Skip to content

chore(deps): bump the web-dependencies group with 21 updates #320

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump the web-dependencies group with 21 updates #320

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 21 additions & 21 deletions apps/web/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,37 +18,37 @@
"@fontsource-variable/sofia-sans": "5.3.0",
"@fontsource-variable/source-sans-3": "^5.3.0",
"@phosphor-icons/react": "^2.1.10",
"onnxruntime-web": "1.27.0",
"onnxruntime-web": "1.30.0",

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Regenerate the dependency qualification artifacts

Regenerate the dependency inventory and browser-distribution qualification alongside this version bump. The required CI step in .github/workflows/ci.yml:61-82 runs validate_dependency_inventory.py, which derives its expected npm IDs from the updated lockfile, but docs/supply-chain/dependency-inventory.json still records versions such as onnxruntime-web@1.27.0, React 19.2.8, and TypeScript 5.9.3; this produces an npm reconciliation mismatch. The browser receipt and scripts/browser_distribution.py also remain explicitly bound to ONNX 1.27.0 and reject changed manifest/lock inputs, so the commit cannot pass the repository's qualification gates until those artifacts and fixed bindings are updated.

Useful? React with 👍 / 👎.

"openseadragon": "6.1.0",
"polygon-clipping": "0.15.7",
"qrcode.react": "4.2.0",
"rbush": "4.0.1",
"react": "19.2.8",
"react-dom": "19.2.8",
"react-router-dom": "7.18.3",
"read-excel-file": "6.0.1",
"react": "19.3.0",
"react-dom": "19.3.0",
"react-router-dom": "7.18.4",
"read-excel-file": "9.3.10",

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Migrate roster imports to the readSheet API

Update parseRosterFile() before taking this major version. It still imports the package-root default and passes its result directly to rowsToCsv, but the upstream 7.x/8.x migration documentation moves browser single-sheet reads to the named readSheet export from read-excel-file/browser; the v9 default export instead returns an array of { sheet, data } objects. On any .xlsx roster upload, rowsToCsv therefore receives sheet objects and fails when it calls row.map, rather than returning the imported CSV data.

Useful? React with 👍 / 👎.

"tus-js-client": "4.3.1",
"write-excel-file": "2.3.10"
"write-excel-file": "4.1.1"

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Migrate spreadsheet exports to the v4 browser API

Update the three existing export call sites before taking this major version. The roster functions and assessment report still import write-excel-file at the package root, pass fileName in the old options object, and in the report treat the direct return value as a Blob; upstream's v3/v4 migration guide requires the /browser entry point and changes the result to a writer whose .toFile(name) or .toBlob() method must be awaited. As written, roster export clicks no longer trigger a download, and report generation passes a writer object to URL.createObjectURL, so all Excel export paths are broken.

Useful? React with 👍 / 👎.

},
"devDependencies": {
"@axe-core/playwright": "^4.13.0",
"@eslint/js": "^9.39.5",
"@playwright/test": "^1.62.1",
"@eslint/js": "^10.0.1",
"@playwright/test": "^1.63.0",
"@testing-library/jest-dom": "^7.0.1",
"@testing-library/react": "^16.3.3",
"@testing-library/user-event": "^14.6.6",
"@types/node": "^26.4.0",
"@types/react": "^19.2.18",
"@types/react-dom": "^19.2.5",
"@vitejs/plugin-react": "^4.7.0",
"eslint": "^9.39.5",
"eslint-plugin-react-hooks": "^5.2.0",
"eslint-plugin-react-refresh": "^0.5.5",
"globals": "^17.11.0",
"jsdom": "^30.0.1",
"typescript": "^5.9.3",
"typescript-eslint": "^8.69.0",
"vite": "^6.4.3",
"vitest": "^4.1.11"
"@types/node": "^26.6.4",
"@types/react": "^19.3.0",
"@types/react-dom": "^19.3.0",
"@vitejs/plugin-react": "^6.1.2",
"eslint": "^10.12.0",
"eslint-plugin-react-hooks": "^7.1.1",
"eslint-plugin-react-refresh": "^0.5.7",
"globals": "^17.13.0",
"jsdom": "^30.1.2",

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Align jsdom with the pinned Node runtime

Update the workflow Node pins or retain a compatible jsdom release. Every checked GitHub workflow pins Node 24.14.0, while the new jsdom@30.1.2 lock entry explicitly supports only ^22.22.2 || ^24.15.0 || >=26.0.0 (pnpm-lock.yaml:1104-1106). Consequently all jsdom-backed test jobs now install and execute this package on an unsupported runtime, and installations with engine enforcement will reject it outright.

Useful? React with 👍 / 👎.

"typescript": "^7.0.2",

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep TypeScript within typescript-eslint's peer range

Use a TypeScript version supported by the selected lint stack, or upgrade typescript-eslint to a release supporting TypeScript 7. The resolved typescript-eslint@8.71.1 declares a TypeScript peer range of >=4.8.4 <6.1.0 (pnpm-lock.yaml:1509-1516), so resolving it with 7.0.2 leaves the parser used by eslint.config.js for every TypeScript file outside its supported range and makes the CI lint results unreliable.

Useful? React with 👍 / 👎.

"typescript-eslint": "^8.71.1",
"vite": "^8.3.2",
"vitest": "^5.0.3"
}
}
Loading
Loading