Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Abandoned Dependencies

The following dependencies have not received updates for an extended period and may be unmaintained.

View abandoned dependencies (3)

[!NOTE]
Packages are marked as abandoned when they exceed the abandonmentThreshold since their last release. Unlike deprecated packages with official notices, abandonment is detected by release inactivity.

Datasource	Package	Last Updated
npm	class-variance-authority	2024-11-26
npm	clsx	2024-04-23
nuget	Microsoft.NETFramework.ReferenceAssemblies	2022-08-19

Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

• deps: Update actions/checkout digest to 3d3c42e
• deps: Update dependency lucide-react to v1.25.0
• deps: Update actions/setup-dotnet action to v6
• deps: Lock file maintenance
• 🔐 Create all rate-limited PRs at once 🔐

Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

• deps: Update dependency @tanstack/react-query to v5.101.4
• deps: Update dependency @tanstack/react-virtual to v3.14.8
• deps: Update dependency @vitejs/plugin-react to v6.0.4
• deps: Update dependency react to v19.2.8
• deps: Update dependency react-dom to v19.2.8
• deps: Update dependency typescript-eslint to v8.65.0
• deps: Update dependency @testing-library/jest-dom to v7

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• deps: Update ancplua-sdk to 2.2.42 (ANcpLua.Roslyn.Utilities, ANcpLua.Roslyn.Utilities.Testing)
• deps: Update dependency vite to v8.1.5
• deps: Update tailwindcss monorepo to v4.3.3 (@tailwindcss/vite, tailwindcss)
• deps: Update dependency Microsoft.Build to 18.8.2
• deps: Update actions/setup-node action to v7
• Click on this checkbox to rebase all open PRs at once

PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

• deps: Update dependency @babel/plugin-transform-runtime to v8
• deps: Update dependency typescript to v7

Detected Dependencies

docker-compose (1)

eng/compose.yaml

dockerfile (1)

services/qyl.collector/Dockerfile (4)

• docker/dockerfile 1@sha256:87999aa3d42bdc6bea60565083ee17e86d1f3339802f543c0d03998580f9cb89
• node 24-slim@sha256:6f7b03f7c2c8e2e784dcf9295400527b9b1270fd37b7e9a7285cf83b6951452d
• mcr.microsoft.com/dotnet/sdk 10.0-aot@sha256:977c117b98abe301eeb4c2ed3f8deebf8b8f11e65549ee7886581d2b41641adb
• mcr.microsoft.com/dotnet/runtime-deps 10.0@sha256:894098eafc82e5fa02ba9f2b71d426dc78252876b9e914caae77ed95cfce185a

github-actions (3)

.github/workflows/ci.yml (15)

• actions/checkout v7@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7]
• actions/checkout v7@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7]
• actions/setup-dotnet v5@26b0ec14cb23fa6904739307f278c14f94c95bf1 → [Updates: v6]
• actions/checkout v7@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7]
• actions/setup-dotnet v5@26b0ec14cb23fa6904739307f278c14f94c95bf1 → [Updates: v6]
• actions/checkout v7@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7]
• actions/setup-dotnet v5@26b0ec14cb23fa6904739307f278c14f94c95bf1 → [Updates: v6]
• actions/setup-node v6@249970729cb0ef3589644e2896645e5dc5ba9c38 → [Updates: v7]
• actions/upload-artifact v7@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• actions/checkout v7@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7]
• actions/setup-dotnet v5@26b0ec14cb23fa6904739307f278c14f94c95bf1 → [Updates: v6]
• actions/setup-node v6@249970729cb0ef3589644e2896645e5dc5ba9c38 → [Updates: v7]
• actions/checkout v7@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7]
• actions/setup-dotnet v5@26b0ec14cb23fa6904739307f278c14f94c95bf1 → [Updates: v6]
• actions/setup-node v6@249970729cb0ef3589644e2896645e5dc5ba9c38 → [Updates: v7]

.github/workflows/links.yml (2)

• actions/checkout v7@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7]
• lycheeverse/lychee-action v2.9.0@e7477775783ea5526144ba13e8db5eec57747ce8

.github/workflows/nuget-publish.yml (12)

