Repository navigation
deps(tests): bump @vitest/coverage-v8 from 4.1.7 to 4.1.8 in /tests/e2e/sdk in the e2e-deps group across 1 directory - #211
Closed
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Free Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
github-project-automation
Bot
moved this from Backlog
to In progress
in WaveHouse Task Board
Member
|
@dependabot rebase (branch predates the #190 root-lockfile consolidation — CI fails with |
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/tests/e2e/sdk/e2e-deps-23042886c7
branch
from
June 5, 2026 21:30
c299c58 to
9ee174f
Compare
github-project-automation
Bot
moved this from In review
to In progress
in WaveHouse Task Board
30 of 31 tasks
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/tests/e2e/sdk/e2e-deps-23042886c7
branch
from
June 8, 2026 16:12
9ee174f to
ba155cb
Compare
github-project-automation
Bot
moved this from In review
to In progress
in WaveHouse Task Board
Member
|
@dependabot rebase |
Bumps the e2e-deps group with 1 update in the /tests/e2e/sdk directory: [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8). Updates `@vitest/coverage-v8` from 4.1.7 to 4.1.8 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.8/packages/coverage-v8) --- updated-dependencies: - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: e2e-deps ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/tests/e2e/sdk/e2e-deps-23042886c7
branch
from
June 10, 2026 23:34
ba155cb to
85a37da
Compare
EricAndrechek
added a commit
that referenced
this pull request
Jun 11, 2026
## Problem Every Dependabot **npm** PR has been failing CI since the #190 root-lockfile consolidation — e.g. #211 (`@vitest/coverage-v8` in `tests/e2e/sdk`) and #337 (the `docs` group). They fail fast on Lint/Unit/E2E/Coverage and **a rebase never fixes them**. Root cause is the Dependabot config, not the dependencies. The repo is a pnpm workspace with a **single root `pnpm-lock.yaml`**, but `.github/dependabot.yml` pointed its three npm entries at the *member* directories (`directory: /docs`, `/clients/ts`, `/tests/e2e/sdk`). Dependabot only updates a lockfile co-located with the manifest it targets, so it edited the member `package.json` but **left the root lockfile untouched**. CI then runs `pnpm install --frozen-lockfile`, the lockfile's recorded specifier no longer matches `package.json`, and it aborts with `ERR_PNPM_OUTDATED_LOCKFILE`. A rebase only replays the same `package.json`-only change onto fresh `main` — it never regenerates the lockfile, so the mismatch returns every run. (#337, created well after #190, fails identically — confirming it's structural, not a stale branch.) ## Fix Replace the three per-member npm entries with **one entry at the workspace root** (`directory: /`, group `npm-deps`, prefix `deps`). At the root, Dependabot reads `pnpm-workspace.yaml`, walks every member, and updates the single root lockfile inside the PR. As a bonus it now also covers the root `package.json`'s own devDeps (biome, markdownlint, nyc), which the per-member configs never did. **Trade-off:** one combined weekly npm PR with a single `deps:` prefix, instead of three per-area PRs (`docs:` / `deps(sdk):` / `deps(tests):`). This matches the existing grouped `go-deps` / `actions-deps` configs and the team's stated preference for fewer Monday PRs. ## Docs sync - `docs/src/content/docs/development.md` — Dependabot section: five configs → three, plus the root-lockfile rationale. - `SECURITY.md` — supply-chain line: "three npm workspaces" → one root npm config. - `CHANGELOG.md` — `[Unreleased] → Changed` entry. ## Note (out of scope) `pnpm-workspace.yaml` sets `minimumReleaseAge: 10080` (7-day cooldown), which Dependabot doesn't honor. When the new config regenerates lockfiles, a dep released <7 days ago can be held by the cooldown at install time — so a freshly-cut bump may need a few days before it merges cleanly. Pre-existing; the no-auto-merge + admin-review gate covers it. ## Follow-up on the broken PRs Once this merges, the old per-member configs no longer exist, so #211 and #337 should be **closed** (not rebased — rebasing keeps the old member-directory branch and reproduces the failure). The new root config regenerates correct combined PRs on the next Dependabot run. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Member
|
closed by #340 |
auto-merge was automatically disabled
June 11, 2026 15:23
Pull request was closed
github-project-automation
Bot
moved this from In review
to Done
in WaveHouse Task Board
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/tests/e2e/sdk/e2e-deps-23042886c7
branch
June 11, 2026 15:23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the e2e-deps group with 1 update in the /tests/e2e/sdk directory: @vitest/coverage-v8.
Updates
@vitest/coverage-v8from 4.1.7 to 4.1.8Release notes
Sourced from @vitest/coverage-v8's releases.
Commits
e61f2ddchore: release v4.1.8e4067b3fix(browser): disable clientcdpAPI whenallowWrite/allowExec: false[ba...