Repository navigation
chore(deps): combine open dependabot updates - #3195
Merged
Merged
Conversation
Bumps the github-actions group with 1 update: [actions/setup-java](https://github.com/actions/setup-java). Updates `actions/setup-java` from 5 to 6 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@v5...v6) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [yargs](https://github.com/yargs/yargs) from 17.7.2 to 18.1.0. - [Release notes](https://github.com/yargs/yargs/releases) - [Changelog](https://github.com/yargs/yargs/blob/main/CHANGELOG.md) - [Commits](yargs/yargs@v17.7.2...v18.1.0) --- updated-dependencies: - dependency-name: yargs dependency-version: 18.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [cypress-visual-regression](https://github.com/cypress-visual-regression/cypress-visual-regression) from 5.3.0 to 6.0.0. - [Changelog](https://github.com/cypress-visual-regression/cypress-visual-regression/blob/master/CHANGELOG.md) - [Commits](https://github.com/cypress-visual-regression/cypress-visual-regression/commits) --- updated-dependencies: - dependency-name: cypress-visual-regression dependency-version: 6.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@redis/search](https://github.com/redis/node-redis) from 5.0.0 to 6.2.1. - [Release notes](https://github.com/redis/node-redis/releases) - [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md) - [Commits](https://github.com/redis/node-redis/compare/json@5.0.0...json@6.2.1) --- updated-dependencies: - dependency-name: "@redis/search" dependency-version: 6.2.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core) from 1.10.1 to 3.0.1. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/core) --- updated-dependencies: - dependency-name: "@actions/core" dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@types/uuid](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/uuid) from 10.0.0 to 11.0.0. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/uuid) --- updated-dependencies: - dependency-name: "@types/uuid" dependency-version: 11.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [make-dir](https://github.com/sindresorhus/make-dir) from 3.1.0 to 5.1.0. - [Release notes](https://github.com/sindresorhus/make-dir/releases) - [Commits](sindresorhus/make-dir@v3.1.0...v5.1.0) --- updated-dependencies: - dependency-name: make-dir dependency-version: 5.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@napi-rs/cli](https://github.com/napi-rs/napi-rs) from 2.18.4 to 3.8.6. - [Release notes](https://github.com/napi-rs/napi-rs/releases) - [Commits](https://github.com/napi-rs/napi-rs/compare/@napi-rs/cli@2.18.4...@napi-rs/cli@3.8.6) --- updated-dependencies: - dependency-name: "@napi-rs/cli" dependency-version: 3.8.6 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
![prosoponator[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
…th 3 updates Bumps the npm-minor-and-patch group with 3 updates in the / directory: [webpack](https://github.com/webpack/webpack), [mongodb](https://github.com/mongodb/node-mongodb-native) and [ip-address](https://github.com/beaugunderson/ip-address). Updates `webpack` from 5.110.1 to 5.110.2 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.110.1...v5.110.2) Updates `mongodb` from 7.5.0 to 7.6.0 - [Release notes](https://github.com/mongodb/node-mongodb-native/releases) - [Changelog](https://github.com/mongodb/node-mongodb-native/blob/main/HISTORY.md) - [Commits](mongodb/node-mongodb-native@v7.5.0...v7.6.0) Updates `ip-address` from 10.5.0 to 10.7.0 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.5.0...v10.7.0) --- updated-dependencies: - dependency-name: ip-address dependency-version: 10.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: mongodb dependency-version: 7.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: webpack dependency-version: 5.110.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…-actions-31df092e2e' into chore/combine-dependabot
…arch-6.2.1' into chore/combine-dependabot
….1.0' into chore/combine-dependabot
…core-3.0.1' into chore/combine-dependabot
…-5.1.0' into chore/combine-dependabot
…id-11.0.0' into chore/combine-dependabot
…cli-3.8.6' into chore/combine-dependabot
…visual-regression-6.0.0' into chore/combine-dependabot
…r-and-patch-dc3f1a57b1' into chore/combine-dependabot # Conflicts: # package-lock.json # packages/database/package.json
This was referenced Sep 7, 2026
…ajor make-dir 4 removed the default export; packages/database imports the named makeDirectory instead. @redis/search 6.2.1 peer-depends on @redis/client ^6.2.1 while redis 5.0.0 pins the whole @redis/* family at 5.0.0, so the bump resolved a second nested copy and typecheck failed on two incompatible RediSearchSchema types. Reverted to 5.0.0 pending a redis 6 upgrade.
@actions/core 3 is native ESM, so its exports are non-configurable and vi.spyOn fails with "Cannot redefine property". Replace the module with vi.mock and assert through vi.mocked; getInput keeps its real implementation because the defaultDeps tests drive it through INPUT_*.
HughParry
enabled auto-merge (squash)
September 7, 2026 12:12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Combines the open Dependabot PRs into a single branch so they build, review and merge once instead of nine times.
Included
actions/setup-java5 → 6 (github-actions group)yargs17.7.2 → 18.1.0@actions/core1.10.1 → 3.0.1make-dir3.1.0 → 5.1.0@types/uuid10.0.0 → 11.0.0@napi-rs/cli2.18.4 → 3.8.6cypress-visual-regression5.3.0 → 6.0.0mongodb7.5.0 → 7.6.0,ip-address10.5.0 → 10.7.0,webpack5.110.1 → 5.110.2Each source branch is merged in, so the individual Dependabot commits and their changesets are preserved.
Excluded:
@redis/search(#3171)Dropped, and its changeset with it.
@redis/search@6.2.1peer-depends on@redis/client@^6.2.1, butredis@5.0.0pins the whole@redis/*family at 5.0.0. Bumping the standalone package resolved a second nested copy at 6.2.1 alongside the hoisted 5.0.0, andpackages/redis-client/src/redisIndex.ts:62then failed typecheck passing aRediSearchSchemafrom one copy into a method typed by the other:This bump only makes sense as part of a
redis5 → 6 upgrade, which is its own piece of work. Reverted to 5.0.0; the lockfile is back to byte-parity withmainon everything@redis/*.Fixes needed to make the rest pass
Two of the bumps needed a code change, both in this branch:
make-dir(chore(deps): bump make-dir from 3.1.0 to 5.1.0 #3174) — v4 dropped the default export.packages/database/src/index.tsnow imports the namedmakeDirectory. This was breakingtests,cypressandprovider_imageat the setup step withSyntaxError: The requested module 'make-dir' does not provide an export named 'default'.@actions/core(chore(deps): bump @actions/core from 1.10.1 to 3.0.1 #3173) — v3 is native ESM, so its exports are non-configurable andvi.spyOn(core, "setFailed")fails withCannot redefine property.dev/prosoponator-bot/src/tests/main.unit.test.tsnow replaces the module withvi.mock/importOriginal(the idiom already used inpuzzleTasks.unit.test.ts) and asserts throughvi.mocked.getInputkeeps its real implementation because thedefaultDepstests drive it throughINPUT_*. Test-only change —bot.tscalls justgetInputandsetFailed, both unaffected.Lockfile
Resolved in place rather than regenerated, then reconciled with
npm install --package-lock-only. All platforms' optional native deps are intact, including the linux rollup binaries CI needs, and thelibcdiscriminators npm 11.6.2 wanted to strip were kept.Supersedes #3169, #3171, #3172, #3173, #3174, #3176, #3177, #3178 and #3188, all now closed.