Repository navigation
chore(deps-dev): bump vite from 6.4.3 to 6.4.5 - #244
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
|
This pull request's reviews are posted as pull request reviews: see the review of |
|
npm i https://pkg.pr.new/cloudflare/browser-run/@cloudflare/playwright@cb7762ab47a47652c6e04e150feb85266bc7bb43Published by this workflow run. New pushes and reruns update this comment. |
|
npm i https://pkg.pr.new/cloudflare/browser-run/@cloudflare/playwright-mcp@cb7762ab47a47652c6e04e150feb85266bc7bb43Published by this workflow run. New pushes and reruns update this comment. |
|
npm i https://pkg.pr.new/cloudflare/browser-run/@cloudflare/puppeteer@cb7762ab47a47652c6e04e150feb85266bc7bb43Published by this workflow run. New pushes and reruns update this comment. |
dependabot
Bot
changed the title
39aaed0 to
67560f7
Compare
![clanky-the-clanker[bot]](https://avatars.githubusercontent.com/in/5306670?s=60&v=4){kind=small}
There was a problem hiding this comment.
Superseded by the review of
cb7762ab.
This review, of 67560f77
Findings: 2 warnings (2 are inline comments on the diff)
The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.
🔧 Fix with your agent
Paste the following into your coding agent to investigate and fix these issues.
Fix the following code review issues found in pull request #244.
Before making changes, review each issue and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g., the fix would require disproportionate changes
for minimal ROI, or the finding is factually incorrect), explain why
- If you need to clarify something before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order
## WARNING (2)
### [Code Quality] playwright-mcp-cloudflare's vite range goes from ^7.3.6 to ^6.4.5, a major-version downgrade, not the patch bump the title describes; the published package's `vite build` would run on vite 6.
- **File:** packages/playwright-mcp-cloudflare/package.json:44
### [Code Quality] The root package.json vite range goes from ^8.0.10 to ^6.4.5, a two-major downgrade; the branch name (vite-8.3.3) suggests a stale Dependabot rebase.
- **File:** package.json:35
📋 Code Quality: ⚠️ 2 warnings
Two of the five manifest edits downgrade vite across major versions instead of applying a patch bump.
Recommendation: 📝 Minor Comments
- [WARNING] playwright-mcp-cloudflare's vite range goes from ^7.3.6 to ^6.4.5, a major-version downgrade, not the patch bump the title describes; the published package's
vite buildwould run on vite 6. (packages/playwright-mcp-cloudflare/package.json:44) - [WARNING] The root package.json vite range goes from ^8.0.10 to ^6.4.5, a two-major downgrade; the branch name (vite-8.3.3) suggests a stale Dependabot rebase. (
package.json:35)
View full review
- The browser-test-runtime, playwright-cloudflare and puppeteer-cloudflare manifests change
^6.4.3to^6.4.5, as the title says. package.json:35changes^8.0.10to^6.4.5, which goes down two major versions.packages/playwright-mcp-cloudflare/package.json:44changes^7.3.6to^6.4.5, which goes down one major version. This package'sbuild:patchedrunsnpx vite buildto produce the publishedlib/esmandlib/cjsoutput, so the shipped artifact would be built on a different vite major.packages/playwright-cloudflare/examples/stagehand/package.json:21still declares^7.3.6, so the workspace now mixes vite majors.- Fix: rebase or recreate the Dependabot branch so each manifest keeps its current major. If the downgrade is intended, say so in the description.
✅ All other checks passed
🔒 Security: ✅ LGTM
vite is a dev-only dependency. Version 6.4.5 includes the server.fs query-stripping fix. Moving the root and playwright-mcp-cloudflare manifests off the 8.x and 7.x lines could leave out dev-server fixes made only on those lines. The downgrade is covered under code quality.
📖 AGENTS.md: ✅ LGTM
This dependency change does not call for any change to contributor or agent guidance.
⚡ Performance: ✅ LGTM
This change only touches dev-dependency ranges and has no runtime performance impact.
📝 Documentation: ✅ LGTM
No documentation changes are needed.
Reviewed commit: 67560f77
| "@cloudflare/workers-types": "^5.20260921.1", | ||
| "typescript": "^5.8.2", | ||
| "vite": "^7.3.6", | ||
| "vite": "^6.4.5", |
There was a problem hiding this comment.
playwright-mcp-cloudflare's vite range goes from ^7.3.6 to ^6.4.5, a major-version downgrade, not the patch bump the title describes; the published package's vite build would run on vite 6.
