👷 Update all non-major dependencies (minor/patch) - #162
Conversation
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
PR Review — Score: 3.0 / 5
Routine Renovate dependency bumps for dev tooling and the runtime dd-trace dependency. Root and playground lockfiles are in sync, but four e2e integration apps have package.json version bumps without matching yarn.lock updates — Renovate's artifact step failed for those apps. I would not merge as-is; regenerate the integration lockfiles (or rebase/retry the Renovate branch) so installs are deterministic before approval.
Why 3.0: The core SDK lockfile updates look correct and the version bumps are all minor/patch. The integration-app lockfile drift is a concrete merge risk that Renovate already flagged.
Why not 5: Four integration yarn.lock files are stale relative to their package.json changes, leaving package/lock mismatch on the bundler apps this repo exercises in CI.
Findings
- [Blocking] Stale integration lockfiles —
vite/webpackbumps in four e2e apps lack correspondingyarn.lockupdates after Renovate artifact failure.
CI was still running (dd-gitlab/* pending) when this review was posted.
Sent by Cursor Automation: electron-sdk reviews
| "electron": "41.1.0", | ||
| "typescript": "5.9.3", | ||
| "vite": "8.0.16" | ||
| "vite": "8.1.0" |
There was a problem hiding this comment.
Blocking — lockfile not updated. Renovate bumped vite here to 8.1.0, but e2e/integration/apps/forge-vite/yarn.lock still resolves vite@npm:8.0.16. The same mismatch exists for:
electron-builder-vite(8.1.0vs lock8.0.16)electron-vite-esm(7.3.6vs lock7.3.5)forge-webpack(5.108.1vs lock5.107.2)
Renovate's PR comment reports artifact update failures for all four apps (missing integration-sdk.tgz in its sandbox). Locally, run yarn install in each app (or trigger a Renovate rebase) so lockfiles match before merge.
| }, | ||
| "dependencies": { | ||
| "dd-trace": "5.109.0" | ||
| "dd-trace": "5.110.0" |
There was a problem hiding this comment.
Only runtime dependency change in this PR. Root yarn.lock is updated and pulls in @datadog/pprof@5.15.1 and import-in-the-middle@3.2.0 (was 3.0.1). No SDK source changes, but worth a quick sanity check that trace initialization and bundler plugin scenarios still pass once CI completes — import-in-the-middle hooks module loading used by dd-trace instrumentation.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b6831ff0ab
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| "electron-builder": "26.15.3", | ||
| "typescript": "5.9.3", | ||
| "vite": "8.0.16" | ||
| "vite": "8.1.0" |
There was a problem hiding this comment.
This manifest update, along with the matching Vite/Webpack bumps in electron-vite-esm, forge-vite, and forge-webpack, leaves the standalone app lockfiles pinned to the previous top-level specs (vite 8.0.16/7.3.5 and webpack 5.107.2). When scripts/install-integration-apps.ts installs these apps it updates and then restores each yarn.lock, so the committed locks no longer capture the dependency graph actually tested and immutable/local installs from the repo are out of sync. Please update the four app yarn.lock files with the manifest changes.
Useful? React with 👍 / 👎.
81b3929 to
39c652a
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 39c652a046
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| }, | ||
| "dependencies": { | ||
| "dd-trace": "5.109.0" | ||
| "dd-trace": "5.111.0" |
There was a problem hiding this comment.
With this root dependency bumped to 5.111.0, the integration app locks are now stale: every e2e/integration/apps/*/yarn.lock still resolves the packed SDK tarball to dd-trace 5.109.0 (for example e2e/integration/apps/electron-builder-vite/yarn.lock:47), and scripts/install-integration-apps.ts updates then restores those lockfiles after packaging. Separate from the existing Vite/Webpack lock drift, the fresh evidence is that all app locks still contain the old SDK tarball dependency, so the committed dependency graph no longer matches what test:integration:init installs for this tracer update.
Useful? React with 👍 / 👎.
| }, | ||
| "dependencies": { | ||
| "dd-trace": "5.109.0" | ||
| "dd-trace": "5.111.0" |
There was a problem hiding this comment.
The minimal E2E app also consumes the root package through portal:../.., but e2e/app/yarn.lock still records that portal dependency as requiring dd-trace 5.109.0. The e2e GitLab job runs yarn test:e2e:init, whose cd e2e/app && yarn install has no --no-immutable; Yarn documents that --immutable defaults to true on CI and aborts if the lockfile would change (https://yarnpkg.com/cli/install). In CI this lockfile mismatch blocks setup before the e2e tests can run, so please update e2e/app/yarn.lock with the tracer bump.
Useful? React with 👍 / 👎.
