Repository navigation
chore(deps): bump lucide-react from 1.29.0 to 1.31.0 - #4959
Merged
github-actions[bot] merged 1 commit intoAug 17, 2026
Merged
Conversation
dependabot
Bot
added
automated
Bumps [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) from 1.29.0 to 1.31.0. - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.31.0/packages/lucide-react) --- updated-dependencies: - dependency-name: lucide-react dependency-version: 1.31.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/lucide-react-1.31.0
branch
from
August 17, 2026 08:13
b074f17 to
31745d8
Compare
github-actions
Bot
added
package: components
plugin
plugin: charts
plugin: kanban
apps
labels
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
✅ Console Performance Budget
📦 Bundle Size Report
Size Limits
|
This was referenced Aug 17, 2026
yinlianghui
pushed a commit
that referenced
this pull request
Aug 17, 2026
自审补一处:`GATE_TIMEOUT_SECONDS` 走 `Number()`,拼错(如 `40 minutes`)得到 `NaN`,而 `elapsedMs >= NaN` 恒假 —— deadline 事实上被关掉,门会一直轮询到 runner 按 `timeout-minutes: 50` 杀掉 job。方向仍是 fail-closed(不合并),但白烧 50 分钟 runner,且报成「超时」而不是它真正的身份「配置写错」。改为 `readDuration()` 校验:非有限值或非正数立即抛出。 顺带:`main()` 补显式 JSDoc 参数类型 —— 在 `strict` 下,JS 解构参数中没有默认值的 绑定会从推断签名里消失,于是注入用的 `api` 在调用点变成类型错误(`tsconfig.scripts.json` 会编译这些 pin 测试)。 `#4959` 快照那条断言把「合并瞬间仍在飞行」的数量钉成精确 9 条(8 条必需 + optional 的 Bundle Analysis),fixture 改动无法悄悄削弱这个案例。 Co-authored-by: Claude <noreply@anthropic.com>
akarma-synetal
pushed a commit
to akarma-synetal/objectui
that referenced
this pull request
Aug 23, 2026
…bjectstack-ai#4987) * ci(dependabot): 合并前显式等待完整检查集,停用无条件 auto-merge (objectstack-ai#4973) `dependabot-auto-merge.yml` 对每个 patch/minor bump 无条件执行 `gh pr merge --auto --squash`。`--auto` 在「GitHub 认为可合」的那一刻落地,也就是 **分支保护必需集**被满足的那一刻 —— 而它与「本仓实际跑的检查」是两个不同的集合。 2026-08-17 这个差值把一个红的提交送上了 `main`:objectstack-ai#4959 在 08:13:36Z 合入,此时它 19 条 check 里有 9 条仍在飞行,shard 3/4 与 shard 1/4 分别在 5m25s、8m20s 后报 `failure`。4 分片 test 矩阵按设计就是全仓最慢的 job(它存在的理由正是压掉约 9 分钟 墙钟),所以它是 `--auto` 系统性跑过去的那一条;`main` 变红阻断了所有并行 agent, 直到 objectstack-ai#4968 修回,七天内第二次(objectstack-ai#4098)。这条通道与被 bump 的包无关:任何落在慢 job 上的红都能骑它进来,即 objectstack-ai#3523 / objectstack-ai#3243 的同一形状。 现在等待是显式的,并且由本 workflow 自己承担:`scripts/dependabot-merge-gate.mjs` 对该 PR 的 head SHA 轮询 Checks API 给出裁决,approve 与 enqueue 两个副作用都挂在 `gate == 'green'` 之后,合并再用 `--match-head-commit` 钉到被裁决的那个 SHA。必需 上下文缺失、到点仍未决、或结论非 `success`,都不算绿:不合并、job 变红、并在 PR 上 留下说明是谁拒绝的评论。semver 策略(patch/minor 自动、major 仅评论)未改;合并动作 仍是 `--auto`,因为强制合并队列会用 405 拒绝直接合并。 `scripts/__tests__/dependabot-merge-gate.test.ts` 回放 objectstack-ai#4959 实测的 check-run 时间线, 把反事实钉成断言:08:13:36Z 判 `pending`(不合并)、shard 3/4 一报到即判 `red`;并断言 三个声明桶恰好划分 `pull_request` 类 workflow 实际产出的 check 名集合 —— 改名或新增 job 会让测试红,而不是悄悄从等待集里掉出去。 未处理(属仓库设置面,仓内既读不到也改不了):分支保护 / 合并队列必需集本身。它可证 不含 4 个 shard —— 合并发生时四片全部 `in_progress`。 Co-authored-by: Claude <noreply@anthropic.com> * ci(dependabot): 门的配置错误改为立刻抛出,而不是把 deadline 关掉 (objectstack-ai#4973) 自审补一处:`GATE_TIMEOUT_SECONDS` 走 `Number()`,拼错(如 `40 minutes`)得到 `NaN`,而 `elapsedMs >= NaN` 恒假 —— deadline 事实上被关掉,门会一直轮询到 runner 按 `timeout-minutes: 50` 杀掉 job。方向仍是 fail-closed(不合并),但白烧 50 分钟 runner,且报成「超时」而不是它真正的身份「配置写错」。改为 `readDuration()` 校验:非有限值或非正数立即抛出。 顺带:`main()` 补显式 JSDoc 参数类型 —— 在 `strict` 下,JS 解构参数中没有默认值的 绑定会从推断签名里消失,于是注入用的 `api` 在调用点变成类型错误(`tsconfig.scripts.json` 会编译这些 pin 测试)。 `objectstack-ai#4959` 快照那条断言把「合并瞬间仍在飞行」的数量钉成精确 9 条(8 条必需 + optional 的 Bundle Analysis),fixture 改动无法悄悄削弱这个案例。 Co-authored-by: Claude <noreply@anthropic.com> * ci(dependabot): 写明门的边界是 check run 而非 commit status (objectstack-ai#4973) 本 PR 自己的 CI 上发现:本仓 SHA 上还挂着一条**第三方 commit status**(`Vercel`, PR 上多为 success / "Canceled by Ignored Build Step")。门读的是 check run,不读 commit status —— 也就是说一条红的 Vercel status 不会拦住 dependabot 合并。 这是**声明边界**,不是漏洞,也不是回归(被替换掉的无条件 `--auto` 什么都不等)。 故意留在门外:要求一个第三方预览部署,等于让一次与本仓无关的服务故障阻断所有依赖 升级,这笔取舍该由维护者决定而非热修顺手做。写进文件头,并加一条断言钉住这段说明, 免得下一个读者只能从「调用了哪个 endpoint」去反推覆盖范围。 Co-authored-by: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
