Repository navigation
Consolidate green Dependabot updates into one PR #577
Description
Summary
Nine open Dependabot PRs have fully green CI. Merging them one by one costs nine CI cycles and nine rebases of pnpm-lock.yaml, so they should land together as a single PR.
Scope
Apply these updates on top of main in one branch:
| PR | Update |
|---|---|
| #576 | zod ^4.4.3 → ^4.6.6 |
| #575 | DavidAnson/markdownlint-cli2-action v24.1.0 → v25.0.0 (CI workflow) |
| #574 | Docker base image node:24.21.0-bookworm-slim → node:24.22.2-bookworm-slim (with digest) |
| #572 | sanitize-html ^2.17.7 → ^2.18.1 |
| #571 | vite ^8.1.5 → ^8.1.6 |
| #566 | dotenv ^17.4.2 → ^18.0.5 (major) |
| #565 | @next/env ^16.2.9 → ^16.3.8 |
| #564 | markdownlint-cli2 ^0.23.1 → ^0.23.3 |
| #562 | next-runtime group: react / react-dom ^19.2.8 → ^19.3.1, @types/react 19.2.18 → 19.3.0, @types/react-dom 19.2.4 → 19.3.0 |
Out of scope: the tooling group update (https://github.com/aicers/github-dashboard/pull/563/files), whose check job fails. It stays open and is handled separately.
Approach
- Take the
package.json,Dockerfileand.github/workflows/ci.ymlchanges exactly as the Dependabot PRs have them. - Regenerate
pnpm-lock.yamlwithpnpm installinstead of merging the nine lockfile diffs by hand. - No
CHANGELOG.mdentry: dependency bumps have not been recorded there.
Acceptance criteria
- The consolidated PR contains every update in the table and nothing else.
biome ci --error-on-warnings .,pnpm run typecheck,pnpm lint:mdandpnpm testpass locally.- CI (
check,test,image-build) is green on the PR. - After merge, the nine Dependabot PRs above are closed as superseded.
Test plan
- Run the local quality gates and unit tests listed above.
- Confirm
pnpm-lock.yamlresolves each package to the target version. - Rely on the
image-buildCI job for the Docker base image change, and on thecheckjob for the new markdownlint action.
Activity