chore(deps): bump the patch group across 7 directories with 10 updates

[dependabot]

Bumps the patch group with 10 updates in the / directory:

Package	From	To
@biomejs/biome	2.3.6	2.3.8
@changesets/cli	2.29.7	2.29.8
@vitest/coverage-v8	4.0.10	4.0.14
vitest	4.0.10	4.0.14
@apollo/server	5.1.0	5.2.0
@types/express	5.0.5	5.0.6
cookie	1.0.2	1.1.1
@types/react	19.2.6	19.2.7
graphql-yoga	5.16.2	5.17.1
@typescript-eslint/eslint-plugin	8.47.0	8.48.0

Bumps the patch group with 4 updates in the /packages/apollo directory: @vitest/coverage-v8, vitest, @apollo/server and @types/express.
Bumps the patch group with 4 updates in the /packages/core directory: @vitest/coverage-v8, vitest, @types/express and cookie.
Bumps the patch group with 4 updates in the /packages/express-adapter directory: @vitest/coverage-v8, vitest, @types/express and cookie.
Bumps the patch group with 2 updates in the /packages/fastify-adapter directory: @vitest/coverage-v8 and vitest.
Bumps the patch group with 4 updates in the /packages/react directory: @vitest/coverage-v8, vitest, @types/express and @types/react.
Bumps the patch group with 5 updates in the /packages/yoga directory:

Package	From	To
@vitest/coverage-v8	4.0.10	4.0.14
vitest	4.0.10	4.0.14
@types/express	5.0.5	5.0.6
graphql-yoga	5.16.2	5.17.1
@typescript-eslint/eslint-plugin	8.47.0	8.48.0

Updates @biomejs/biome from 2.3.6 to 2.3.8

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.3.8

2.3.8

Patch Changes

• #8188 4ca088c Thanks @​ematipico! - Fixed #7390, where Biome couldn't apply the correct configuration passed via --config-path.

  If you have multiple root configuration files, running any command with --config-path will now apply the chosen configuration file.

• #8171 79adaea Thanks @​dibashthapa! - Added the new rule noLeakedRender. This rule helps prevent potential leaks when rendering components that use binary expressions or ternaries.

  For example, the following code triggers the rule because the component would render 0:

  const Component = () => {
    const count = 0;
    return <div>{count && <span>Count: {count}</span>}</div>;
  };

• #8116 b537918 Thanks @​Netail! - Added the nursery rule noDuplicatedSpreadProps. Disallow JSX prop spreading the same identifier multiple times.

  Invalid:

  <div {...props} something="else" {...props} />

• #8256 f1e4696 Thanks @​cormacrelf! - Fixed a bug where logs were discarded (the kind from --log-level=info etc.). This is a regression introduced after an internal refactor that wasn't adequately tested.

• #8226 3f19b52 Thanks @​dyc3! - Fixed #8222: The HTML parser, with Vue directives enabled, can now parse v-slot shorthand syntax, e.g. \<template #foo>.

• #8007 182ecdc Thanks @​brandonmcconnell! - Added support for dollar-sign-prefixed filenames in the useFilenamingConvention rule.

  Biome now allows filenames starting with the dollar-sign (e.g. $postId.tsx) by default to support naming conventions used by frameworks such as TanStack Start for file-based-routing.

• #8218 91484d1 Thanks @​hirokiokada77! - Added the noMultiStr rule, which disallows creating multiline strings by escaping newlines.

  Invalid:

  const foo =
    "Line 1\n\
  Line 2";

  Valid:

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.3.8

Patch Changes

• #8188 4ca088c Thanks @​ematipico! - Fixed #7390, where Biome couldn't apply the correct configuration passed via --config-path.

  If you have multiple root configuration files, running any command with --config-path will now apply the chosen configuration file.

• #8171 79adaea Thanks @​dibashthapa! - Added the new rule noLeakedRender. This rule helps prevent potential leaks when rendering components that use binary expressions or ternaries.

  For example, the following code triggers the rule because the component would render 0:

  const Component = () => {
    const count = 0;
    return <div>{count && <span>Count: {count}</span>}</div>;
  };

• #8116 b537918 Thanks @​Netail! - Added the nursery rule noDuplicatedSpreadProps. Disallow JSX prop spreading the same identifier multiple times.