This was referenced Sep 16, 2026
akarma-synetal
pushed a commit
to akarma-synetal/objectui
that referenced
this pull request
Sep 28, 2026
… -> 8, dist pins get their own job (objectstack-ai#9584) Fixes objectstack-ai#9499 Scope is the director-seat ruling (comment `5682566291`, batch objectstack-ai#135 item 1, letter **C**), not the card body, which predates it. All three changes land in one PR. ## What changed | | | |---|---| | `test-aggregate` (`name: Test`) | New. `needs: [test, test-dist-pins]`, `if: always() && github.event_name != 'push'`. The single required test context. | | `test` | Matrix 4 → 8, `pnpm test --shard=N/8`. `timeout-minutes: 20` **unchanged**; no test skipped, disabled or quarantined; the relevance gate **not** widened. | | `test-dist-pins` (`name: Test (dist pins)`) | New. The shard-1-only `Run built-artifact pins (dist project)` step, lifted out of the matrix, carrying the `test` job's relevance gate **verbatim**. | ## ⭐ The acceptance: a shard forced to `skipped` turns the aggregator red — measured, not argued `needs.test.result` alone is a phantom gate, and the measurement says so in two ways. Both readings are from a real Actions run on branch `claude/issue-9499-proto` (workflow `PROTO 9499`), which stands in for the shard matrix with trivial jobs so the mechanism is the only thing under test. Run [`35045618251`](https://github.com/objectstack-ai/objectui/actions/runs/35045618251), attempt 1. Read back with `GET /actions/runs/{id}/attempts/1/jobs` and `GET /check-runs/{id}/annotations` — raw job logs are served from a blob host this agent's egress is denied, so the proto emits its readings as annotations, which the REST API does serve. | job | conclusion | |---|---| | `Test (shard 1/4)`, `(2/4)`, `(4/4)` | `success` | | `Test (shard 3/4)` — **forced to skip** with `if: false` | `skipped` | | `PROTO allskip (…)` — a 2-leg matrix whose whole job carries `if: false` | `skipped` | | ⛔ `PROTO naive aggregator` — `needs: [test, test-shard-3]`, **no** `always()` | **`skipped`** | | ⭐ `Test` — the real `scripts/check-test-shard-results.mjs` | **`failure`** | **The gate's own annotation on that failure**, verbatim: > `Test` :: 1 test shard(s) did not report success: Test (shard 3/4) (skipped). ⛔ 'skipped' is not a pass here -- that is the whole reason this gate reads each shard instead of the matrix rollup (objectui#9499). > :: Process completed with exit code 3. **The rollup, on the same run**, verbatim: > `ROLLUP` :: needs.test.result=success (3-leg matrix, every leg success) | needs.test-shard-3.result=skipped (one job, if: false) | needs.allskip.result=skipped (2-leg matrix, whole job if: false) > `ROLLUP SEEN BY THE GATE` :: needs.test.result=success ⇒ two distinct phantom shapes, both measured on the same run: 1. **`needs.test.result` reads `success`** on a run where a job named `Test (shard 3/4)` was `skipped`. An aggregator that trusted the shard matrix's rollup would have been green there. The gate that reads each shard's own conclusion is red. 2. ⭐ **A `needs:`-without-`always()` aggregator is itself `skipped`** — and a skipped *required* context counts as **success** in branch protection, so that aggregator does not merely mis-report, it vanishes. `test-aggregate` carries `if: always()` for exactly this.