chore(deps): batch-consolidate patch/minor/security Renovate updates - #3293
Open
ByronDWall wants to merge 15 commits into
Open
chore(deps): batch-consolidate patch/minor/security Renovate updates#3293ByronDWall wants to merge 15 commits into
ByronDWall wants to merge 15 commits into
Conversation
🦋 Changeset detectedLatest commit: 2e3effe The changes in this PR will be included in the next version bump. This PR includes changesets to release 97 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
tylermorrisford
approved these changes
Aug 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Batch-consolidates the currently-open Renovate PRs and the safe (patch/minor/security)
items from the Dependency Dashboard (#1991) into a single branch/PR, per the request.
Genuine major-version jumps are excluded and listed below for visibility; the original
Renovate PRs are left open/untouched.
Important caveat on dashboard data: The live Dependency Dashboard (#1991) body
returned by the GitHub API contains a "Rate-Limited" section with 115 items (not the
~61 assumed going in), and a majority of those items (78 of 115) reference packages
that do not exist anywhere in this repo's
package.json/pnpm-workspace.yamlfiles(e.g.
@flopflip/*,pmmmwh/react-refresh-webpack-plugin,@commercetools/nimbus,@sentry/*,webpack,express,jsdomas a direct dep, etc. — those look likethey belong to a different repo's dependency graph, e.g. merchant-center-application-kit,
based on the Mend portal link embedded in the dashboard body pointing at that repo).
Every dashboard item was checked against this repo's actual
package.jsonfiles beforeany change was made; items not found in this repo were skipped rather than guessed at
(see full breakdown below). Only 5 dashboard items turned out to be real, present, and
non-major for this repo, and 4 of those actually changed a resolvable version.
Separately, a file-integrity issue occurred during this session: partway through,
an external process modified this working tree's
pnpm-workspace.yamlto inject aninvalid
allowBuildsentry (protobufjs: set this to true or false) that is not presentin any commit on
mainor this branch. It reappeared after being removed once. It wasremoved again and is not present in the final pushed state — verified with
git show <rev>:pnpm-workspace.yaml | grep protobufjsreturning nothing on every commitin this branch. No approval was granted for
protobufjs's build script. Flagging thisfor visibility since it's a legitimate security-relevant anomaly independent of the
dependency work itself.
Included (12 dependency-version commits)
From open Renovate PRs (9/9, all previously verified live via
gh pr list):dompurify→ v3.4.12immutable→ v4.3.9postcss→ v8.5.23agilepathway/pull-request-label-checkerdocker tag to14f5f3dchromaui/actiondigest →14cfaef@types/react-dom,react,react-dom— dev/build catalog only, not the public peer range) → v19.2.8@changesets/cli→ v2.31.1@formatjs/cli→ v6.16.16browserslist→ v4.28.7From Dependency Dashboard "Rate-Limited" section (verified present + non-major in this repo):
qspostcssoverrides.postcsscapping actual resolution at 8.5.15; pre-existing, not introduced by this PR, matches upstream #3281's own behavior)formik@commercetools-uikit/pagination→ changeset added@changesets/changelog-githubrepocatalogpnpm installwas run once at the end to regeneratepnpm-lock.yamlfor the wholeworkspace; it completed cleanly with no errors.