  Invalid:

  <div {...props} something="else" {...props} />

• #8256 f1e4696 Thanks @​cormacrelf! - Fixed a bug where logs were discarded (the kind from --log-level=info etc.). This is a regression introduced after an internal refactor that wasn't adequately tested.

• #8226 3f19b52 Thanks @​dyc3! - Fixed #8222: The HTML parser, with Vue directives enabled, can now parse v-slot shorthand syntax, e.g. \<template #foo>.

• #8007 182ecdc Thanks @​brandonmcconnell! - Added support for dollar-sign-prefixed filenames in the useFilenamingConvention rule.

  Biome now allows filenames starting with the dollar-sign (e.g. $postId.tsx) by default to support naming conventions used by frameworks such as TanStack Start for file-based-routing.

• #8218 91484d1 Thanks @​hirokiokada77! - Added the noMultiStr rule, which disallows creating multiline strings by escaping newlines.

  Invalid:

  const foo =
    "Line 1\n\
  Line 2";

  Valid:

  const foo = "Line 1\nLine 2";
  const bar = `Line 1

... (truncated)

Commits

• 0a6b6fb chore: restore version and yaml how they were
• 5d15cd5 chore: revert version
• 59fa146 ci: release (#8263)
• f7e836f feat(biome_js_analyze): implement noProto rule (#8276)
• b537918 feat(js_biome_analyze): implement noDuplicatedSpreadProps (#8116)
• 91484d1 feat(biome_js_analyze): implement noMultiStr rule (#8218)
• 68c052e feat(biome_js_analyze): implement noEqualsToNull rule (#8214)
• 79adaea feat(lint): added new rule no-leaked-render from eslint-react (#8171)
• cd2edd7 feat(js_analyze): implement noTernary (#8201)
• 8e97b89 ci: release (#8161)
• Additional commits viewable in compare view

Updates @changesets/cli from 2.29.7 to 2.29.8

Commits

• See full diff in compare view

Updates @vitest/coverage-v8 from 4.0.10 to 4.0.14

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.0.14

   🚀 Experimental Features

• browser: Expose utils.configurePrettyDOM  -  by @​sheremet-va in vitest-dev/vitest#9103 (2cc34)
• runner: Add full names to tasks  -  by @​macarie in vitest-dev/vitest#9087 (821aa)
• ui: Add tabbed failure view for toMatchScreenshot with comparison slider  -  by @​macarie in vitest-dev/vitest#8813 (c37c2)

   🐞 Bug Fixes

• Externalize before caching  -  by @​sheremet-va in vitest-dev/vitest#9077 (e1b2e)
• Collect the duration of external imports  -  by @​sheremet-va in vitest-dev/vitest#9097 (3326c)
• Rename collect to import, remove prepare  -  by @​sheremet-va in vitest-dev/vitest#9091 (1256b)
• browser:
  • Unsubscribe onCancel on rpc destroy  -  by @​AriPerkkio in vitest-dev/vitest#9088 (f5b72)
  • Revert the viewport scaling in non-ui mode #9018  -  by @​sheremet-va in vitest-dev/vitest#9072 and vitest-dev/vitest#9018 (64502)
• coverage:
  • Invalidate circular modules correctly on rerun with coverage  -  by @​aicest in vitest-dev/vitest#9096 (6f22c)
• expect:
  • Allow function as standard schema  -  by @​hi-ogawa in vitest-dev/vitest#9099 (ed8a2)
• jsdom:
  • Reuse abort signals if possible  -  by @​sheremet-va in vitest-dev/vitest#9090 (2c468)
• pool:
  • Init VITEST_POOL_ID + VITEST_WORKER_ID before environment setup  -  by @​AriPerkkio in vitest-dev/vitest#9085 (37918)
• web-worker:
  • postMessage to send ports to workers  -  by @​whitphx and @​AriPerkkio in vitest-dev/vitest#9078 (9d176)