⚠️ One shape could **not** be produced and is reported as such rather than asserted: GitHub does not expose the `matrix` context to a job-level `if:`, so a single leg cannot be skipped while its siblings succeed. The forced-skipped shard above is therefore its own job under the shard's name — which is what the gate looks at anyway, since it reads job names and conclusions, not matrix membership. The reachable shapes are the three the gate covers: the whole matrix skipped, a leg missing from the matrix, and a leg failed/cancelled/timed-out. ## How the gate works `scripts/check-test-shard-results.mjs` reads **this run's own job list** from `GET /actions/runs/{id}/attempts/{n}/jobs` (`actions: read`, nothing written) and asserts each shard **by name and by its own conclusion**. `skipped` is not a pass. It fails closed — an unreadable answer is exit 2 and a red context — and it refuses any verdict over a job list that does not contain its own job, because that endpoint answers `200` with an empty list for a run id that does not exist, which would otherwise make "no shards found" and "every shard was removed" the same reading. The dist-pin job is asserted straight from `needs.test-dist-pins.result`: a non-matrix job's result is its own conclusion and `skipped` is visible in it, so no API read says anything more. The shard **count** is the one thing the script does not derive. `scripts/__tests__/check-test-shard-results.test.ts` pins the `--shards` argument written in `ci.yml` against `ci.yml`'s own `shard: [...]` matrix, and pins the shard-name spelling against the workflow through the same parser `dependabot-merge-gate.test.ts` uses. Drift is red, locally and loudly — which is the difference from the repository-settings surface the count used to be welded to. ## Why the ruleset rename was the blocker Naming the legs made the shard count a member of GitHub ruleset `11776024`: 4 → 8 renames four live required contexts at once, and between the rename and the settings edit every pull request blocks forever on a check that can no longer report while every queue build burns the ruleset's 60-minute status-check timeout. ⛔ **This PR is not mergeable on its own** — the ruling sequences three steps around it (remove the four `Test (shard n/4)` contexts, merge, add `Test`), and that sequencing is the lane seat's and the maintainer's, not this PR's. Two consequences recorded rather than left to be discovered: - `WATCHED_CONTEXTS` in `scripts/check-required-check-set.mjs` now names the set the ruling installs. Between this merge and the third step the live answer is the old one, so the patrol reports **`drifted` — exit 0, printed in the run summary, never red**. That is objectui#9422's two-tier split doing exactly what it was built for. A new test pins that reading against the committed 2026-09-14 live fixture, naming both halves (`Test` missing, the four shard names unexpected). - `REQUIRED_CONTEXTS` names `Test` instead of the four shards; the eight shards and `Test (dist pins)` move to `NOT_A_GATE` with the reason. They are blocking legs — the difference is that one context reports their verdict. ## The objectstack-ai#4959 counterfactual, re-read `dependabot-merge-gate.test.ts` carries a frozen verbatim record of the 2026-08-17 incident. It is not edited. What changed is what today's required set makes of it: the four shard names moved from `pending` to one `missing` name, and the case now asserts that too, so the drop from nine pending contexts to five cannot stand for a weakened case.