• actions/checkout v7@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7]
• actions/checkout v7@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7]
• actions/setup-dotnet v5@26b0ec14cb23fa6904739307f278c14f94c95bf1 → [Updates: v6]
• actions/setup-node v6@249970729cb0ef3589644e2896645e5dc5ba9c38 → [Updates: v7]
• actions/checkout v7@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7]
• actions/setup-dotnet v5@26b0ec14cb23fa6904739307f278c14f94c95bf1 → [Updates: v6]
• actions/setup-node v6@249970729cb0ef3589644e2896645e5dc5ba9c38 → [Updates: v7]
• actions/upload-artifact v7@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• actions/checkout v7@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7]
• actions/download-artifact v8@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
• actions/setup-dotnet v5@26b0ec14cb23fa6904739307f278c14f94c95bf1 → [Updates: v6]
• NuGet/login v1@8d196754b4036150537f80ac539e15c2f1028841

npm (1)

services/qyl.dashboard/package.json (32)

• @ancplua/qyl-api-schema 1.0.5
• @base-ui/react ^1.4.1
• @tanstack/react-query ^5.99.2 → [Updates: ^5.99.2]
• @tanstack/react-virtual ^3.13.24 → [Updates: ^3.13.24]
• ajv 8.20.0
• class-variance-authority ^0.7.1
• clsx ^2.1.1
• lucide-react ^1.8.0 → [Updates: ^1.8.0]
• react ^19.2.5 → [Updates: ^19.2.5]
• react-dom ^19.2.5 → [Updates: ^19.2.5]
• react-router-dom ^7.14.2
• sonner ^2.0.7
• tailwind-merge ^3.5.0
• @eslint/js 10.0.1
• @playwright/test 1.61.1
• @tailwindcss/vite 4.3.2 → [Updates: 4.3.3]
• @testing-library/jest-dom 6.9.1 → [Updates: 7.0.0]
• @types/react 19.2.17
• @types/react-dom 19.2.3
• @vitejs/plugin-react 6.0.3 → [Updates: 6.0.4]
• @vitest/coverage-v8 4.1.10
• eslint 10.7.0
• globals 17.7.0
• jsdom 29.1.1
• tailwindcss 4.3.2 → [Updates: 4.3.3]
• typescript 5.9.3 → [Updates: 7.0.2]
• typescript-eslint 8.64.0 → [Updates: 8.65.0]
• vite 8.1.4 → [Updates: 8.1.5]
• vitest 4.1.10
• node ^20.19.0 || >=22.12.0
• js-yaml ^4.2.0 → [Updates: ^5.0.0]
• @babel/plugin-transform-runtime ^7.29.0 → [Updates: ^8.0.0]

nuget (18)

Directory.Packages.props (14)

• Qyl.OpenTelemetry.SemanticConventions.SourceGeneration 3.5.1
• Qyl.OpenTelemetry.SemanticConventions.Incubating 3.5.1
• Qyl.OpenTelemetry.SemanticConventions 3.5.1
• YamlDotNet 18.1.0
• Valleysoft.DockerfileModel 2.0.0
• Microsoft.NETFramework.ReferenceAssemblies 1.0.3
• Microsoft.Build 18.7.1 → [Updates: 18.8.2]
• McMaster.Extensions.CommandLineUtils 5.1.0
• xunit.v3.mtp-v2 3.2.2
• System.Security.Cryptography.Xml 10.0.10
• NuGet.Packaging 7.6.0
• Microsoft.CodeAnalysis.PublicApiAnalyzers 5.6.0
• Microsoft.CodeAnalysis.CSharp 5.6.0
• Microsoft.OpenApi 2.11.0 → [Updates: 3.9.0]

eng/build/build.csproj

eng/tools/CollectorAotSmoke/CollectorAotSmoke.csproj

eng/tools/GacInstallTool/GacInstallTool.csproj

eng/tools/LibraryVersionsGenerator/LibraryVersionsGenerator.csproj

eng/tools/QylSdkConformance/QylSdkConformance.csproj

eng/tools/SdkVersionAnalyzer/SdkVersionAnalyzer.csproj

global.json (6)

• dotnet-sdk 10.0.302
• ANcpLua.NET.Sdk 3.4.45
• ANcpLua.NET.Sdk.Web 3.4.45
• ANcpLua.NET.Sdk.Test 3.4.45
• ANcpLua.Roslyn.Utilities.Testing 2.2.39 → [Updates: 2.2.42]
• ANcpLua.Roslyn.Utilities 2.2.39 → [Updates: 2.2.42]

internal/qyl.collector.storage.generators/qyl.collector.storage.generators.csproj (1)

• Microsoft.CodeAnalysis.CSharp 5.6.0

internal/qyl.instrumentation.generators/qyl.instrumentation.generators.csproj (1)