   🏎 Performance

• Replace debug with obug  -  by @​sxzz and @​AriPerkkio in vitest-dev/vitest#9057 (acc51)

    View changes on GitHub

v4.0.13

   🐞 Bug Fixes

• types:
  • Don't use type from Vite 7.1  -  by @​sheremet-va in vitest-dev/vitest#9071 (6356b)
  • Don't import node.js dependent types in vitest/browser  -  by @​sheremet-va in vitest-dev/vitest#9068 (332af)

   🏎 Performance

• Avoid fetchModule roundtrip if the module is cached  -  by @​sheremet-va in vitest-dev/vitest#9075 (b27e0)
• experimental: If fsCacheModule is enabled, read from the memory when possible  -  by @​sheremet-va in vitest-dev/vitest#9076 (6b9a1)

    View changes on GitHub

v4.0.12

   🐞 Bug Fixes

• Inherit fsModuleCachePath by default  -  by @​sheremet-va in vitest-dev/vitest#9063 (9a8bc)

... (truncated)

Commits

• 9ca74cf chore: release v4.0.14
• acc5152 perf: replace debug with obug (#9057)
• 73b54ce chore: release v4.0.13
• 5aa84d5 chore: release v4.0.12
• c3befb0 chore: release v4.0.11
• See full diff in compare view

Updates vitest from 4.0.10 to 4.0.14

Release notes

Sourced from vitest's releases.

v4.0.14

   🚀 Experimental Features

• browser: Expose utils.configurePrettyDOM  -  by @​sheremet-va in vitest-dev/vitest#9103 (2cc34)
• runner: Add full names to tasks  -  by @​macarie in vitest-dev/vitest#9087 (821aa)
• ui: Add tabbed failure view for toMatchScreenshot with comparison slider  -  by @​macarie in vitest-dev/vitest#8813 (c37c2)

   🐞 Bug Fixes

• Externalize before caching  -  by @​sheremet-va in vitest-dev/vitest#9077 (e1b2e)
• Collect the duration of external imports  -  by @​sheremet-va in vitest-dev/vitest#9097 (3326c)
• Rename collect to import, remove prepare  -  by @​sheremet-va in vitest-dev/vitest#9091 (1256b)
• browser:
  • Unsubscribe onCancel on rpc destroy  -  by @​AriPerkkio in vitest-dev/vitest#9088 (f5b72)
  • Revert the viewport scaling in non-ui mode #9018  -  by @​sheremet-va in vitest-dev/vitest#9072 and vitest-dev/vitest#9018 (64502)
• coverage:
  • Invalidate circular modules correctly on rerun with coverage  -  by @​aicest in vitest-dev/vitest#9096 (6f22c)
• expect:
  • Allow function as standard schema  -  by @​hi-ogawa in vitest-dev/vitest#9099 (ed8a2)
• jsdom:
  • Reuse abort signals if possible  -  by @​sheremet-va in vitest-dev/vitest#9090 (2c468)
• pool:
  • Init VITEST_POOL_ID + VITEST_WORKER_ID before environment setup  -  by @​AriPerkkio in vitest-dev/vitest#9085 (37918)
• web-worker:
  • postMessage to send ports to workers  -  by @​whitphx and @​AriPerkkio in vitest-dev/vitest#9078 (9d176)

   🏎 Performance

• Replace debug with obug  -  by @​sxzz and @​AriPerkkio in vitest-dev/vitest#9057 (acc51)

    View changes on GitHub

v4.0.13

   🐞 Bug Fixes

• types:
  • Don't use type from Vite 7.1  -  by @​sheremet-va in vitest-dev/vitest#9071 (6356b)
  • Don't import node.js dependent types in vitest/browser  -  by @​sheremet-va in vitest-dev/vitest#9068 (332af)

   🏎 Performance

• Avoid fetchModule roundtrip if the module is cached  -  by @​sheremet-va in vitest-dev/vitest#9075 (b27e0)
• experimental: If fsCacheModule is enabled, read from the memory when possible  -  by @​sheremet-va in vitest-dev/vitest#9076 (6b9a1)

    View changes on GitHub

v4.0.12

   🐞 Bug Fixes

• Inherit fsModuleCachePath by default  -  by @​sheremet-va in vitest-dev/vitest#9063 (9a8bc)