⚠️ That file used to end a case with *"a gate that waited for `Test` as one name, or for whichever shard reported first, would have merged this pull request"*. That warning is about a single check **produced by** a shard, which reports while its siblings still run. `test-aggregate` has a `needs:` edge to every leg, so it cannot report before the last of them, and it is red unless each leg's own conclusion is `success`. The replacement case states that difference as behaviour, with a control in the same command: the same snapshot with the same two failed shards is green when the aggregator says `success`, so the red is the aggregator speaking and not a residual shard name. ## Local verification Every exit code below was redirected to a file and captured before any pipe. Worktree `objectui-issue-9499`, tree clean, at `d3e01fe48`. | command | exit | |---|---| | `pnpm exec vitest run --project unit scripts/__tests__` | **0** — 165 files passed, 2 skipped; 4798 tests passed, 2 skipped | | `pnpm type-check:scripts` | 0 | | `pnpm check:control-bytes` | 0 — 7740 tracked text files scanned | | `pnpm check:required-check-set` | 0 | | `pnpm check:merge-queue-head` | 0 | | `pnpm check:entry-guard` | 0 | | `pnpm check:test-path-roots` | 0 | | `pnpm check:action-ref-convention` | 0 | | `pnpm check:shell-escape-residue` | 0 | | `pnpm check:pre-install-import-graph` | 0 | | `pnpm lint:coverage` | 0 | | `pnpm docs:check-links` | 0 | | `pnpm check:doc-fences` · `check:doc-types` · `check:doc-example-ids` · `check:spec-symbols` · `check:new-line-citations` | 0 | | `pnpm check:governed-queue-guard` | 0 | | `node scripts/check-changeset-presence.mjs` | 0 | | `pnpm check:doc-snippets` | **2 — NOT MEASURED** | **`check:doc-snippets` is exit 2, which its own output calls `PRECONDITION NOT MET (exit 2) — The snippet program was NOT run`, explicitly "not a verdict about any document".** It needs a 34-package build first. Recorded as not measured rather than as a pass or a failure. The bound on what that leaves open: this change adds **zero** code fences to the page (`git diff -- content/docs | grep -c '^+.*```'` → `0`), and `check:doc-fences` is green over it. **changeset — the gate's own verdict line, quoted:** > `✅ No source or published contract of a released package changed in this range, so no changeset is owed.` > `Compared the working tree with f7fcc2c (merge-base with origin/main): 16 file(s) changed, 0 of them published source of a package the release covers, 0 of them a manifest whose published contract moved, 0 under a package changesets ignores, 0 changeset(s) added.` ⛔ No `skip-changeset` label is applied and no empty-frontmatter changeset is written: `grep -rn skip-changeset .github/ scripts/` outside `__tests__` returns zero and `ci-cd-pipeline-doc.test.ts` pins that label as a phantom. **lint, narrowed and declared.