Skip to content

Dependency updates and Dependabot grouping fix - #50

Merged
lorem-dev merged 9 commits into
mainfrom
develop
Sep 8, 2026
Merged

Dependency updates and Dependabot grouping fix#50
lorem-dev merged 9 commits into
mainfrom
develop

Conversation

@lorem-dev

@lorem-dev lorem-dev commented Sep 8, 2026

Copy link
Copy Markdown
Owner

Second develop -> main round. Carries the first Dependabot wave plus the config fix it exposed.

This merge is what activates the new grouping -- Dependabot reads .github/dependabot.yml from the default branch, so until this lands it keeps batching action majors into one pull request.

Dependency updates

PR Update What made it safe beyond a green check
#42 cargo minor/patch x5 (uuid, aes, interprocess, two tauri plugins) full Rust suite
#46 sha2 0.10.9 -> 0.11.0 the NIST vectors in hashing.rs (ABC_SHA256, EMPTY_SHA256) and app_update/verify.rs. Green means skill content hashes are byte-identical -- a change there would make every installed skill look modified for every user
#43 argon2 0.5.3 -> 0.6.0 unlocks_a_v3_encrypted_ed25519_key and unlocks_v3_rsa_and_ecdsa decrypt real puttygen PPK v3 fixtures through the actual KDF, plus three cap-rejection tests
#45 toml 0.8.2 -> 1.1.4+spec-1.1.0 one consumer (mcp/writers.rs); its tests assert the emitted table headers and key = "value" shape, and that existing user keys survive a rewrite
#47 npm minor/patch x13 (eslint, typescript-eslint, jest, motion, @storybook/react, ...) lint, typecheck, test:cov, build

Config fix (#48)

Two updates were closed rather than merged, and #48 stops both from coming back:

  • chore(deps): bump the github-actions group with 6 updates #44 batched six action updates including three majors. tauri-action v0.6.2 -> v1.0.0 lives only in release.yml and setup-uv v7.6.0 -> v10.0.1 only in docs.yml; neither workflow runs on a pull request, so the green checks covered none of it. The github-actions group was missing the update-types: [minor, patch] filter that cargo and npm already had -- majors now arrive one per pull request.
  • chore(deps-dev): bump @types/node from 24.13.3 to 26.4.1 #49 offered @types/node 24.13.3 -> 26.4.1 while engines.node is >=24 and all six setup-node steps pin node-version: '24'. Types ahead of the runtime make tsc accept APIs that are not there, moving the failure to run time. Majors for that package are now ignored; 24.x patches still flow.

After merging

The action bumps come back split on the next run. To see them without waiting for Monday 06:00 UTC, use the recheck on the GitHub Actions row of Insights -> Dependency graph -> Dependabot.

lorem-dev and others added 9 commits September 8, 2026 23:12
@lorem-dev
Merge pull request #41 from lorem-dev/main
d71d584 
chore: back-merge main into develop
@dependabot
chore(deps): bump the cargo-minor-and-patch group with 5 updates (#42)
f1d91d2 
Bumps the cargo-minor-and-patch group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [uuid](https://github.com/uuid-rs/uuid) | `1.24.1` | `1.26.0` |
| [tauri-plugin-dialog](https://github.com/tauri-apps/plugins-workspace) | `2.7.2` | `2.7.3` |
| [tauri-plugin-clipboard-manager](https://github.com/tauri-apps/plugins-workspace) | `2.3.2` | `2.3.3` |
| [interprocess](https://github.com/kotauskas/interprocess) | `2.4.3` | `2.4.4` |
| [aes](https://github.com/RustCrypto/block-ciphers) | `0.9.2` | `0.9.3` |


Updates `uuid` from 1.24.1 to 1.26.0
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.24.1...v1.26.0)

Updates `tauri-plugin-dialog` from 2.7.2 to 2.7.3
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@dialog-v2.7.2...dialog-v2.7.3)

Updates `tauri-plugin-clipboard-manager` from 2.3.2 to 2.3.3
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@os-v2.3.2...nfc-v2.3.3)

Updates `interprocess` from 2.4.3 to 2.4.4
- [Release notes](https://github.com/kotauskas/interprocess/releases)
- [Commits](kotauskas/interprocess@2.4.3...2.4.4)

Updates `aes` from 0.9.2 to 0.9.3
- [Commits](RustCrypto/block-ciphers@aes-v0.9.2...aes-v0.9.3)

---
updated-dependencies:
- dependency-name: uuid
  dependency-version: 1.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-and-patch
- dependency-name: tauri-plugin-dialog
  dependency-version: 2.7.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-and-patch
- dependency-name: tauri-plugin-clipboard-manager
  dependency-version: 2.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-and-patch
- dependency-name: interprocess
  dependency-version: 2.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-and-patch
- dependency-name: aes
  dependency-version: 0.9.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump sha2 from 0.10.9 to 0.11.0 (#46)
b65e347 
Bumps [sha2](https://github.com/RustCrypto/hashes) from 0.10.9 to 0.11.0.
- [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.0)

---
updated-dependencies:
- dependency-name: sha2
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump argon2 from 0.5.3 to 0.6.0 (#43)
32185aa 
Bumps [argon2](https://github.com/RustCrypto/password-hashes) from 0.5.3 to 0.6.0.
- [Commits](RustCrypto/password-hashes@argon2-v0.5.3...argon2-v0.6.0)

