fix(deps): unblock renovate lockfile updates and apply pending dependency PRs - #387
Merged
Conversation
…pdates Renovate could not regenerate pnpm-lock.yaml on any branch: its environment enforces a 24h pnpm minimumReleaseAge and rejects the whole lockfile when any entry is younger than the cutoff. It then pushed package.json-only commits, so every dependency PR failed CI with ERR_PNPM_OUTDATED_LOCKFILE. The too-fresh entries came from lockfiles regenerated locally, where the policy was not configured at all. - .npmrc: enforce the same 24h cutoff locally so a regenerated lockfile can no longer contain entries Renovate will reject - renovate.json: only propose releases at least 3 days old, keeping merged entries comfortably clear of that cutoff - renovate.json: config:base -> config:recommended (base is deprecated) and re-enable the dependency dashboard, which surfaces artifact failures in one place instead of hiding them in individual PR comments Verified: pnpm rejects a version inside the cutoff, an update outside it resolves cleanly, and lint, typecheck, format and the 382 tests pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0112NzqomWiWeVxH3R6CJVLH
Brings in the mergeable half of the open dependency PRs, lockfile included: - react-hook-form 7.83.0 -> 7.84.0 (#381) - @testing-library/jest-dom ^6.9.1 -> ^7.0.0 (#383) - eslint-plugin-simple-import-sort ^13.0.0 -> ^14.0.0 (#384) No source changes were needed: jest-dom v7 keeps the bare '@testing-library/jest-dom' setup import, and simple-import-sort v14 produces the same ordering for the configured groups. The two remaining majors are blocked upstream, not by this repo: - eslint v10 (#325) crashes every run via eslint-plugin-react@7.37.5, which still calls context.getFilename(), removed in v10. 7.37.5 is the newest release and eslint-config-next depends on eslint-plugin-react ^7.37.0, so the plugin cannot be dropped or overridden from here. - typescript v7 (#368) is refused outright by typescript-eslint 8.65.0, whose entrypoint throws "does not support TS 7.0". Its peer range caps at <6.1.0 and no newer release exists. Verified: lint, typecheck, format and 382 tests pass. Build compiles and type checks; page-data collection needs the CMS secrets that only CI provides. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0112NzqomWiWeVxH3R6CJVLH
📝 WalkthroughWalkthroughThe pull request updates Renovate and npm release-age settings. It also updates ChangesDependency updates
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #387 +/- ##
=======================================
Coverage 67.04% 67.04%
=======================================
Files 67 67
Lines 789 789
Branches 175 169 -6
=======================================
Hits 529 529
Misses 260 260 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.npmrc:
- Line 3: Remove the minimum-release-age setting from .npmrc and add the
equivalent 24-hour minimumReleaseAge configuration to pnpm-workspace.yaml, using
pnpm’s workspace configuration naming and preserving the existing policy value.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d7bee862-7e7e-4647-af20-43d786c06031
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (3)
.github/renovate.json.npmrcpackage.json
pnpm 11 no longer honours minimum-release-age from a project .npmrc: the install succeeds and the policy is silently skipped. Since the repo pins no packageManager, a contributor or tool on pnpm 11 would lose the guard without any signal. pnpm-workspace.yaml is honoured by both versions, so the setting moves there. Verified against a package published inside the cutoff: - pnpm 11.18.0 + .npmrc -> install succeeds (setting ignored) - pnpm 11.18.0 + pnpm-workspace -> ERR_PNPM_NO_MATURE_MATCHING_VERSION - pnpm 10.33.0 + pnpm-workspace -> ERR_PNPM_NO_MATURE_MATCHING_VERSION Lockfile unchanged, frozen-lockfile install still clean, and Next.js reports no workspace-root change. Lint, typecheck, format and 382 tests pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0112NzqomWiWeVxH3R6CJVLH
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Every open Renovate PR failed at the same step —
pnpm install --frozen-lockfilewithERR_PNPM_OUTDATED_LOCKFILE. Each PR modified onlypackage.json;pnpm-lock.yamlwas missing.The cause is recorded as an
⚠️ Artifact update problemcomment in each PR: Renovate's environment enforces pnpm'sminimumReleaseAgewith a 24h cutoff and rejects the entire lockfile as soon as a single entry is younger — including entries unrelated to the PR at hand.Locally the policy was not configured at all (
pnpm config get minimumReleaseAge→undefined). Lockfiles regenerated here and merged therefore contained freshly published packages, which then blocked Renovate across all branches. This was self-sustaining: every update merged on its release day kept the state alive for another 24 hours.Changes
Policy fix
pnpm-workspace.yaml:minimumReleaseAge: 1440— the same 24h cutoff locally, so a regenerated lockfile can no longer contain entries Renovate will reject. Deliberately not 3 days:lint-staged@17.3.0is pinned exactly and only 2 days old, so a higher value would breakpnpm installimmediately..github/renovate.json:minimumReleaseAge: "3 days"— Renovate only proposes releases comfortably clear of that cutoff..github/renovate.json:config:base→config:recommended(base is deprecated) and the dependency dashboard re-enabled, so artifact failures surface in one place instead of individually in PR comments.The lockfile itself needed no rebuild — the offending entries have since aged past the cutoff.
Dependency updates
react-hook-form7.83.0 → 7.84.0 (fix(deps): update dependency react-hook-form to v7.84.0 - autoclosed #381)@testing-library/jest-dom^6.9.1 → ^7.0.0 (chore(deps): update dependency @testing-library/jest-dom to v7 - autoclosed #383)eslint-plugin-simple-import-sort^13.0.0 → ^14.0.0 (chore(deps): update dependency eslint-plugin-simple-import-sort to v14 - autoclosed #384)No source changes required: jest-dom v7 works with the existing
import '@testing-library/jest-dom', and simple-import-sort v14 orders the configured groups identically.Not included — blocked upstream
eslint v10 (#325) crashes on every run via
eslint-plugin-react@7.37.5:ESLint 10 removed
context.getFilename(); the plugin still calls it. 7.37.5 is the latest release, andeslint-config-next@16.2.12itself depends oneslint-plugin-react: ^7.37.0— the plugin can be neither removed nor overridden from here. Tracked in jsx-eslint/eslint-plugin-react#3977 and vercel/next.js#89764.typescript v7 (#368) is refused outright by
typescript-eslint@8.65.0(typescript-eslint does not support TS 7.0). Its peer range caps at<6.1.0and no newer release exists. Tracked in typescript-eslint#10940.Side note for the eventual TS 7 migration: TS 7 removes
target: "es5"andbaseUrl.src/components/templates/HeroIntro.tsx:10imports via'src/components/ui/icons', which only resolves throughbaseUrl— everywhere else the@/alias is used. Left untouched here.Verification
.npmrc(camelCaseminimumReleaseAgeis silently ignored)lint-staged@17.3.0pnpm-workspace.yaml, not.npmrc— pnpm 11 ignores the.npmrcvariant silently, whilepnpm-workspace.yamlis honoured by both pnpm 10.33 and 11.18 (see review thread)lint:strict,typecheck,format:checkand 382 tests across 30 suites passbuildcompiles and type checks; page-data collection needs the CMS secrets only CI providesFollow-up
#381, #383 and #384 can be closed — their content is included here. #325 and #368 remain open, both waiting on upstream.