This changes vite from ^7.3.6 to ^6.4.5, which is a major-version downgrade, not a 6.4.3 to 6.4.5 patch bump. build:patched runs npx vite build to produce the published lib/esm and lib/cjs output, so the next @cloudflare/playwright-mcp release would be built with a different vite major. Nobody would have chosen that. Unless the downgrade is intended, keep the 7.x range here.
| "vite": "^6.4.5", | |
| "vite": "^7.3.6", |
| "picomatch": "^4.0.4", | ||
| "pkg-pr-new": "^0.0.67", | ||
| "vite": "^8.0.10", | ||
| "vite": "^6.4.5", |
There was a problem hiding this comment.
The root package.json vite range goes from ^8.0.10 to ^6.4.5, a two-major downgrade; the branch name (vite-8.3.3) suggests a stale Dependabot rebase.
The root vite range drops from ^8.0.10 to ^6.4.5, which goes down two major versions. The branch is named vite-8.3.3, and an earlier version of this pull request bumped this range to ^8.3.3. That points to a Dependabot branch that was resolved against the wrong base. Consider recreating the Dependabot branch so the root keeps its 8.x range, or say in the description why the downgrade is wanted.
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 6.4.3 to 6.4.5. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.5/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.5/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.3.3 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <[email protected]>
67560f7 to
cb7762a
Compare
There was a problem hiding this comment.
build:patched script runs vite build to produce the published package. The title and description describe only a 6.4.3 to 6.4.5 patch bump.
Findings: 2 warnings
The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.
🔧 Fix with your agent
Paste the following into your coding agent to investigate and fix these issues.
Fix the following code review issues found in pull request #244.
Before making changes, review each issue and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g., the fix would require disproportionate changes
for minimal ROI, or the finding is factually incorrect), explain why
- If you need to clarify something before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order
## WARNING (2)
### [Code Quality] playwright-mcp-cloudflare's vite range goes from ^7.3.6 to ^6.4.5, a major-version downgrade, not the patch bump the title describes; the published package's `vite build` (line 18) would run on vite 6.
- **File:** packages/playwright-mcp-cloudflare/package.json:44
### [Code Quality] The root package.json vite range goes from ^8.0.10 to ^6.4.5, a two-major downgrade that the title does not describe; this likely comes from a stale Dependabot rebase.
- **File:** package.json:35
📋 Code Quality: ⚠️ 2 warnings
Two manifests downgrade vite across major versions; the other three get the patch bump the title describes.
Recommendation:
- [WARNING] playwright-mcp-cloudflare's vite range goes from ^7.3.6 to ^6.4.5, a major-version downgrade, not the patch bump the title describes; the published package's
vite build(line 18) would run on vite 6. (packages/playwright-mcp-cloudflare/package.json:44) - [WARNING] The root package.json vite range goes from ^8.0.10 to ^6.4.5, a two-major downgrade that the title does not describe; this likely comes from a stale Dependabot rebase. (
package.json:35)
View full review
packages/browser-test-runtime,packages/playwright-cloudflareandpackages/puppeteer-cloudflaremove from^6.4.3to^6.4.5, as the title says.package.json:35moves from^8.0.10to^6.4.5, down two major versions.packages/playwright-mcp-cloudflare/package.json:44moves from^7.3.6to^6.4.5, down one major version. Line 18 of that file (build:patched) runsnpx vite build, so the published package would be built with vite 6.- The branch name (
vite-8.3.3) suggests Dependabot rebased this branch onto an old base. Recreating or rebasing it should let each manifest keep its current major version. These two downgrades also give up any dev-server security fixes released only on the vite 7.x and 8.x lines.
✅ All other checks passed
🔒 Security: ✅ LGTM
vite is a dev-only dependency, and 6.4.5 includes the server.fs query-stripping fix. The major-version downgrades are covered in the code-quality section.
📖 AGENTS.md: ✅ LGTM
This dependency change does not call for any change to contributor or agent guidance.
⚡ Performance: ✅ LGTM
This change only touches dev-dependency ranges and has no runtime performance impact.
📝 Documentation: ✅ LGTM
No documentation changes are needed.
Reviewed commit: cb7762ab
Bumps vite from 6.4.3 to 6.4.5.
Release notes
Sourced from vite's releases.
Changelog
Sourced from vite's changelog.
Commits
83ab40brelease: v6.4.591e40d7fix: checkserver.fsafter stripping query as well (#22160) (#23855)5f0d9a4release: v6.4.4eec6464fix(server): check resolved ids for transform access (#20410)e570d8dfix(server): store ids tosafeModulePathsrather than URLs (#23656)8afec69fix(deps): update launch-editor to v2.14.2 (#23654)19902cffix(html): filename passed to transformIndexHtml should not include queries (...