Excluded — genuine major version jumps (28 items, dashboard-verified present in repo)
@babel/cli,@babel/core,@babel/eslint-parser,@babel/plugin-*×10,@babel/preset-*×3,@babel/register,@babel/runtime,@babel/runtime-corejs3,babel-loader)(major)@commitlint/cli,@commitlint/config-conventional,husky,lint-staged)(major)@formatjs/cli-lib,@formatjs/icu-messageformat-parser,@formatjs/intl-*×5,react-intl)(major)@jest/types,@types/jest,jest-environment-puppeteer,jest-puppeteer)(major)eslint,eslint-config-prettier,eslint-formatter-pretty,eslint-import-resolver-typescript,eslint-plugin-cypress,eslint-plugin-jest,eslint-plugin-jest-dom,eslint-plugin-n,eslint-plugin-prettier,eslint-plugin-react-hooks)(major)@types/node,actions/setup-node,node)(major)@svgr/babel-preset,@svgr/cli,@svgr/core,@svgr/plugin-jsx,@svgr/plugin-svgo,@svgr/webpack)@types/eslint,@types/express,@types/jscodeshift,@types/jsdom,@types/prettier,@types/svgo,@types/testing-library__jest-dom)(major)@manypkg/find-root@manypkg/get-packages@testing-library/jest-dom@vitejs/plugin-react@vitejs/plugin-react-swcbabel-plugin-formatjscommandercross-envdownshiftexecaflat-cache>rimrafglobjsdomprettierpuppeteerstylelintstylelint-config-standardstylelint-ordervitewebpack-dev-server>rimrafExcluded — dependency dashboard "Rate-Limited" items whose packages do not exist anywhere in this repo (78 items)
These reference package names not found in any
package.jsonorpnpm-workspace.yamlcatalog in
commercetools/ui-kit. Skipped rather than guessed at — see caveat above.Full list (branch id → title):
@radix-ui/react-dialog,cosmiconfig,fflate,html-webpack-plugin,serialize-javascript,uuid, sentry-javascript monorepo (@sentry/browser,@sentry/react,@sentry/types), all apollo-graphql packages (@apollo/client,graphql), the remaining 16 packages inside "update all dependencies"(
@commercetools/nimbus,@percy/core,@reduxjs/toolkit,@rollup/pluginutils,ajv,changesets/action,cosmiconfig-typescript-loader,mini-css-extract-plugin,node,pnpm/action-setup,react-refresh,rimraf[also already at latest 3.x —no-op],
semver,sentry-testkit,start-server-and-test,winston),jest[already 30.4.2, latest],
jest-each,jest-environment-jsdom[already 30.4.1,latest],
jest-mock, all node.js updates already covered above,react-redux,webpack,@commercetools/api-request-builder,@commercetools/http-user-agent,@commercetools/sdk-client,@commercetools/sdk-middleware-correlation-id,@commercetools/sdk-middleware-http,@commercetools/sync-actions,@cypress/code-coverage,@react-hook/resize-observer,@rollup/plugin-graphql,@testing-library/jest-domv7 target (already excluded above as major, but alsodouble-listed with a
major-all-testing-library-packagesbranch id),apollo-link-logger,babel-plugin-istanbul,chalk,cldr,cypress,diff,dotenv,dotenv-expand,express,fast-equals,find-up,fs-extra,fuse.js,globals,graphql-request,jose,js-yaml,jscodeshift,jwt-decode,listr2,memoize-one,minimatch@^3/@^4/@^9,open,path-to-regexp@^6,picomatch@^2,qss,reselect,rollup-plugin-visualizer,semver@^6,sentry-testkit,start-server-and-test,style-loader,stylelint-value-no-unknown-custom-properties,svg-url-loader,test-exclude,thread-loader,unfetch,vercel,vite-bundle-analyzer,wait-for-expect,webpackbar,pnpm/action-setupaction v6,codecov/codecov-actionv7,@commercetools/composable-commerce-test-data,babel-jest[already 30.4.1, matches dashboard target exactly — no-op either way],typescript[already 5.9.3, matches dashboard target exactly — no-op],react/react-dom/@types/react-domgroup [duplicate of already-merged PR #3285,handled above],
pnpmto v11.20.0 [pnpm itself was already bumped to 11.14.0 onmainin a prior commit outside this batch; the v11.20.0 dashboard entry is a furtherminor tool-version bump we did not chase since it's the pnpm binary version pinned via
packageManager/CI config, not a package.json dependency, and out of scope for apackage-dependency consolidation],
actions/cachev6,actions/checkoutv7 (major,excluded per task instructions),
actions/stalev11.Skipped per explicit instruction:
chore(deps): lock file maintenance(not a real dependency).Changeset
Added
.changeset/renovate-batch-consolidation.md:@commercetools-uikit/pagination: patch — becauseformikis listed as a runtimedependenciesentry (not devDependency/peerDependency) for that package.No other changeset was added. Everything else in this batch (
qs,postcss,@changesets/changelog-github,dompurify,immutable, react tooling versions,@changesets/cli,@formatjs/cli,browserslist, and the CI/action pins/digests) isa devDependency, CI-only, or repo-tooling change that does not affect the runtime
behavior of any published
@commercetools-uikit/*/@commercetools-frontend/*package, consistent with existing changeset precedent in this repo.
Totals
in the initial task framing — see caveat above)
Not merging or closing the original Renovate PRs — leaving that to review.