deps: update dependencies to latest - #386
Merged
Merged
Conversation
Go: - github.com/lucasb-eyer/go-colorful: v1.4.0 -> v1.4.1 - github.com/google/pprof (indirect): 20260709232956 -> 20260802141513 Web (npm lockfile refresh, 51 transitive packages): - vite: 8.1.3 -> 8.2.0 - rolldown: 1.1.5 -> 1.2.1 - lightningcss: 1.32.0 -> 1.33.0 - @astrojs/language-server: 2.16.11 -> 2.16.13 - postcss: 8.5.23 -> 8.5.25 - prettier: 3.9.4 -> 3.9.6 - @babel/parser, @babel/types: 7.29.7 -> 7.29.8 - ultrahtml: 1.6.0 -> 1.7.0 - devalue: 5.8.1 -> 5.9.0 - entities: 4.5.0 -> 6.0.1 - @oxc-project/types: 0.139.0 -> 0.142.0 - p-queue: 9.3.1 -> 9.3.3 - package-manager-detector: 1.7.0 -> 1.8.0 Lockfile correction: node_modules/typescript now resolves to the alias package.json actually declares, @typescript/typescript6@6.0.2 (published 2026-07-06), instead of the stale hoisted typescript@6.0.3 (published 2026-04-16). The TypeScript 6 line moved to the scoped package after 6.0.3, so this is a forward move despite the lower version number. The classic build still ships nested as @typescript/old. Held back: cosign stays on v2.6.4 in release.yml. v3 forces the single-file bundle format and breaks the detached .sig/.pem signatures that install.sh and install.ps1 verify. Already at latest, no change needed: both package.json manifests, every pinned GitHub Action, golangci-lint v2.12.2, gofumpt v0.11.0, mage v1.17.2, goreleaser v2.17.1, govulncheck v1.6.0, deadcode (x/tools v0.48.0), Node 24 LTS, Go 1.26.5. Validation: gofmt, gofumpt, go mod tidy, go vet, go build, go test, golangci-lint (0 issues), govulncheck (0 vulnerabilities), deadcode, cross-compile for all release targets, npm ci, npm audit (0 vulnerabilities), astro check (0 errors), astro build. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7e11817c-e867-4318-a609-a1bb68bf206d
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Routine dependency refresh across the Go module and the Astro website lockfile.
51 lock entries changed; the table lists the notable ones. No manifest edits needed: every declared range is already at latest.
Lockfile correction.
node_modules/typescriptnow resolves to the aliaspackage.jsonactually declares,@typescript/typescript6@6.0.2(published 2026-07-06), instead of the stale hoistedtypescript@6.0.3(published 2026-04-16). The TypeScript 6 line moved to the scoped package after 6.0.3, so this moves forward despite the lower number, and the classic build still ships nested as@typescript/old.Held back. cosign stays on v2.6.4 in
release.yml; v3 forces the single-file bundle format and breaks the detached.sig/.pemsignatures thatinstall.shandinstall.ps1verify.Already at latest and untouched: every pinned GitHub Action, golangci-lint v2.12.2, gofumpt v0.11.0, mage v1.17.2, goreleaser v2.17.1, govulncheck v1.6.0, deadcode (x/tools v0.48.0), Node 24 LTS, Go 1.26.5.
typecheck/lint/build/test: pass. Local sweep: gofmt, gofumpt, go mod tidy, go vet, go build, go test, golangci-lint (0 issues), govulncheck (0 vulns), deadcode, cross-compile for all release targets, npm ci, npm audit (0 vulns), astro check (0 errors), astro build. Race tests need gcc and run in CI.