Repository navigation
fix(deps): the js-yaml override follows the direct dependency - #1771
Merged
Merged
Conversation
The root Dependabot job failed with the message that the override for js-yaml 5.4.2 conflicts with the direct dependency whenever it tried to bump js-yaml, because the override carried its own range. The overrides and the pnpm.overrides now reference the direct dependency, so a bump of js-yaml changes one field and the override follows it. The lockfile is unchanged: js-yaml 4.3.2 for the root and for markdownlint-cli, and both npm and bun read the reference. Signed-off-by: Felipe Marzochi <fmarzochi@gmail.com>
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 1 file
Reply with feedback, questions, or to request a fix.
View guided diff | Turn on auto-fix | Re-trigger cubic
… covers With the bare js-yaml entry of pnpm.overrides pointing at the direct dependency, the markdownlint-cli nested selector resolved to the same spec and changed nothing in the tree. Review point of the first push. Signed-off-by: Felipe Marzochi <fmarzochi@gmail.com>
|
Fmarzochi
added a commit
that referenced
this pull request
Oct 8, 2026
… docs of 2026-10-07 (#1773) * docs: the changelog and the roadmap record the three merges after the docs of 2026-10-07 The session-end hook budget and warning (#1772), the js-yaml override by reference (#1771) and the fixture sweep over 21 test files (#1768) enter Unreleased in both files. Signed-off-by: Felipe Marzochi <fmarzochi@gmail.com> * docs: the sweep entry claims the 21 files it changed Review point: tests/check-internal-tool-leak.test.js still builds git repositories without the shared fixture, so the headline no longer says every test. Signed-off-by: Felipe Marzochi <fmarzochi@gmail.com> --------- Signed-off-by: Felipe Marzochi <fmarzochi@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The root Dependabot job failed with the message that the override for js-yaml 5.4.2 conflicts with the direct dependency whenever it tried to bump js-yaml, because the override in package.json carried its own range. The overrides and the pnpm.overrides now reference the direct dependency, so a bump of js-yaml changes one field and the override follows it. The lockfile is unchanged (js-yaml 4.3.2 for the root and for markdownlint-cli): npm install with package-lock-only reported up to date and 0 vulnerabilities, and a bun install dry run in a scratch copy resolved the tree with the reference.
Summary by cubic
Fixes the root Dependabot job failing when bumping
js-yaml, because the override carried its own range that conflicted with the direct dependency. Theoverridesandpnpm.overridesnow reference the direct dependency ($js-yaml), so a bump changes one field and the override follows it. The nestedmarkdownlint-cli>js-yamlselector was dropped since the bare override already resolves to the same spec. The lockfile is unchanged (js-yaml4.3.2 for both the root andmarkdownlint-cli).Written for commit bc00130. Summary will update on new commits.