Skip to content

Validation only: coordinated dependency updates - #254

Closed
Hazzng wants to merge 32 commits into
mainfrom
chore/dependency-proof-20261014
Closed

Hazzng wants to merge 32 commits into
mainfrom
chore/dependency-proof-20261014

Conversation

@Hazzng

@Hazzng Hazzng commented Oct 14, 2026 •

Copy link
Copy Markdown
Owner

Validation only; do not merge.

This branch contains exactly the dependency code in #251 plus one temporary workflow. It runs pnpm check, pnpm security:audit, and pnpm verify:architecture sequentially on an isolated GitHub-hosted runner because the shared local host has produced timing-sensitive failures under concurrent test load. No assertions, timeouts, or integration gates are relaxed. This PR will be closed after evidence is collected; the temporary workflow will not enter main.


Summary by cubic

Validation-only branch for the coordinated dependency updates from #251; do not merge. It adds one temporary workflow that runs pnpm check, pnpm security:audit, and pnpm verify:architecture sequentially on an isolated GitHub-hosted runner, because the shared local host produces timing-sensitive failures under concurrent test load. This PR will be closed after evidence is collected, and the temporary workflow will not enter main. No assertions, timeouts, or integration gates are relaxed.

Written for commit a56c18e. Summary will update on new commits.

View guided diff Turn on auto-fix

dependabot Bot and others added 30 commits October 13, 2026 23:48
Bumps [ruff](https://github.com/astral-sh/ruff) from 0.15.13 to 0.17.0.
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.13...0.17.0)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@changesets/changelog-github](https://github.com/changesets/changesets/tree/HEAD/packages/changelog-github) from 0.7.0 to 1.0.1.
- [Release notes](https://github.com/changesets/changesets/releases)
- [Changelog](https://github.com/changesets/changesets/blob/main/packages/changelog-github/CHANGELOG.md)
- [Commits](https://github.com/changesets/changesets/commits/@changesets/changelog-github@1.0.1/packages/changelog-github)

---
updated-dependencies:
- dependency-name: "@changesets/changelog-github"
  dependency-version: 1.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@changesets/cli](https://github.com/changesets/changesets/tree/HEAD/packages/cli) from 2.31.0 to 3.0.3.
- [Release notes](https://github.com/changesets/changesets/releases)
- [Changelog](https://github.com/changesets/changesets/blob/main/packages/cli/CHANGELOG.md)
- [Commits](https://github.com/changesets/changesets/commits/@changesets/cli@3.0.3/packages/cli)

---
updated-dependencies:
- dependency-name: "@changesets/cli"
  dependency-version: 3.0.3
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [tsx](https://github.com/privatenumber/tsx) from 4.21.0 to 4.23.15.
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.21.0...v4.23.15)

---
updated-dependencies:
- dependency-name: tsx
  dependency-version: 4.23.15
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [jose](https://github.com/panva/jose) from 6.2.2 to 6.2.12.
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.2...v6.2.12)

---
updated-dependencies:
- dependency-name: jose
  dependency-version: 6.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2 to 3.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@v2...v3)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 4 to 6.
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@v4...v6)

---
updated-dependencies:
- dependency-name: pnpm/action-setup
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5 to 7.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v5...v7)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v7)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
…lidation-20261014

# Conflicts:
#	.github/workflows/ci.yml
#	.github/workflows/security.yml
…lidation-20261014

# Conflicts:
#	package.json
#	pnpm-lock.yaml
@coderabbitai

coderabbitai Bot commented Oct 14, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 4877207b-1ce1-4f0e-9272-971faa396f7d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@Hazzng Hazzng closed this Oct 14, 2026
@Hazzng
Hazzng deleted the chore/dependency-proof-20261014 branch October 14, 2026 01:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant