chore(deps-dev): sweep verified dev-tooling upgrades (supersedes #116-#128)#129
Merged
Conversation
Consolidates the Dependabot backlog (PRs #116-#128) into one reviewed change. Every dep here is dev/example tooling — the published library has zero runtime deps, so consumers are unaffected. Each bump was verified independently in an isolated worktree (build/test/docs/example builds), then re-verified together; root + docs both audit to 0 vulnerabilities. Bumped: - @web/test-runner ^0.18.0 -> ^0.20.2 (root) - globals ^16.5.0 -> ^17.6.0 (root) - @commitlint/cli + config-conventional ^20.5.0 -> ^21.0.2 (root) - realfavicon ^0.5.0 -> ^0.8.3 (docs; full docs build incl. favicon gen verified) - react + react-dom ^18.3.1 -> ^19.2.7, @types to ^19 (examples 04/05/06, bumped together to avoid a react/react-dom major skew) - vue-tsc ^2.2.12 -> ^3.3.4 (examples 07/08/09) Deliberately deferred (separate, considered migrations): - typescript 6.0: brand-new major, forces a tsc --ignoreConfig build-script workaround, no consumer benefit, and our own dependabot cooldown argues against adopting day-old majors. Revisit when the toolchain confirms support. - mocha 11: pulls a vulnerable diff (low) whose patched version is outside mocha's range; mocha isn't the actual test runner (web-test-runner is), so the major buys nothing while reintroducing an alert. Kept on 10. - husky 9: changes hook format; needs a deliberate migration, can't be verified by lint/build/test. (Dependabot PR #117 was mislabeled — its branch contained no husky change.)
This was referenced Jun 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Consolidates the Dependabot backlog (#116–#128) into one reviewed change. Every dependency here is dev/example tooling — the published library has zero runtime deps, so consumers are unaffected.
How it was verified
Each bump was first verified independently in an isolated git worktree (a 13-agent parallel matrix) running the gate that matters for its scope — including the docs build (realfavicon/vitepress) and example builds, which normal PR CI skips. Then the whole set was re-verified together.
Final gate (combined tree): lint 0 errors · library build ✓ · 251 tests pass · docs typecheck+build ✓ · all 6 framework-bumped examples build ✓ · root + docs
npm audit→ 0 vulnerabilities.Bumped
Deliberately deferred (each warrants its own migration)
tsc --ignoreConfigbuild-script workaround; zero consumer benefit; contradicts our 7-day Dependabot cooldown. Revisit when typescript-eslint/vue-tsc/typedoc confirm support.diff(low) whose fix is outside mocha's range; mocha isn't the real test runner (web-test-runner is), so the major reintroduces an alert for no gain. Kept on 10.Notes
muggle-string; a full clean resolves it —npm cion fresh CI checkout is clean).chore(deps-dev)).