Deps: Bump postcss from 8.5.20 to 8.5.23 - #111
Merged
Merged
Conversation
Rebuilt on current main with a pnpm-resolved lockfile. Dependabot's own resolution floated 13 unrelated entries to versions published inside the `minimumReleaseAge` window (turbo 2.10.8, ws 8.21.2, nanoid 3.3.17, recast 0.23.19, minimatch 10.2.6, …), which `pnpm install` rejects with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION — so CI failed in the install step before running a single test. Dependabot's `cooldown` only gates which *direct* updates it proposes; it has no age awareness when regenerating the lockfile. Letting pnpm resolve instead keeps every transitive at its current, age-compliant version and moves postcss alone: 7 lines instead of a sprawl. pnpm also held postcss at 8.5.23 rather than the available 8.5.25, which is 7 days old and inside the window. The policy working as intended. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
|
Storybook preview: https://preview-111.ratio-ui.pages.dev |
There was a problem hiding this comment.
Pull request overview
Updates the repo’s PostCSS dependency to a newer patch release while keeping the pnpm-lock.yaml resolution minimal and compliant with the workspace minimumReleaseAge policy, avoiding Dependabot-induced transitive churn.
Changes:
- Bump direct
postcssdevDependency from^8.5.20to^8.5.23. - Update
pnpm-lock.yamlto resolvepostcssto8.5.23(and update dependent snapshot references accordingly).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| package.json | Updates the declared PostCSS version range to ^8.5.23. |
| pnpm-lock.yaml | Updates the lockfile entry and snapshots to use postcss@8.5.23, with no leftover 8.5.20 references. |
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
losolio
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #108, which is red for a reason that has nothing to do with postcss.
Why #108 fails
Both jobs die after ~17s, in the install step:
None of the 13 is postcss. Dependabot regenerated
pnpm-lock.yamland floatedunrelated transitives to their newest releases, all published inside the 10-day
minimumReleaseAgewindow:@turbo/*)turboisn't even a postcss dependency.Root cause
.github/dependabot.ymlalready setscooldown: default-days: 10, matchingminimumReleaseAge: 14400inpnpm-workspace.yaml. The two look like a closedloop, but they act at different layers: cooldown gates which direct updates
Dependabot proposes, while lockfile regeneration re-resolves transitives
with no age awareness at all. pnpm then rejects the result at install time.
This is systemic, not a one-off — #99 fails identically, and a weekly rebase
re-floats the transitives, so these PRs don't reliably heal by waiting.
This PR
Rebuilt on current main, letting pnpm resolve the lockfile instead of
Dependabot. Every offender above already has an age-compliant version that
satisfies its range, so pnpm keeps them and moves postcss alone — 7 lockfile
lines instead of a sprawl.
pnpm also held postcss at 8.5.23 rather than the available 8.5.25, which is
7 days old and inside the window. The policy doing its job.
Verified locally:
turbo run lint build --force9/9,pnpm test92/92 files,512/512 tests.
The upstream change itself is worth taking but not urgent — 8.5.23 is
"do not load source map without
opts.fromfor security reasons".🤖 Generated with Claude Code