• Microsoft.CodeAnalysis.CSharp 5.6.0

internal/qyl.instrumentation/qyl.instrumentation.csproj

packages/Directory.Build.props

packages/Qyl.Host/Qyl.Host.csproj

packages/Qyl.Run.Workload/Qyl.Run.Workload.csproj

services/qyl.collector/qyl.collector.csproj

tests/Qyl.Collector.Tests/Qyl.Collector.Tests.csproj

tests/Qyl.Host.Tests/Qyl.Host.Tests.csproj

tests/Qyl.Sdk.Conformance/Qyl.Sdk.Conformance.csproj

renovate-config (1)

renovate.json

---

• Check this box to trigger a request for Renovate to run again on this repository

[coderabbitai]

🔗 Related PRs

#3 - fix: resolve NU1506 duplicate package errors and update SDK to 1.6.29 [merged]
#186 - ci(auto-merge): consume reusable workflow + keep Governance tier local [merged]
#194 - chore(deps-bot): remove Dependabot, make Renovate canonical [merged]
#240 - deps: bump ANcpLua.Agents 0.6 → 1.4.1 + trailing pins [merged]
#304 - chore: remove qyl.OpenTelemetry.SemanticConventions.Analyzers package [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[coderabbitai]

Coding Plan

Summary

• Lock file maintenance is an automated Renovate action—no code changes required from developers
• The checked checkbox triggers immediate execution; Renovate handles PR creation
• Manual fallback involves running npm install in 7 directories if automation fails
• Missing packageManager declarations create npm version drift risk across CI environments and developer machines

Implementation Steps

Phase 1: Automated Lock File Maintenance (Renovate-Driven)

The checked checkbox [x] deps: Lock file maintenance instructs Renovate to unschedule the pending maintenance and execute immediately. No manual implementation is required unless Renovate fails.

Task 1: Verify Renovate Execution

Confirm that Renovate creates the renovate/lock-file-maintenance branch and opens a PR.

• Monitor for PR creation on branch renovate/lock-file-maintenance
• Renovate will regenerate lock files in all 7 locations:
  • services/qyl.dashboard/package-lock.json
  • packages/qyl-client/package-lock.json
  • core/specs/package-lock.json
  • core/specs/emitters/csharp/package-lock.json
  • core/specs/emitters/duckdb/package-lock.json
  • core/specs/emitters/ts-types/package-lock.json
  • core/specs/emitters/qyl-semconv-lint/package-lock.json
• Lock file maintenance does NOT bump pinned versions—only transitive resolutions change

Task 2: CI Validation

Ensure the generated PR passes all CI checks before merge.

• Full test suite must pass—transitive bumps can introduce subtle breakage
• Pay attention to TypeSpec emitter packages under core/specs/emitters/; these have peer dependency constraints on @typespec/compiler ^1.12.0-dev
• Dashboard (qyl.dashboard) has Playwright and Vitest; watch for flaky tests from dependency drift

🤖 Prompt for AI agents

This phase is fully Renovate-driven; no code is generated by a coding agent. The
goal is to verify that Renovate correctly triggers and completes lock file
maintenance across all 7 packages.

- No code changes are required from developers in this phase
- Confirm that Renovate creates the `renovate/lock-file-maintenance` branch and
opens a PR targeting the correct base branch
- Validate that the PR includes regenerated `package-lock.json` files at all 7
paths:
  - `services/qyl.dashboard/package-lock.json`
  - `packages/qyl-client/package-lock.json`
  - `core/specs/package-lock.json`
  - `core/specs/emitters/csharp/package-lock.json`
  - `core/specs/emitters/duckdb/package-lock.json`
  - `core/specs/emitters/ts-types/package-lock.json`
  - `core/specs/emitters/qyl-semconv-lint/package-lock.json`
- Confirm that no `package.json` dependency versions are altered—only transitive
resolutions in the lock files should change
- Verify CI passes on the Renovate PR before merging; flag failures in TypeSpec
emitter packages (peer constraint `@typespec/compiler ^1.12.0-dev`) and in
`qyl.dashboard` (Playwright/Vitest) as high-priority—these are the most likely
breakage points from transitive drift

Phase 2: Manual Fallback (If Renovate Fails)

Only execute if Renovate does not create the maintenance PR within expected timeframe.

Task 1: Regenerate Lock Files Manually

Run npm install in each package directory to regenerate lock files.