... (truncated)

Commits

• 9ca74cf chore: release v4.0.14
• 821aa20 feat(runner): Add full names to tasks (#9087)
• 1256b5c fix: rename collect to import, remove prepare (#9091)
• 3326cc9 fix: collect the duration of external imports (#9097)
• 379185b fix(pool): init VITEST_POOL_ID + VITEST_WORKER_ID before environment setu...
• 2c468ee fix(jsdom): reuse abort signals if possible (#9090)
• e1b2e08 fix: externalize before caching (#9077)
• acc5152 perf: replace debug with obug (#9057)
• 73b54ce chore: release v4.0.13
• b27e002 perf: avoid fetchModule roundtrip if the module is cached (#9075)
• Additional commits viewable in compare view

Updates @apollo/server from 5.1.0 to 5.2.0

Release notes

Sourced from @​apollo/server's releases.

@​apollo/server-integration-testsuite@​5.2.0

Patch Changes

• Updated dependencies [51acbeb]:
  • @​apollo/server@​5.2.0

@​apollo/server@​5.2.0

Minor Changes

• #8161 51acbeb Thanks @​jerelmiller! - Fix an issue where some bundlers would fail to build because of the dynamic import for the optional peer dependency on @yaacovcr/transform introduced in @apollo/server 5.1.0. To provide support for the legacy incremental format, you must now provide the legacyExperimentalExecuteIncrementally option to the ApolloServer constructor.

  import { legacyExecuteIncrementally } from '@yaacovcr/transform';
  const server = new ApolloServer({
  // ...
  legacyExperimentalExecuteIncrementally: legacyExecuteIncrementally,
  });

  If the legacyExperimentalExecuteIncrementally option is not provided and the client sends an Accept header with a value of multipart/mixed; deferSpec=20220824, an error is returned by the server.

Changelog

Sourced from @​apollo/server's changelog.

5.2.0

Minor Changes

• #8161 51acbeb Thanks @​jerelmiller! - Fix an issue where some bundlers would fail to build because of the dynamic import for the optional peer dependency on @yaacovcr/transform introduced in @apollo/server 5.1.0. To provide support for the legacy incremental format, you must now provide the legacyExperimentalExecuteIncrementally option to the ApolloServer constructor.

  import { legacyExecuteIncrementally } from '@yaacovcr/transform';
  const server = new ApolloServer({
  // ...
  legacyExperimentalExecuteIncrementally: legacyExecuteIncrementally,
  });

  If the legacyExperimentalExecuteIncrementally option is not provided and the client sends an Accept header with a value of multipart/mixed; deferSpec=20220824, an error is returned by the server.

Commits

• 7be3686 Version Packages (#8163)
• 51acbeb Require legacy incremental execute as an ApolloServer option instead of a d...
• See full diff in compare view

Updates @types/express from 5.0.5 to 5.0.6

Commits

• See full diff in compare view

Updates cookie from 1.0.2 to 1.1.1

Release notes

Sourced from cookie's releases.

v1.1.1

Fixed

• Overwrite value in passed in options (#253) c66147c
  • When value was provided in serialize(key, value, { value }) the value in options was used instead of the value passed as an argument

---

jshttp/cookie@v1.1.0...v1.1.1

v1.1.0

Added:

• Add stringifyCookie and parseSetCookie methods (#244, #214)
• Rename existing methods for clarity (old method names remain for backward compatibility)
  • parse → parseCookie
  • serialize → stringifySetCookie
• Add side effects field (#245) 00b0327

---

jshttp/cookie@v1.0.2...v1.1.0

Commits

• 1b89eec 1.1.1
• c66147c Overwrite value in passed in options (#253)
• 09cec9f 1.1.0
• 05ebd34 Add tests for parsing top sites (#249)
• 6214eaf Add benchmark for parseSetCookie (#247)
• 71798d7 Fix skip over of boolean attributes (#248)
• 9e41cf1 build(deps): bump the npm_and_yarn group across 1 directory with 4 updates (#...
• 6fea506 Add parse method for set-cookie (#244)
• 00b0327 Add side effects field (#245)
• 94586de feat: remove dependabot from repo (#242)
• Additional commits viewable in compare view

Updates @types/react from 19.2.6 to 19.2.7

Commits

• See full diff in compare view

Updates graphql-yoga from 5.16.2 to 5.17.1

Changelog

Sourced from graphql-yoga's changelog.

