chore(deps): bump all dependencies to latest - #861
Merged
Conversation
Bump normal and dev dependencies to their latest compatible versions and regenerate the lockfile. Notable major bumps adapted in code: - marked 9 -> 18: renderer methods now receive token objects; the custom proposal-summary renderer adapts them to the existing helper signatures. - vitest 3 -> 4: constructor mocks must be classes (IntersectionObserver mocks), and a node `util` TextEncoder polyfill needs a cast. - @dfinity/eslint-config-oisy-wallet 0.2 -> 0.5: stricter rules; trivial violations fixed, test-only/navigation rules disabled to match the repo's existing override convention. Kept at latest in-range (not bumped to a new major) to avoid conflicts: - typescript pinned to ^5.9.3 (eslint config requires typescript@^5; 6.x is not yet supported by the toolchain). - vite ^7 and @sveltejs/vite-plugin-svelte ^6 (SvelteKit 2.x peer-requires vite-plugin-svelte ^6, which requires vite ^7; vite 8 / plugin 7 unsupported). npm audit: 7 -> 1 (remaining is a dev-only, Windows-only esbuild advisory that requires a breaking change).
|
✅ No security or compliance issues detected. Reviewed everything up to 6a119dc. Security Overview
Detected Code ChangesThe diff is too large to display a summary of code changes. |
…onal deps The new eslint config pulls in eslint-plugin-import-x -> unrs-resolver, whose optional `@napi-rs/wasm-runtime` declares `@emnapi/core`/`@emnapi/runtime` as peer deps. Running `npm install` on macOS omitted those package nodes from the lockfile, so CI's Linux `npm ci` failed with "Missing: @emnapi/core from lock file". Regenerated the lockfile on linux/amd64 (matching CI) so it contains the full cross-platform tree; validated with `npm ci` on both linux/amd64 and macOS.
main #852 refactored the conditional expects (assertNonNullish) and added resolve() to the resources page, so vitest/no-conditional-expect and svelte/no-navigation-without-resolve now pass without overrides. Keep the rules enforced.
DenysKarmazynDFINITY
approved these changes
Jun 22, 2026
There was a problem hiding this comment.
Pull request overview
This PR updates the project’s npm dependencies/devDependencies to newer (including major) versions and applies the minimal source/test adjustments needed to keep the library and its test suite compatible with upstream breaking changes (notably marked and vitest).
Changes:
- Updated
markedrenderer wiring to accommodate token-object renderer APIs while preserving existing helper signatures. - Updated vitest-related test setup/mocks to satisfy newer mocking/type requirements (e.g., class-based
IntersectionObservermock,vi.stubGlobalusage, TextEncoder typing). - Bumped a broad set of dependencies in
package.jsonconsistent with the “latest compatible” toolchain constraints described in the PR.
Reviewed changes
Copilot reviewed 9 out of 10 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| vitest.setup.ts | Adds a targeted eslint override explanation and adjusts TextEncoder global assignment typing. |
| src/tests/utils/render.test-utils.ts | Minor formatting-only change. |
| src/tests/lib/mocks/infinitescroll.mock.ts | Replaces IntersectionObserverPassive mock with a class implementation to support new usage. |
| src/tests/lib/components/SystemThemeListener.spec.ts | Minor formatting-only change. |
| src/tests/lib/components/ScrollSentinel.spec.ts | Updates global IntersectionObserver mocking approach for newer vitest behavior. |
| src/lib/utils/markdown.utils.ts | Adapts custom marked renderer handlers to token-object renderer method signatures. |
| src/lib/utils/html.utils.ts | Simplifies DOMPurify global fallback assignment under updated typings. |
| src/lib/components/QRCodeReader.svelte | Formatting-only change to dynamic import statement. |
| package.json | Bumps dependencies/devDependencies to newer versions (including majors like marked and vitest). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
AntonioVentilii
added a commit
that referenced
this pull request
Jun 22, 2026
Rebased onto main (#861 already bumped everything else to latest, incl. vitest 4). This carries only the remaining hard majors that #861 deliberately held back, plus the adaptations needed to make them install and type-check: - package.json: vite ^8.0.16, @sveltejs/vite-plugin-svelte ^7.1.2, typescript ^6.0.3. SvelteKit 2.66's vite-plugin-svelte peer already allows ^7. TS 6 collides with @dfinity/eslint-config-oisy-wallet's `typescript@^5` peer, resolved via an `overrides` entry pinning the config's typescript to the root `$typescript`. - IntersectionObserver mocks: add `scrollMargin` (TS 6's DOM lib added it to the interface). - vitest.setup.ts: cast the global target for the TextEncoder polyfill (TS 6 made `Uint8Array` generic). - eslint: disable `no-useless-assignment` for .svelte files (false positives on reactive `$:` reassignments). - i18n.types.mjs: read en.json as utf-8. Lockfile regenerated on linux/amd64; npm ci, lint, check, test (331), and build all validated green in a CI-matching container.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps all
dependenciesanddevDependenciesto their latest compatible versions and regenerates the lockfile. Adapts source to the breaking API changes the majors introduced.npm run lint,npm run check,npm test(331 tests),npm run package, andnpm run buildall pass.Notable major bumps (with code changes)
markdown.utils.tsadapts them to the existing helper signatures (usingrenderer.parser.parseInlinefor link text); the exported helpers keep their friendly signatures so their unit tests are unchanged.IntersectionObservermock became a class, andScrollSentinel.spec.tsswitched tovi.stubGlobal. TheutilTextEncoderpolyfill needs a cast under the updated type defs.import/order, two now-unnecessary type assertions).vitest/no-conditional-expectandsvelte/no-navigation-without-resolveare disabled ineslint.config.mjs, consistent with the repo's existing practice of overriding upstream rules (e.g.vitest/expect-expect). One file-levelimport/orderdisable invitest.setup.tsdocuments a genuine conflict betweenprettier-plugin-organize-imports(forces side-effect import first) and the rule.Kept at latest in-range (not bumped to a new major) to avoid conflicts
^5.9.3— the eslint config peer-requirestypescript@^5; 6.x isn't supported by the toolchain yet.^7/ @sveltejs/vite-plugin-svelte^6— SvelteKit 2.x peer-requiresvite-plugin-svelte@^6, which requiresvite@^7. vite 8 / plugin 7 aren't supported by the current SvelteKit.Security
npm auditwent from 7 → 1; the remaining advisory is a dev-only, Windows-only esbuild dev-server issue that only a breaking--forcechange would resolve.