chore(deps): bump remotion from 4.0.258 to 4.0.410 in /site - #109
Conversation
Bumps [remotion](https://github.com/remotion-dev/remotion) from 4.0.258 to 4.0.410. - [Release notes](https://github.com/remotion-dev/remotion/releases) - [Commits](remotion-dev/remotion@v4.0.258...v4.0.410) --- updated-dependencies: - dependency-name: remotion dependency-version: 4.0.410 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
cnjack
left a comment
cnjack
left a comment
There was a problem hiding this comment.
Review
Overall Risk: Medium — this bump only updates remotion (4.0.258 → 4.0.410) but leaves @remotion/player pinned at 4.0.258.
Finding: Remotion / @remotion/player version skew
Remotion's own docs require remotion and all @remotion/* companion packages to be on the exact same version — mismatches are documented to cause "subtle bugs or even complete breakage" (https://www.remotion.dev/docs/version-mismatch), since <Player> and the composition's remotion runtime communicate through internal state that isn't guaranteed compatible across versions.
Evidence:
site/package.json:@remotion/playerstays at4.0.258whileremotionbumps to4.0.410.site/pnpm-lock.yamlconfirms two distinct resolved copies:remotion@4.0.258(pulled in transitively via@remotion/player@4.0.258) andremotion@4.0.410(the new direct dependency).site/src/components/DemoPlayer.tsxrenders<Player>from@remotion/player, hosting compositions (site/src/remotion/DesktopDemo.tsx,CliDemo.tsx) that importuseCurrentFrame/useVideoConfig/spring/interpolatedirectly from the bumpedremotion. A ~150-patch-version gap between the two copies is enough to plausibly break that communication.
Suggested fix: Bump @remotion/player to match (4.0.410, or whatever release aligns) in this same PR so both resolve to one shared version. Longer term, add a .github/dependabot.yml group rule for the remotion/@remotion/* family so Dependabot bumps them atomically instead of one at a time.
No other issues — the diff is otherwise a clean, minimal lockfile-only change scoped to site/, which doesn't touch the core Go agent.
Generated by Claude Code
Bumps [remotion](https://github.com/remotion-dev/remotion) from 4.0.258 to 4.0.410. - [Release notes](https://github.com/remotion-dev/remotion/releases) - [Commits](remotion-dev/remotion@v4.0.258...v4.0.410) --- updated-dependencies: - dependency-name: remotion dependency-version: 4.0.410 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
1 participant
Bumps remotion from 4.0.258 to 4.0.410.
Release notes
Sourced from remotion's releases.
... (truncated)
Commits
a5650cbv4.0.410c0d9d4bMerge pull request #6372 from tiwariaayu/#6365be94efdUpdate cli-versions.test.tsaae57a531k239dac3Merge pull request #6380 from remotion-dev/fix/render-button-dropdowncee59bbUpdate RenderButton.tsxccffcfaUpdate cli-versions.test.ts8579712Merge remote-tracking branch 'origin/main' into pr/63720b87929alright2aea3a2docs: document mediabunny and zod support in CLI commandsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.