Skip to content

chore(deps)(deps): bump @casl/ability from 6.8.1 to 7.0.0 in /apps/ui - #104

Merged
agjs merged 1 commit into
mainfrom
dependabot/bun/apps/ui/casl/ability-7.0.0
Jun 2, 2026
Merged

chore(deps)(deps): bump @casl/ability from 6.8.1 to 7.0.0 in /apps/ui#104
agjs merged 1 commit into
mainfrom
dependabot/bun/apps/ui/casl/ability-7.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 1, 2026

Copy link
Copy Markdown
Contributor

Bumps @casl/ability from 6.8.1 to 7.0.0.

Release notes

Sourced from @​casl/ability's releases.

@​casl/ability: v7.0.0

7.0.0 (2026-05-21)

⚠ BREAKING CHANGES

  • .possibleRulesFor and .rulesFor return readonly Rule[] type
  • this function is unused in userland and mostly was needed to restore ForbiddenError state in tests
  • renames PureAbility to Ability and dops default options. In order, to get the previous behavior of Ability class, clients are expected to use createMongoAbility and MongoAbility type
  • Ability matching now treats conditions that semantically match everything the same as rules without conditions.
  • rulesToQuery has been replaced with rulesToCondition

Bug Fixes

  • defensive protection against undefined returned from rule conditions matcher (3f0ad4b)
  • deps: upgrades @ucast/* to latest version (#1218) (22b00ff)
  • ensure rules index cache is not polluted with not defined actions (#1228) (89c19ba)
  • treats empty conditions object as matches all (#1198) (cedc463), closes #684
  • ensure that rulesToQuery and rulesToAST generate condition that respect rule priority (#1193)

Code Refactoring

  • removes getDefaultErrorMessage exported function as unneeded (#1206) (3f56353)
  • renames PureAbility to Ability (#1205) (97beee4)

@​casl/ability: v7.0.0-rc

7.0.0-rc (2026-05-08)

⚠ BREAKING CHANGES

  • this function is unused in userland and mostly was needed to restore ForbiddenError state in tests
  • renames PureAbility to Ability and dops default options. In order, to get the previous behavior of Ability class, clients are expected to use createMongoAbility and MongoAbility type
  • Ability matching now treats conditions that semantically match everything the same as rules without conditions.

Bug Fixes

Code Refactoring

  • removes getDefaultErrorMessage exported function as unneeded (#1206) (3f56353)
  • renames PureAbility to Ability (#1205) (97beee4)
Changelog

Sourced from @​casl/ability's changelog.

7.0.0 (2026-05-21)

⚠ BREAKING CHANGES

  • .possibleRulesFor and .rulesFor return readonly Rule[] type
  • getDefaultErrorMessage function is unused in userland and mostly was needed to restore ForbiddenError state in tests
  • renames PureAbility to Ability and drops default options. In order, to get the previous behavior of Ability class, clients are expected to use createMongoAbility and MongoAbility type
  • Ability matching now treats conditions that semantically match everything the same as rules without conditions.
  • rulesToQuery has been replaced with rulesToCondition

Bug Fixes

  • defensive protection against undefined returned from rule conditions matcher (3f0ad4b)
  • deps: upgrades @ucast/* to latest version (#1218) (22b00ff)
  • ensure rules index cache is not polluted with not defined actions (#1228) (89c19ba)
  • treats empty conditions object as matches all (#1198) (cedc463), closes #684
  • ensure that rulesToQuery and rulesToAST generate condition that respect rule priority (#1193)

