150
.github/workflows/update-release-pr.yml:110 14 comment lines warn 10
docs/upgrading/v2-to-v3.md 1276 lines warn 1040
src/engine/layers.ts:217 157 chars warn 150
src/flows/settings-write.ts:142 159 chars warn 150
src/flows/settings-write.ts:30 11 comment lines warn 10
src/flows/snapshot.ts:189 13 comment lines warn 10
src/github/secret-scan.ts:43 11 comment lines warn 10
src/schema.ts:186 153 chars warn 150
src/schema.ts:197 176 chars warn 150
src/sections/contract/errors.ts:14 14 comment lines warn 10
src/sections/contract/module.ts:963 185 chars warn 150
src/sections/contract/module.ts:627 12 comment lines warn 10
src/sections/contract/module.ts:897 12 comment lines warn 10
src/sections/secret_scanning_custom_patterns/compilable-form.ts:382 161 chars warn 150
src/sections/shared/roles.ts:43 13 comment lines warn 10
src/types.ts:16 156 chars warn 150
test/docs/guides.test.ts:451 155 chars warn 150
test/e2e/generators.ts 2634 lines warn 2560
test/e2e/generators.ts:1704 166 chars warn 150
test/e2e/generators.ts:1858 161 chars warn 150
test/e2e/generators.ts:1667 12 comment lines warn 10
test/engine/execute.test.ts:617 152 chars warn 150
test/flows/merge-parity.test.ts:63 164 chars warn 150
test/scripts/auto-fix-allowlist.test.ts:12 12 comment lines warn 10
test/sections/refusal-messages.test.ts:61 19 comment lines warn 10

Split the file, wrap the line, shorten or exempt the comment, or list the path in .file-size-allow.local with a # reason.

5 managed file(s) skipped; repo-platform owns them.

@Vivswan Vivswan added the merge-when-green Owner approved: merge once every gate is green label Oct 4, 2026
@Vivswan
Vivswan marked this pull request as ready for review October 4, 2026 22:26
@Vivswan
Vivswan merged commit 83fde6e into main Oct 4, 2026
34 checks passed
@Vivswan
Vivswan deleted the chore/deps-bump branch October 4, 2026 22:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

merge-when-green Owner approved: merge once every gate is green

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants