Repository navigation
chore(deps): batch same-major dependency updates + fix 2 reactivity bugs they exposed - #23
Merged
Merged
Conversation
…ugs they exposed Takes the 8 SAFE (same-major) Dependabot bumps as one verified batch rather than 8 separate CI cycles that would each conflict on lockfiles: hono 4.6.14 -> 4.13.0, wrangler 4.97.0 -> 4.118.0 (all three workers), svelte 5.15.0 -> 5.56.8, svelte-check 4.1.1 -> 4.7.4, cobra 1.8.1 -> 1.10.2 The 9 MAJOR bumps (typescript 5->7, vitest 2->4, @cloudflare/workers-types 4->5, adapter-cloudflare 4->7, vite-plugin-svelte 5->7, and the 3 GitHub Actions v4->v7) are deliberately NOT included. Green CI on a major bump is not the same as safe; they need individual review and each deserves its own revert boundary. The upgraded svelte-check earned its keep immediately by surfacing two GENUINE reactivity bugs in my own code — not lint noise: 1. Seo.svelte computed `canonical` as a plain template literal over the `path` prop, freezing it at first render. Every client-side navigation would have emitted the WRONG canonical URL — actively harmful for the SEO work in #20. 2. drafts/[id] destructured `const draft = data.draft`, so navigating from one draft to another (the component is reused) would keep showing the PREVIOUS draft's title and id. Both now $derived. The version selector was restructured so no prop is read at $state initialisation — seeded by an $effect instead, with an `activeVersion` derived value — rather than silencing a real warning with a comment. Verified live after deploying all three workers: origins 200, /api/me 200, all authed pages 200, each draft page carries its OWN id and a matching canonical URL (proving the fix), upload -> serve raw byte-for-byte MATCH, rendered markdown still has an h1 and zero <input> tags. 60/60 validator corpus, svelte-check 0/0, all typechecks and go vet clean.
This was referenced Aug 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Takes the 8 safe (same-major) Dependabot bumps as one verified batch rather than 8 separate CI cycles that would each conflict on lockfiles.
Majors deliberately excluded
The 9 major bumps (typescript 5→7, vitest 2→4,
@cloudflare/workers-types4→5, adapter-cloudflare 4→7, vite-plugin-svelte 5→7, and 3 GitHub Actions v4→v7) are not in here. Green CI on a major bump is not the same as safe; each needs individual review and its own revert boundary.The upgraded svelte-check earned its keep
It immediately surfaced two genuine reactivity bugs in my own code — not lint noise:
Seo.sveltecomputedcanonicalas a plain template literal over thepathprop, freezing it at first render. Every client-side navigation would have emitted the wrong canonical URL — actively harmful to the SEO work in docs: problem-statement README + SEO for the marketing origin only #20.drafts/[id]destructuredconst draft = data.draft, so navigating between drafts (the component is reused) would keep showing the previous draft title and id.Both now
$derived. The version selector was restructured so no prop is read at$stateinitialisation — seeded by an$effectwith anactiveVersionderived value — rather than silencing a real warning with a comment.How tested
Deployed all three workers, then verified live:
/api/me200, all authed pages 200<h1>and zero<input>tagsgo vetclean