Code Refactoring

  • removes getDefaultErrorMessage exported function as unneeded (#1206) (3f56353)
  • renames PureAbility to Ability (#1205) (97beee4)
Commits
  • a4a4a1a chore: release master (#1199)
  • 3f0ad4b fix: defensive protection against undefined returned from rule conditions mat...
  • 89c19ba fix: ensure rules index cache is not polluted with not defined actions (#1228)
  • b51b1b8 chore: allow next as publish branch
  • d875352 chore: fixes release for casl-ability
  • d49daa6 chore: specify dist tag in release script
  • 569bc1e test: refactor tests to ts
  • 22b00ff fix(deps): upgrades @ucast/* to latest version (#1218)
  • fcfde9d chore: fixes package metadata for @​casl/ability
  • 3f56353 refactor: removes getDefaultErrorMessage exported function as unneeded (#1206)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 1, 2026
@dependabot
dependabot Bot requested a review from agjs as a code owner June 1, 2026 23:23
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 1, 2026
agjs added a commit that referenced this pull request Jun 2, 2026
)

Combines 19 open dependabot PRs into one batch. Manifest pins applied and each
app's bun.lock regenerated once (frozen-lockfile verified); paths-filter bumped
across all workflows.

api:  bullmq 5.77.3; nodemailer 8.0.8; resend 6.12.4; @anthropic-ai/sdk 0.98.0;
      openai 6.39.0; eslint-plugin-{oauth-security,structured-logging,
      test-conventions,audit-log,cache-keys} 0.1.2; knip 6.14.2 (parity)
ui:   @tanstack/react-query(+devtools) 5.100.14; vitest(+coverage-v8) 4.1.7;
      storybook(+addon-a11y,addon-themes,react-vite) 10.4.1; knip 6.14.2;
      eslint-plugin-{i18n-keys,test-conventions} 0.1.2; vite 8.0.14
docs: ws 8.21.0; astro 6.3.7; wrangler 4.94.0
ci:   dorny/paths-filter v4.0.1 (#102)

knip bumped in api too for shared-tool-version-parity (the ui-only PR #105 would
otherwise break that lint-meta rule on main).

Excluded: #104 @casl/ability 6->7 (major; needs review on its own).

Validated: bun run check (api, ui), ui test:ci + build, docs build:ci all green;
bun install --frozen-lockfile passes in all three apps.

Closes #89, #90, #91, #92, #93, #94, #95, #96, #97, #98, #99, #100, #101, #102,
#103, #105, #106, #107, #108
Bumps [@casl/ability](https://github.com/stalniy/casl/tree/HEAD/packages/casl-ability) from 6.8.1 to 7.0.0.
- [Release notes](https://github.com/stalniy/casl/releases)
- [Changelog](https://github.com/stalniy/casl/blob/master/packages/casl-ability/CHANGELOG.md)
- [Commits](https://github.com/stalniy/casl/commits/@casl/ability@7.0.0/packages/casl-ability)

---
updated-dependencies:
- dependency-name: "@casl/ability"
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/bun/apps/ui/casl/ability-7.0.0 branch from 00fe06e to 7edd88d Compare June 2, 2026 08:55
@agjs
agjs merged commit 34fff4a into main Jun 2, 2026
23 checks passed
@agjs
agjs deleted the dependabot/bun/apps/ui/casl/ability-7.0.0 branch June 2, 2026 09:34
agjs added a commit that referenced this pull request Jun 2, 2026
Follow-up to #104, which bumped @casl/ability to 7.0.0 in ui only.

- api: @casl/ability 6.8.1 -> 7.0.0 (keeps the shared ACL model in parity; api
  was left on v6 by #104).
- ui: drop @casl/react. v7 removed createContextualCan, the only API the UI used
  from it, and #104 left @casl/react@6 paired with @casl/ability@7 (peer
  mismatch). Reimplement the small <Can> directly over the existing typed
  AbilityContext instead of pulling v7's AbilityProvider/useAbility (which would
  replace the template's deliberate AbilityContext + emptyAbility design and its
  tests). That makes @casl/react unused, so it's removed.

Validated: bun run check (api, ui), ACL suites (api 50, ui 13), ui build; bun
install --frozen-lockfile clean in both apps.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant