You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "LiteSun (via GitHub)" <gi...@apache.org> on 2026/10/15 07:21:08 UTC
[PR] chore(deps): consolidate the open Dependabot version updates [apisix-dashboard]
LiteSun opened a new pull request, #3476:
URL: https://github.com/apache/apisix-dashboard/pull/3476
Please answer these questions before submitting a pull request, **or your PR will get closed**.
**Why submit this pull request?**
- [ ] Bugfix
- [ ] New feature provided
- [ ] Improve performance
- [ ] Backport patches
- [x] Dependency maintenance
**What changes will this PR take into?**
Consolidates the ten Dependabot PRs still open after #3475 into one reviewed change. Each dependency is taken to its current release rather than the (now stale) version the bot proposed, and the release notes between the two versions were checked for breaking changes.
npm:
| Package | Before | After | Notes |
| --- | --- | --- | --- |
| @tanstack/react-router | ^1.168.3 | ^1.170.44 | supersedes #3401; the two minor bumps (1.169 `params.parse` may return `false`, 1.170 "clean minor bump") add nothing we rely on |
| @tanstack/router-plugin | ^1.167.4 | ^1.168.46 | supersedes #3403; moves to chokidar 5 and drops its @babel/* and recast dependencies |
| @tanstack/react-router-devtools | ^1.166.11 | ^1.167.2 | kept in step with the router |
| monaco-editor | ^0.52.2 | ^0.57.0 | supersedes #3402; see the code changes below |
| jiti | ^2.4.2 | ^2.7.0 | supersedes #3400 |
| dayjs | ^1.11.20 | ^1.11.23 | supersedes #3399; 1.11.22/23 are timezone-plugin fixes |
| dompurify (override) | 3.4.15 | >=3.4.16 | new; monaco-editor pins 3.4.15, which has two low-severity advisories |
GitHub Actions:
| Action | Before | After | Notes |
| --- | --- | --- | --- |
| actions/checkout | v6 | v7 | supersedes #3407; v7 only blocks fork checkouts on `pull_request_target` / `workflow_run`, which none of our workflows use |
| actions/setup-node | v6 | v7 | supersedes #3430; ESM migration, no input changes |
| actions/github-script | v6 | v9 | supersedes #3375; v9 drops `require('@actions/github')` and injects `getOctokit`, neither of which the e2e label script uses |
| apache/skywalking-eyes/header | commit ab3d1fe (May) | commit a196742 `# v0.9.0` | supersedes #3425 and #3406 (both bump the same line to different main commits); pinned to the v0.9.0 release with a version comment, the same style as the pnpm/action-setup pin |
Code changes the bumps required:
- monaco-editor 0.56 reorganised its ESM entry points: `exports` now maps `./*` to `./esm/vs/*.js`, so the `monaco-editor/esm/vs/...` deep imports in `src/utils/monaco.ts` stopped resolving (and `editor.all.js` no longer exists). The file now imports the public `monaco-editor` entry plus the `editor/editor.worker` and `languages/features/json/json.worker` workers. 0.55 moved the JSON language namespace to the top level, so `FormItemEditor` reads `monaco.json.jsonDefaults` instead of `monaco.languages.json.jsonDefaults`.
- TanStack Router now types `ErrorComponentProps.error` as `unknown`; `PageError` narrows it before reading `.message`.
- `src/routeTree.gen.ts` was regenerated by the new router-plugin. The generator now orders routes deterministically, so the diff is a pure reorder (358 lines moved, nothing added or removed).
Things to be aware of:
- The `monaco-editor-vendor` chunk grows from 3.3 MB to 4.1 MB (gzip 846 kB → 1.07 MB). The `manualChunks` entry names the whole `monaco-editor` package, so the chunk has always bundled every language and feature; the 0.57 entry simply bundles more (LSP client, new features). Switching to the modular `monaco-editor/editor` + `features/register.all` + `languages/features/json/register` entry points and a function-form `manualChunks` would shrink it well below the old size. Left as a follow-up to keep this PR to the dependency bumps.
- `pnpm audit` is down to the single `braces` finding, now reachable only through lint-staged → micromatch (chokidar 5 dropped the other path). braces has no fixed release.
**Related issues**
Supersedes #3401, #3403, #3402, #3400, #3399, #3407, #3430, #3375, #3425 and #3406.
**Checklist:**
- [x] Did you explain what problem does this PR solve? Or what new features have been added?
- [ ] Have you added corresponding test cases? (dependency bumps; covered by the existing unit and e2e suites)
- [ ] Have you modified the corresponding document? (no documentation impact)
- [x] Is this PR backward compatible? If it is not backward compatible, please discuss on the mailing list first
Verification (pnpm 10.34.4):
- `pnpm install --frozen-lockfile`, `pnpm lint`, `pnpm exec tsc -b`, `pnpm test` (163 tests) and `vite build` all pass
- The Playwright e2e suite is left to CI on this PR
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore(deps): consolidate the open Dependabot version updates [apisix-dashboard]
Posted by "LiteSun (via GitHub)" <gi...@apache.org>.
LiteSun commented on PR #3476:
URL: https://github.com/apache/apisix-dashboard/pull/3476#issuecomment-6187469044
Local Playwright run against the e2e docker-compose stack, single worker like CI: 240 of 243 tests passed. Two of the three failures (`stream_routes.crud-required-fields`, `upstreams.crud-all-fields`) passed on an isolated rerun, so they were timing flakes (local runs have `retries: 0`). The third, `stream_routes.show-disabled-error`, restarts the compose project named `server` to toggle `proxy_mode`; my stack ran under a different project name, so the toggle never applied. The monaco-specific test (`edge/plugins.invalid-json-monaco`) passed. CI e2e is green as well.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore(deps): consolidate the open Dependabot version updates [apisix-dashboard]
Posted by "LiteSun (via GitHub)" <gi...@apache.org>.
LiteSun merged PR #3476:
URL: https://github.com/apache/apisix-dashboard/pull/3476
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org