5.17.1

Patch Changes

• #4302 c27f550 Thanks @​beaumontjonathan! - Bump @​whatwg-node/promise-helpers to fix missing export unfakePromise

5.17.0

Minor Changes

• #4288 66c370c Thanks @​EmrysMyrddin! - Add experimental support for coordinate error attribute proposal.

  The coordinate attribute indicates the coordinate in the schema of the resolver which experienced the errors. It allows for an easier error source identification than with the path which can be difficult to walk, or even lead to unsolvable ambiguities when using Union or Interface types.

  Usage

  Since this is experimental, it has to be explicitly enabled by adding the appropriate plugin to the Yoga instance:

  import { createYoga, useErrorCoordinate } from 'graphql-yoga'
  import { schema } from './schema'
  export const yoga = createYoga({
  schema,
  plugins: [useErrorCoordinate()]
  })

  Once enabled, located errors will gain the coordinate attribute:

  const myPlugin = {
    onExecutionResult({ result }) {
      if (result.errors) {
        for (const error of result.errors) {
          console.log('Error at', error.coordinate, ':', error.message)
        }
      }
    }
  }

... (truncated)

Commits

• c801618 chore(release): update monorepo packages versions (#4304)
• c27f550 Bump @​whatwg-node/promise-helpers (#4302)
• e1079f6 chore(release): update monorepo packages versions (#4300)
• 66c370c feat(graphql-yoga): add support for experimental error coordinate (#4288)
• 0517886 chore(deps): update dependency globby to v16 (#4289)
• See full diff in compare view

Updates @typescript-eslint/eslint-plugin from 8.47.0 to 8.48.0

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.48.0

8.48.0 (2025-11-24)

🚀 Features

• eslint-plugin: [no-redundant-type-constituents] use assignability checking for redundancy checks (#10744)
• rule-tester: remove workaround for jest circular structure error (#11772)
• typescript-estree: gate all errors behind allowInvalidAST (#11693)
• typescript-estree: replace fast-glob with tinyglobby (#11740)

🩹 Fixes

• eslint-plugin: [consistent-generic-constructors] ignore when constructor is typed array (#10477)
• scope-manager: change unhelpful aaa error message and change analyze to expects Program (#11747)
• typescript-estree: infers singleRun as true for project service (#11327)
• typescript-estree: disallow binding patterns in parameter properties (#11760)

❤️ Thank You

• Ben McCann @​benmccann
• Dima Barabash @​dbarabashh
• fisker Cheung @​fisker
• James Henry @​JamesHenry
• JamesHenry @​JamesHenry
• Josh Goldberg
• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger
• mdm317 @​gen-ip-1
• Younsang Na @​nayounsang

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.48.0 (2025-11-24)

🚀 Features

• eslint-plugin: [no-redundant-type-constituents] use assignability checking for redundancy checks (#10744)

🩹 Fixes

• typescript-estree: disallow binding patterns in parameter properties (#11760)
• eslint-plugin: [consistent-generic-constructors] ignore when constructor is typed array (#10477)

❤️ Thank You

• Dima Barabash @​dbarabashh
• JamesHenry @​JamesHenry
• Josh Goldberg
• mdm317 @​gen-ip-1

You can read about our versioning strategy and releases on our website.

Commits

• 6fb1551 chore(release): publish 8.48.0
• d26e9de chore(eslint-plugin): correct TODO comment on the wrong line (#11773)
• 5f04910 fix(typescript-estree): disallow binding patterns in parameter properties (#1...
• a4dc42a chore: migrate to nx 22 (#11780)
• 2ffb168 feat(eslint-plugin): [no-redundant-type-constituents] use assignability check...
• 5ea21f1 fix(eslint-plugin): [consistent-generic-constructors] ignore when constructor...
• See full diff in compare view

Updates @apollo/server from 5.1.0 to 5.2.0

Release notes

Sourced from @​apollo/server's releases.

