upgrade deps v1 - #6396
Conversation
Re-resolves 41 already-in-range dependencies to their newest release that is at least seven days old, matching the dependabot cooldown. No package.json changes: ranges are untouched, only yarn.lock resolutions move. Notable: preact 10.29.2 -> 10.29.7 (26 workspaces), vitest/@vitest/browser 4.1.6 -> 4.1.10, sass 1.89.2 -> 1.101.0, msw 2.10.4 -> 2.15.0, turbo, tailwindcss 4.3.3, vue 3.5.40, svelte-check, tsx, multer (supersedes transloadit#6347). Two transitive resolutions land inside the cooldown window because no in-range alternative exists: postcss 8.5.22 (2.5d) and enhanced-resolve 5.24.3 (4.6d). Both are patch-level build tooling.
Range bumps whose target release is at least seven days old: - playwright 1.60.0 -> 1.61.1 (8 workspaces) - esbuild ^0.25/^0.27 -> ^0.28.1 (supersedes transloadit#6332) - next 16.1.5 -> 16.2.10, react/react-dom 19.1.0 -> 19.2.7 (nextjs example) - companion: helmet 8.3.0, ioredis 5.11.1, morgan 1.11.0 (supersedes transloadit#6375/transloadit#6376), ws 8.21.1 (supersedes transloadit#6350/transloadit#6361), p-map 7.0.5, serialize-javascript 7.0.7, content-disposition 2.0.1, @types/supertest 7.2.1 - adm-zip ^0.6.0 (supersedes transloadit#6378) - @changesets/changelog-github ^0.7.0 - karma-jasmine-html-reporter ~2.2.0 - whatwg-fetch 3.6.2 -> 3.6.20 Left for the next round: @aws-sdk/* (3.1090.0 is eligible but drags in ~30 transitive @aws-sdk/@smithy releases published 3 days ago) and @biomejs/biome (2.5.5 is 3 days old). Verified: yarn build (54/54), yarn typecheck (75/75), yarn check:ci, yarn test (19/19) all pass.
Majors confined to dev tooling, verified to need no source changes: - jasmine-core ~5.1 -> ~6.3, @types/jasmine ~5.1 -> ~6.0 (angular) - zone.js ~0.15 -> ~0.16 (angular) - jsdom ^26 -> ^29 - execa 9.6.1 -> 10.0.0 (companion) - @npmcli/arborist ^9 -> ^10, pacote ^21 -> ^22 (release tooling) - dotenv ^16 -> ^17 (aws-nodejs example) Deliberately excluded after testing: - @types/node 20 -> 26 breaks companion typecheck (Uploader.ts FormData -> FormDataLike cast, TS2352). Blocked on the same formdata-node work as got 14. - body-parser 2.2.2 -> 2.3.0 in companion makes the @uppy/url browser test fail under the full parallel `yarn test` run (the URL plugin stops receiving file metadata). It passes when that package is run alone, so the trigger is load-dependent; reverting to 2.2.2 makes the full run green again, reproduced three times each way. - body-parser ^1 -> ^2 in the express examples, held back with the above. undici 8.8.0 lands 4.2 days inside the cooldown as a transitive of the release tooling; no in-range alternative exists. Verified: yarn build (54/54), yarn typecheck (75/75), yarn check:ci, yarn test (19/19), example-angular build.
🦋 Changeset detectedLatest commit: 5d562dd The changes in this PR will be included in the next version bump. This PR includes changesets to release 2 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
There was a problem hiding this comment.
Pull request overview
This PR consolidates several dependency-upgrade PRs by updating a set of build, test, example-app, and Companion runtime dependencies across the Uppy monorepo, plus a small repo hygiene update to ignore Vitest attachment artifacts.
Changes:
- Bump build/release tooling deps in
packages/uppy(notablyesbuild,adm-zip,@npmcli/arborist,pacote). - Update Playwright across multiple packages and examples, plus other test/dev deps (e.g.
jsdomin@uppy/aws-s3). - Refresh
@uppy/companionruntime/dev dependencies (e.g.ws,morgan,helmet,ioredis,serialize-javascript,execa).
Reviewed changes
Copilot reviewed 16 out of 18 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| packages/uppy/package.json | Updates build/release tooling dependencies used by the uppy package. |
| packages/@uppy/xhr-upload/package.json | Bumps Playwright version for browser testing. |
| packages/@uppy/url/package.json | Bumps Playwright version for browser testing. |
| packages/@uppy/golden-retriever/package.json | Bumps Playwright version for browser testing. |
| packages/@uppy/dashboard/package.json | Bumps Playwright version for browser testing. |
| packages/@uppy/companion/package.json | Updates Companion runtime and dev dependencies, including security-relevant libraries. |
| packages/@uppy/aws-s3/package.json | Updates test/dev dependencies (jsdom, Playwright, whatwg-fetch). |
| packages/@uppy/angular/package.json | Updates Angular wrapper dependencies (Zone.js, Jasmine/Karma ecosystem). |
| package.json | Updates root tooling dependency (@changesets/changelog-github). |
| examples/vue/package.json | Bumps Playwright for the Vue example’s browser testing. |
| examples/sveltekit/package.json | Bumps Playwright for the SvelteKit example’s browser testing. |
| examples/react/package.json | Bumps Playwright for the React example’s browser testing. |
| examples/nextjs/package.json | Updates Next.js + React versions used by the Next.js example. |
| examples/aws-php/package.json | Updates esbuild used by the AWS PHP example tooling. |
| examples/aws-nodejs/package.json | Updates dotenv used by the AWS Node.js example. |
| examples/angular/package.json | Updates Zone.js used by the Angular example. |
| .gitignore | Ignores Vitest-generated attachment artifacts. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5c09ac324b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
examples/angular still depends on @angular/core ^19.2.18, which declares a peer on zone.js ~0.15.0, so the 0.16 bump left it running against an unsupported peer. packages/@uppy/angular is on Angular 21 and keeps ~0.16.2. Adds the missing changeset: @uppy/companion and @uppy/angular both take runtime dependency bumps in this PR and would otherwise never be released.
Supersedes dependabot PRs #6332, #6347, #6350, #6361, #6375, #6376, #6378