** `eslint --no-inline-config` over the **11** changed JS/TS files (count read from `--format json`): exit 0, 0 errors, 0 warnings. Population: the repo-wide `pnpm lint` scan is CI's and is not run here. Invariance: this repo's flat config sets no `parserOptions.project` / `projectService`, so no rule in it is type-aware and nothing in this diff can move the verdict on a file the diff does not touch. ⛔ No build, no `dom` project and no package test run: this diff touches `.github/workflows/**`, `scripts/**` and `content/docs/**` only, and `scripts/` is not a workspace package, so the affected-package closure is empty. Every test that reads any file in this diff lives under `scripts/__tests__`, and all 167 of those files ran. ## Acceptance notes - **Zone 2 assumption 1 — the coverage lane is NOT coupled.** `test-coverage` declares its own `shard: [1, 2, 3, 4]`, its own `--shard=N/4` and its own `blob-N-4.json` file names; nothing is shared with the `test` matrix. The `ci.yml:741` sentence *"sharded the same 4 ways"* was a description, not a coupling, and it is now reworded to say so. **No coverage-lane change is required by this card**, which is the reading objectui#9271 needs. - **Zone 2 assumption 2 — half falsified.** `check:merge-queue-head` pins no check name at all. `check:required-check-set` pins only `Type Check`; the shard names are in the *watched* tier, whose absence is reported and never red — but a separate assertion (*"every pinned and watched name is declared blocking in `REQUIRED_CONTEXTS`"*) does couple them, so the update was in scope after all, for a different reason than the one assumed. - **Zone 2 assumption 4 — falsified.** `content/docs/guide/ci-cd-pipeline.md` is forced, and not by the add-a-workflow rule: `ci-cd-pipeline-doc.test.ts` pins the job table against `ci.yml`'s `jobs:` keys **in both directions**, pins each row's *Appears as* against the job's `name:`, and pins each row's *What it runs* against the job's first-party commands. Two new jobs means two new rows or a red test. - **A matrix leg cannot be skipped while its siblings succeed.** GitHub does not expose the `matrix` context to a job-level `if:`, so the literal "mixed rollup" shape cannot be produced from a matrix. The reachable forms are: the whole matrix skipped, a leg removed from the matrix, and a leg failing or cancelled. The gate covers all three, and the proto run demonstrates the first and third. - noted, not filed: the page's Core CI section stated *"Every job runs in parallel — there are no `needs:` edges between them"*, which `coverage-report` (`needs: test-coverage`, objectui#5403) had already falsified. Corrected here because this PR adds the second such edge and the sentence sits in the paragraph the new rows belong to. Successor: whoever next edits that section — this PR is that editor. - noted, not filed: three workflow comments (`changeset-release.yml`, `check-links.yml`, `labeler.yml`) enumerate the required set as it stood, each under an explicit `Re-measured … at 2026-09-06T17:20Z` dateline. A dated fact cannot drift, so they are left alone. The present-tense claims about the same set — `lint.yml`'s step comment, three `scripts/__tests__` headers and two paragraphs of the page — are corrected here, because this change is what made them false. Successor: none needed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_015h79niBMyoB1xcaQje3uiz --- _Generated by [Claude Code](https://claude.ai/code/session_015h79niBMyoB1xcaQje3uiz)_ --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Steve Jobs <steve@objectstack.ai> Co-authored-by: os-zhuang <jack@objectstack.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps lucide-react from 1.29.0 to 1.31.0.
Release notes
Sourced from lucide-react's releases.
Commits
0f8d48btest(packages): updates unit test snapshots with face-slightly-smiling (#4676)