chore(deps): group low-risk frontend bumps (ai, @ai-sdk/react, @types/react) - #221
Conversation
…/react) Batches dependabot #208, #214, #205. - ai 7.0.52 -> 7.0.62 - @ai-sdk/react 4.0.55 -> 4.0.65 - @types/react 19.2.17 -> 19.2.18 Baseline vs origin/main unchanged: build 0/0, lint 1/1, audit 2/2. Lock moved 7 packages (3 direct + 4 @ai-sdk transitives), all past the 14-day cooldown. bun test 71 pass, typecheck clean.
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…disproved First end-to-end run of this skill on real PRs (#221 bun, #222 uv) turned up four things the branch had wrong. - The uv 'tests' metric ran 'pytest -q' on top of pyproject's addopts '-q'. The resulting -qq suppresses the 'N failed ... in Xs' summary the pattern parses, so a failing suite scored UNMEASURABLE instead of a count. Verified with an injected failing test, on a workstation with Postgres: 245 passed, 1 failed detected only without the extra -q. - references/uv.md led with 'uv add' and listed lock-only last. With >= floors -- what this repo and most projects declare -- it is the other way round: every ordinary bump is lock-only, and 'uv add X==b' rewrites the floor into an exact pin. All four packages of the uv batch were lock-only. - 'lock delta should equal the packages you bumped' misfires on siblings released in lockstep: ai 7.0.52 -> 7.0.62 legitimately moved 7 entries, four of them @ai-sdk internals. Account for the extras and cooldown-check them rather than resetting on the count. - Superseded bot PRs were only addressed at merge time. They now get a comment when the grouped PR opens, so the queue is not re-worked in between. Also refreshes the recorded baselines: main is now bun 0/1/2 and uv 0/76/245, and adds the stale-branch failure mode -- a branch behind main reads as a regression, and a three-dot diff hides why.
|
CI note: |
1 participant
Summary
Batches three low-risk frontend dependabot PRs into one reviewable change:
#208, #214, #205. Grouped and verified with the
grouped-dependency-upgradesskill from #199 — this is that skill's first live run on the JS side.
ai@ai-sdk/react@types/reactSupersedes #208, #214, #205 — close those when this merges.
Verification
Most checks are not gated in CI on this repo, so the bar is unchanged vs the
base branch, not green. Measured on both sides with
compare_baseline.py --adapter bun:origin/mainerror TS)Additionally:
bun test71 pass / 0 fail,bun run typecheckexits 0.Blast radius.
bun.lockmoved 7 packages: the 3 above plus four@ai-sdkinternals the
aibump pulls with it (gateway4.0.49,mcp2.0.31,provider-utils5.0.27,provider4.0.7). All 7 checked against the npmpublish date and past the 14-day cooldown (oldest 18 days).
package.jsonshows only the three version strings; carets restored afterbun addpinned them exact, and nothing moved betweendependenciesanddevDependencies.Additional notes
typescript-eslint) andthe linter/build-tool bumps chore(deps-dev): bump eslint from 10.8.0 to 10.8.1 in /frontend #212, chore(deps-dev): bump eslint-plugin-react-refresh from 0.5.3 to 0.5.4 in /frontend #216, chore(deps-dev): bump vite from 8.2.1 to 8.2.2 in /frontend #218 move the yardstick they'd be
measured by, and ci(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.0 #204 (
setup-uv9→10) is a major. They stay as individual PRs.chore/deps-uv-lowPR.