chore(deps)(deps): bump recharts from 2.15.4 to 3.10.1 in /frontend/studyhub-app - #446
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
Bumps [recharts](https://github.com/recharts/recharts) from 2.15.4 to 3.10.1. - [Release notes](https://github.com/recharts/recharts/releases) - [Changelog](https://github.com/recharts/recharts/blob/main/CHANGELOG.md) - [Commits](recharts/recharts@v2.15.4...v3.10.1) --- updated-dependencies: - dependency-name: recharts dependency-version: 3.10.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
added
the
dependencies
Deploying studyhub with
|
| Latest commit: |
7ec6c46
|
| Status: | 🚫 Build failed. |
Apexone11
added a commit
that referenced
this pull request
Aug 2, 2026
Clears 3 advisories (2 high) that landed after round 3. **Lockfile-only** — no manifest changes. | Alert | Package | Advisory floor | Now at | |---|---|---|---| | #179, #182 (high) | postcss | 8.5.18 | **8.5.25** (all 3 lockfiles) | | #180 (medium) | tar | 7.5.21 | **7.5.22** (root + frontend) | ## Not included: react-router (deliberate) The 2 remaining high alerts (#176, #177) are `react-router`, and the fix is **8.3.0 — a major bump from 7.18.1**. CLAUDE.md lists React Router among the majors that require an explicit founder approval, so it is held out of this PR. It touches every route in the app and deserves its own PR with a full route smoke pass. Dependabot has it open as #450/#451. Also open and awaiting the same call: #446 recharts 2→3, #447 @vitejs/plugin-react 5→6, #448 @testing-library/jest-dom 6→7, #449 rollup-plugin-visualizer 6→7 — all majors. ## Validation - Backend: lint ✅ · build ✅ · tests ✅ **3541 passed** - Frontend: lint ✅ 0 errors · build ✅ · **906 passed** - Release-log entry added (CI gate) - `playwright-smoke` remains the known-red baseline (red on main since 2026-06-02) 🤖 Generated with [Claude Code](https://claude.com/claude-code) ## Summary by Sourcery Update dependency lockfiles to address recent security advisories for postcss and tar, and document the changes in the release log. Enhancements: - Record security round 4 dependency updates and remaining react-router advisories in the v2.3.0 release log entry. Chores: - Upgrade postcss to 8.5.25 and tar to 7.5.22 across all lockfiles to clear three new security advisories.
Apexone11
added a commit
that referenced
this pull request
Aug 2, 2026
…, jest-dom 7, visualizer 7 (#457) Clears the **last 2 open high-severity alerts** (#176, #177 — react-router). Supersedes Dependabot #446–#451. ## react-router 7.18.1 → 8.3.0 (the breaking one) **v8 removes the `react-router-dom` package entirely.** In v7 everything DOM-specific had already collapsed into `react-router`; `react-router-dom` was kept only as a v6-compat convenience, and v8 drops it. - Swapped all **225 importing files** (src + tests, including `vi.mock`/`vi.importActual` targets) to `react-router`. - Every symbol this app uses is exported from `react-router` in v8: `BrowserRouter`, `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `Navigate`, `useNavigate`, `useLocation`, `useParams`, `useSearchParams`, `useBlocker`. - The app never used `RouterProvider`/`HydratedRouter` (those move to `react-router/dom`), so there are no other import-path changes. **v8 raises its Node floor to 22.22.0**, so: - frontend `engines.node` → `>=22.22.0` - every workflow's `setup-node` → **22** (was 20) - added a root **`.node-version`** so Cloudflare Pages builds on 22 rather than defaulting to an older runtime and tripping the engine check — this was the one silent deploy risk in the upgrade. **Breaking changes that do NOT apply here** (checked against the v8.0.0 changelog): ESM-only publish, middleware always-on + `RouterContextProvider`, `meta` `data`→`loaderData` rename, `hasErrorBoundary` removal, and the `future.v8_*` flag removals all affect data-router/framework mode. This app is declarative `BrowserRouter` with no loaders, actions, or meta. ## Other majors | Package | From → To | |---|---| | recharts | 2.15.4 → **3.10.1** | | @vitejs/plugin-react | 5.1.1 → **6.0.4** | | @testing-library/jest-dom | 6.9.1 → **7.0.0** | | rollup-plugin-visualizer | 6.0.11 → **7.0.1** | ## Validation - Backend: lint ✅ · build ✅ · tests ✅ **3541 passed** - Frontend: lint ✅ **0 errors** · build ✅ (charts + editor chunks build fine on recharts 3 / plugin-react 6) · **906 passed, zero failures** - All three lockfiles regenerated together from a root install; `react-router-dom` is gone from every lockfile and `react-router@8.3.0` is the only entry - Release-log entry added (CI gate) After this merges, **Dependabot alerts should be at 0**. `playwright-smoke` remains the known-red baseline (red on main since 2026-06-02). 🤖 Generated with [Claude Code](https://claude.com/claude-code) ## Summary by Sourcery Upgrade routing and frontend tooling dependencies and align Node version requirements across the app and CI. Bug Fixes: - Resolve outstanding high-severity dependency alerts related to react-router. Enhancements: - Migrate all frontend and test imports from react-router-dom to react-router v8. - Update recharts, @vitejs/plugin-react, @testing-library/jest-dom, and rollup-plugin-visualizer to their latest major versions. Build: - Raise frontend Node engine requirement to >=22.22.0 and add a root .node-version file for consistent runtime selection. CI: - Switch all GitHub Actions workflows to use Node 22 for backend, frontend, mobile, nightly, and integrity jobs. Documentation: - Add release-log entry documenting the security-focused dependency upgrades and Node version change. Tests: - Adjust routing-related tests and mocks to target react-router instead of react-router-dom while keeping coverage intact. Chores: - Regenerate root and workspace lockfiles to reflect the new dependency versions and removal of react-router-dom.
Contributor
Author
|
Looks like recharts is up-to-date now, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/frontend/studyhub-app/recharts-3.10.1
branch
August 2, 2026 04:27
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps recharts from 2.15.4 to 3.10.1.
Release notes
Sourced from recharts's releases.
... (truncated)
Commits
ffb91873.10.1411b6f2fix(bar): keep barGap correct when maxBarSize clamps the bar width (#2774) (#...58c321bchore(deps-dev): bump postcss from 8.5.10 to 8.5.22 (#7581)f08972bchore(deps-dev): bump the storybook group with 8 updates (#7578)89599d0chore(deps-dev): bump chromatic from 11.29.0 to 18.1.0 (#7579)3da7d87chore(deps-dev): bump typescript-eslint from 8.64.0 to 8.65.0 in the typescri...9764273chore(deps-dev): bump marked from 18.0.5 to 18.0.7 (#7577)a5d7737fix(tooltip): fall back to index-based search when label-based search returns...497e8dfchore(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 (#7576)0776eb0chore(deps): bump immer from 11.1.9 to 11.1.15 (#7575)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for recharts since your current version.
Install script changes
This version adds
preparescript that runs during installation. Review the package contents before updating.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)