• Use a consistent npm version (npm 10+ recommended for lockfile v3 compatibility)
• Execute in order (emitters before core/specs if local file: dependencies require it):

  core/specs/emitters/csharp/
  core/specs/emitters/duckdb/
  core/specs/emitters/ts-types/
  core/specs/emitters/qyl-semconv-lint/
  core/specs/
  packages/qyl-client/
  services/qyl.dashboard/
  

• Commit all 7 lock files in a single commit with message deps: Lock file maintenance

Task 2: Add packageManager Field (Recommended Follow-up)

Address npm version drift risk by pinning the package manager.

• Consider adding "packageManager": "npm@10.x.x" to each package.json, or
• Add a root-level .npmrc or tooling config if standardizing across packages
• This is out of scope for this ticket but flagged as technical debt

🤖 Prompt for AI agents

This phase is a manual fallback executed only if Renovate fails to produce the
maintenance PR. The goal is to reproduce what Renovate would have done:
regenerate all 7 `package-lock.json` files to their latest allowed transitive
resolutions.

- Use npm 10+ to ensure lockfile v3 format compatibility; using a mismatched npm
version will corrupt the lockfile format and create CI/developer machine drift
- Run `npm install` (not `npm ci`) in each package directory in the following
order to respect any local `file:` dependency edges:
  1. `core/specs/emitters/csharp/`
  2. `core/specs/emitters/duckdb/`
  3. `core/specs/emitters/ts-types/`
  4. `core/specs/emitters/qyl-semconv-lint/`
  5. `core/specs/`
  6. `packages/qyl-client/`
  7. `services/qyl.dashboard/`
- Do NOT modify any `package.json` files—only lock files should change
- Stage all 7 regenerated `package-lock.json` files and commit together with the
message: `deps: Lock file maintenance`
- The `packageManager` field addition is out of scope for this ticket; flag it
as technical debt but do not implement it here

Research

This repository contains 7 independent npm packages without workspace configuration. Each maintains its own package-lock.json (npm, lockfile v3). No packageManager field is declared anywhere—npm version is implicit. Renovate configuration delegates entirely to the external preset at github>ANcpLua/renovate-config, meaning lock file maintenance schedule and behavior are not locally visible or auditable.

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

This phase is fully Renovate-driven; no code is generated by a coding agent. The
goal is to verify that Renovate correctly triggers and completes lock file
maintenance across all 7 packages.

- No code changes are required from developers in this phase
- Confirm that Renovate creates the `renovate/lock-file-maintenance` branch and
opens a PR targeting the correct base branch
- Validate that the PR includes regenerated `package-lock.json` files at all 7
paths:
  - `services/qyl.dashboard/package-lock.json`
  - `packages/qyl-client/package-lock.json`
  - `core/specs/package-lock.json`
  - `core/specs/emitters/csharp/package-lock.json`
  - `core/specs/emitters/duckdb/package-lock.json`
  - `core/specs/emitters/ts-types/package-lock.json`
  - `core/specs/emitters/qyl-semconv-lint/package-lock.json`
- Confirm that no `package.json` dependency versions are altered—only transitive
resolutions in the lock files should change
- Verify CI passes on the Renovate PR before merging; flag failures in TypeSpec
emitter packages (peer constraint `@typespec/compiler ^1.12.0-dev`) and in
`qyl.dashboard` (Playwright/Vitest) as high-priority—these are the most likely
breakage points from transitive drift
===============================================================================

Task: 2

This phase is a manual fallback executed only if Renovate fails to produce the
maintenance PR. The goal is to reproduce what Renovate would have done:
regenerate all 7 `package-lock.json` files to their latest allowed transitive
resolutions.

- Use npm 10+ to ensure lockfile v3 format compatibility; using a mismatched npm
version will corrupt the lockfile format and create CI/developer machine drift
- Run `npm install` (not `npm ci`) in each package directory in the following
order to respect any local `file:` dependency edges:
  1. `core/specs/emitters/csharp/`
  2. `core/specs/emitters/duckdb/`
  3. `core/specs/emitters/ts-types/`
  4. `core/specs/emitters/qyl-semconv-lint/`
  5. `core/specs/`
  6. `packages/qyl-client/`
  7. `services/qyl.dashboard/`
- Do NOT modify any `package.json` files—only lock files should change
- Stage all 7 regenerated `package-lock.json` files and commit together with the
message: `deps: Lock file maintenance`
- The `packageManager` field addition is out of scope for this ticket; flag it
as technical debt but do not implement it here

💡 Iterate on the plan with: @coderabbitai <feedback>

Example Feedback
- @coderabbitai You can skip phase 3. Add a simple unit test case for phase 2.
- @coderabbitai For design choice 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!

[coderabbitai]

I've updated the plan above based on your feedback. Ready to proceed when you are!