---
updated-dependencies:
- dependency-name: argon2
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump the npm-minor-and-patch group with 13 updates (#47)
ba217f1 
Bumps the npm-minor-and-patch group with 13 updates:

| Package | From | To |
| --- | --- | --- |
| [eslint](https://github.com/eslint/eslint) | `10.8.1` | `10.10.0` |
| [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.4` | `0.5.6` |
| [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) | `30.4.2` | `30.5.1` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.67.0` | `8.69.0` |
| [@tauri-apps/plugin-clipboard-manager](https://github.com/tauri-apps/plugins-workspace) | `2.3.2` | `2.3.3` |
| [motion](https://github.com/motiondivision/motion) | `13.1.0` | `13.2.0` |
| [@storybook/react](https://github.com/storybookjs/storybook/tree/HEAD/code/renderers/react) | `10.5.9` | `10.6.0` |
| [@storybook/react-vite](https://github.com/storybookjs/storybook/tree/HEAD/code/frameworks/react-vite) | `10.5.9` | `10.6.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.2.7` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.5` | `6.1.1` |
| [sass](https://github.com/sass/dart-sass) | `1.102.0` | `1.104.0` |
| [storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core) | `10.5.9` | `10.6.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.1` | `8.2.2` |


Updates `eslint` from 10.8.1 to 10.10.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.8.1...v10.10.0)

Updates `eslint-plugin-react-refresh` from 0.5.4 to 0.5.6
- [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases)
- [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md)
- [Commits](ArnaudBarre/eslint-plugin-react-refresh@v0.5.4...v0.5.6)

Updates `jest` from 30.4.2 to 30.5.1
- [Release notes](https://github.com/jestjs/jest/releases)
- [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md)
- [Commits](https://github.com/jestjs/jest/commits/v30.5.1/packages/jest)

Updates `typescript-eslint` from 8.67.0 to 8.69.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.69.0/packages/typescript-eslint)

Updates `@tauri-apps/plugin-clipboard-manager` from 2.3.2 to 2.3.3
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@os-v2.3.2...nfc-v2.3.3)

Updates `motion` from 13.1.0 to 13.2.0
- [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md)
- [Commits](motiondivision/motion@v13.1.0...v13.2.0)

Updates `@storybook/react` from 10.5.9 to 10.6.0
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.6.0/code/renderers/react)

Updates `@storybook/react-vite` from 10.5.9 to 10.6.0
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.6.0/code/frameworks/react-vite)

Updates `@types/react-dom` from 19.2.4 to 19.2.7
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.1
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react)

Updates `sass` from 1.102.0 to 1.104.0
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](sass/dart-sass@1.102.0...1.104.0)

Updates `storybook` from 10.5.9 to 10.6.0
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.6.0/code/core)

Updates `vite` from 8.2.1 to 8.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 10.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: eslint-plugin-react-refresh
  dependency-version: 0.5.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: jest
  dependency-version: 30.5.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: typescript-eslint
  dependency-version: 8.69.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@tauri-apps/plugin-clipboard-manager"
  dependency-version: 2.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: motion
  dependency-version: 13.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@storybook/react"
  dependency-version: 10.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@storybook/react-vite"
  dependency-version: 10.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: sass
  dependency-version: 1.104.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: storybook
  dependency-version: 10.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: vite
  dependency-version: 8.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@lorem-dev
ci: keep action majors out of the grouped update
adf9ecf 
The github-actions group matched every pattern with no update-type
filter, unlike the cargo and npm groups below it. Its first run put six
updates in one pull request, three of them majors: tauri-action v0.6.2
to v1.0.0, setup-uv v7.6.0 to v10.0.1, and the checkout / setup-node /
artifact v5-to-v7 line.

That is the wrong shape for this repository specifically. tauri-action
appears only in release.yml and setup-uv only in docs.yml, and neither
workflow runs on a pull request -- release.yml is tag-only and docs.yml
triggers on a push to main. A green pull request check therefore said
nothing at all about the two riskiest lines in the diff, and the first
real exercise of a v0-to-v1 bundler major would have been a release tag,
across six matrix legs holding the signing secrets.

Restricting the group to minor and patch makes every major arrive on its
own, where the diff is small enough that its changelog is obviously the
thing under review.
@lorem-dev
ci: hold @types/node at the Node major the project runs
16cab69 
Dependabot offered @types/node 24.13.3 -> 26.4.1 while `engines` asks
for Node >= 24 and every workflow pins `node-version: '24'`. That bump
is not a dependency update so much as a claim about the runtime: tsc
would start accepting APIs Node 24 does not have, the type check would
stay green, and the failure would move to run time -- the one place
these types exist to keep it out of.

Ignoring only the major keeps the 24.x patches flowing. When the runtime
moves, the types move with it in the same change.
@dependabot
chore(deps): bump toml from 0.8.2 to 1.1.4+spec-1.1.0 (#45)
7f75c81 
Bumps [toml](https://github.com/toml-rs/toml) from 0.8.2 to 1.1.4+spec-1.1.0.
- [Commits](toml-rs/toml@toml-v0.8.2...toml-v1.1.4)

---
updated-dependencies:
- dependency-name: toml
  dependency-version: 1.1.4+spec-1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@lorem-dev
Merge pull request #48 from lorem-dev/fix/dependabot-group-majors
95ca8c5 
ci: split action majors out of the group and hold @types/node
@github-advanced-security

github-advanced-security AI commented Sep 8, 2026

Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

@lorem-dev
lorem-dev merged commit 876a070 into main Sep 8, 2026
14 checks passed
@github-actions github-actions Bot mentioned this pull request Sep 8, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@lorem-dev @github-advanced-security