@​apollo/server-integration-testsuite@​5.2.0

Patch Changes

• Updated dependencies [51acbeb]:
  • @​apollo/server@​5.2.0

@​apollo/server@​5.2.0

Minor Changes

• #8161 51acbeb Thanks @​jerelmiller! - Fix an issue where some bundlers would fail to build because of the dynamic import for the optional peer dependency on @yaacovcr/transform introduced in @apollo/server 5.1.0. To provide support for the legacy incremental format, you must now provide the legacyExperimentalExecuteIncrementally option to the ApolloServer constructor.

  import { legacyExecuteIncrementally } from '@yaacovcr/transform';
  const server = new ApolloServer({
  // ...
  legacyExperimentalExecuteIncrementally: legacyExecuteIncrementally,
  });

  If the legacyExperimentalExecuteIncrementally option is not provided and the client sends an Accept header with a value of multipart/mixed; deferSpec=20220824, an error is returned by the server.

Changelog

Sourced from @​apollo/server's changelog.

5.2.0

Minor Changes

• #8161 51acbeb Thanks @​jerelmiller! - Fix an issue where some bundlers would fail to build because of the dynamic import for the optional peer dependency on @yaacovcr/transform introduced in @apollo/server 5.1.0. To provide support for the legacy incremental format, you must now provide the legacyExperimentalExecuteIncrementally option to the ApolloServer constructor.

  import { legacyExecuteIncrementally } from '@yaacovcr/transform';
  const server = new ApolloServer({
  // ...
  legacyExperimentalExecuteIncrementally: legacyExecuteIncrementally,
  });

  If the legacyExperimentalExecuteIncrementally option is not provided and the client sends an Accept header with a value of multipart/mixed; deferSpec=20220824, an error is returned by the server.

Commits

• 7be3686 Version Packages (#8163)
• 51acbeb Require legacy incremental execute as an ApolloServer option instead of a d...
• See full diff in compare view

Updates @types/express from 5.0.5 to 5.0.6

Commits

• See full diff in compare view

Updates @vitest/coverage-v8 from 4.0.10 to 4.0.14

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.0.14

   🚀 Experimental Features

• browser: Expose utils.configurePrettyDOM  -  by @​sheremet-va in vitest-dev/vitest#9103 (2cc34)
• runner: Add full names to tasks  -  by @​macarie in vitest-dev/vitest#9087 (821aa)
• ui: Add tabbed failure view for toMatchScreenshot with comparison slider  -  by @​macarie in vitest-dev/vitest#8813 (c37c2)

   🐞 Bug Fixes

• Externalize before caching  -  by @​sheremet-va in vitest-dev/vitest#9077 (e1b2e)
• Collect the duration of external imports  -  by @​sheremet-va in vitest-dev/vitest#9097 (3326c)
• Rename collect to import, remove prepare  -  by @​sheremet-va in vitest-dev/vitest#9091 (1256b)
• browser:
  • Unsubscribe onCancel on rpc destroy  -  by @​AriPerkkio in vitest-dev/vitest#9088 (f5b72)
  • Revert the viewport scaling in non-ui mode #9018  -  by @​sheremet-va in vitest-dev/vitest#9072 and vitest-dev/vitest#9018 (64502)
• coverage:
  • Invalidate circular modules correctly on rerun with coverage  -  by @​aicest in vitest-dev/vitest#9096 (6f22c)
• expect:
  • Allow function as standard schema  -  by @​hi-ogawa in vitest-dev/vitest#9099 (ed8a2)
• jsdom:
  • Reuse abort signals if possible  -  by @​sheremet-va in vitest-dev/vitest#9090 (2c468)
• pool:
  • Init VITEST_POOL_ID + VITEST_WORKER_ID before environment setup  -  by @​AriPerkkio in vitest-dev/vitest#9085 (37918)
• web-worker:
  • postMessage to send ports to workers  -  by @​whitphx and @​AriPerkkio<...

    Description has been truncated

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7665e80

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.