19e47d0 to
096d103
Compare
902c646 to
dc9f6bf
Compare
ac19f55 to
972b80e
Compare
de4e32c to
f0aada8
Compare
09cc6ad to
43ba69a
Compare
0a844a7 to
a60a112
Compare
a60a112 to
f2e5669
Compare
This PR contains the following updates:
7.5.0→7.9.07.10.07.5.0→7.9.07.10.00.0.5→0.0.100.0.111.61.1→1.62.11.10.0→1.11.04.1.10→4.1.114.1.10→4.1.11v7.0.0→v7.0.110.0.3→10.0.56.10.0→6.12.06.13.00.28.1→0.28.210.7.0→10.9.117.1.0→17.3.017.4.11.61.1→1.62.13.9.5→3.9.64.62.2→4.62.54.63.1(+1)6.4.1→6.5.18.64.0→8.68.08.69.08.1.5→8.2.24.1.10→4.1.115.108.4→5.109.25.110.2(+2)4.17.1→4.18.04.17.1→4.18.0Release Notes
DataDog/browser-sdk (@datadog/browser-core)
v7.9.0Compare Source
Public Changes:
Internal Changes:
v7.8.0Compare Source
Public Changes:
Internal Changes:
v7.7.0Compare Source
Public Changes:
Internal Changes:
v7.6.1Compare Source
Public Changes:
Internal Changes:
v7.6.0Compare Source
Public Changes:
Internal Changes:
DataDog/browser-sdk (@datadog/js-core)
v0.0.10Compare Source
v0.0.9Compare Source
v0.0.8Compare Source
v0.0.7Compare Source
v0.0.6Compare Source
microsoft/playwright (@playwright/test)
v1.62.1Compare Source
v1.62.0Compare Source
🧱 New component testing model
Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a
gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates
to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:
Pass a story type as a template argument to type-check its props, and use
update(props)/unmount()on the returned locator to re-render or tear down within a test.🛑 Cancel operations with AbortSignal
Most operations and web-first assertions now accept a
signaloption that takes anAbortSignal, letting youcancel long-running actions, navigations, waits, and assertions:
Providing a signal does not disable the default timeout; pass
timeout: 0to disable it.🖼️ WebP screenshots
expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot()
can now store snapshots in the WebP format — just give the snapshot a
.webpname:page.screenshot() and locator.screenshot() also accept
webpas atype,where quality
100(the default) is lossless and lower values use lossy compression.🧩 Custom test filtering with Reporter.preprocess()
New reporter.preprocess() hook runs after the configuration is resolved and before
reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded,
fixed, or failing through a TestRun object:
🔁 Isolated retries
New testConfig.retryStrategy controls when failed tests are retried. The default
'immediate'retries as soon as a worker is free;'isolated'runs all retries at the end,one by one in a single worker, to minimize interference with the rest of the suite:
New APIs
Browser and Context
credentialsincludes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.Actions
scrolloption ("auto"|"none") on actions to opt out of Playwright's automatic scroll-into-view.Network
Evaluation
Command line & MCP
playwright-cli, runnable vianpx playwright mcpandnpx playwright cli.Reporters
mergeFilesreporter option:Announcements
Browser Versions
This version was also tested against the following stable channels:
vercel/webpack-asset-relocator-loader (@vercel/webpack-asset-relocator-loader)
v1.11.0Compare Source
Features
v1.10.3Compare Source
Bug Fixes
v1.10.2Compare Source
Bug Fixes
vitest-dev/vitest (@vitest/coverage-v8)
v4.1.11Compare Source
🐞 Bug Fixes
View changes on GitHub
actions/checkout (actions/checkout)
v7.0.1Compare Source
open-cli-tools/concurrently (concurrently)
v10.0.5Compare Source
What's Changed
New Contributors
Full Changelog: open-cli-tools/concurrently@v10.0.4...v10.0.5
v10.0.4Compare Source
What's Changed
New Contributors
Full Changelog: open-cli-tools/concurrently@v10.0.3...v10.0.4
DataDog/dd-trace-js (dd-trace)
v6.12.0: 6.12.0Compare Source
Features
Fixes
Performance
Internal (CI, Testing, Benchmarking)
Contributors
v6.11.0: 6.11.0Compare Source
Features
Fixes
Performance
Documentation
Internal (CI, Testing, Benchmarking)
Contributors
evanw/esbuild (esbuild)
v0.28.2Compare Source
Fix tree shaking bug due to TypeScript import alias (#4507)
This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific
importassignment and looks something like this:Fix CSS minification bug involving
&(#4497)This release fixes a bug where esbuild's CSS minifier incorrectly removed a
&when it was unsafe to do so. Here is an example:This should match
<span class="a"><span class="b"><span class="b">yes</span></span></span>but not<span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.Avoid overwriting input files without
--allow-overwrite(#4484)For example:
esbuild input.js --outfile=input.jstells esbuild to overwriteinput.jswith the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless
--allow-overwriteis explicitly present. This is done by not writing out any files when a build error is encountered.Fix incorrect code generated when using top-level await (#4498)
Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing
asyncon one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing anasyncmodule wrapper.Fix a minification bug with lowered logical assignment operators (#4508)
This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
Fix a potential deadlock when the JavaScript API is used incorrectly (#4503, #4506)
The JavaScript API runs the native esbuild executable as a long-lived child process and communicates with it over stdin/stdout/stderr. Each API request is asynchronous and the executable stays open as long as it has work to do, which is as long as either stdin is still open (meaning there may be more API requests) or there are currently r
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.