chore(deps-dev): bump monaco-editor from 0.50.0 to 0.56.0 - #20
Conversation
dependabot
Bot
added
dependencies
neo-opus-grace
left a comment
neo-opus-grace
left a comment
There was a problem hiding this comment.
PR Micro-Review
Class: mechanical — one dependency version in package.json plus its lockfile subtree, no source.
Verdict: Approved
Verified at 365baaddc5, gh pr checks exit 0, OPEN / CLEAN.
Glance: monaco-editor 0.50.0 → 0.56.0, six minors on a package this repo pins exactly. The thing I looked for was not the version but what the new tree drags in, and it is not nothing: 0.56 vendors two nested dependencies 0.50 did not — monaco-editor/node_modules/dompurify@3.4.8 and monaco-editor/node_modules/marked@14.0.0. Neither is a conflict. This repo declares marked: ^18.0.5 at top level, so after this lands two copies of marked coexist by design — monaco resolves its own 14.0.0, devindex keeps its ^18.x — and dompurify is a new transitive that no top-level declaration competes with. 3.4.8 is current, so it arrives without a stale-sanitizer problem.
Findings: Two, neither blocking.
-
A sanitizer entering the tree is worth naming even when the version is fine.
neomjs/neocarries a spec on exactly this surface —MonacoEditor.spec.mjs:153, "the editor executes the DOMPurify npm resolves for monaco-editor, not the copy Monaco embeds" — which exists because Monaco embeds a copy. devindex declares no such contract, so nesting is correct behaviour here rather than a violation. Recording it so that if devindex ever asserts which sanitizer Monaco runs, this bump is where the embedded copy arrived. -
#18and this PR both rewritepackage-lock.json—#18movesmarked 18.0.10 → 18.0.12at top level, this one adds the monaco subtree. Different packages, same file, so whichever merges second wants a rebase rather than a trust-the-green. Dependabot will do it on request; worth knowing before the second merge rather than after. -
Origin Session ID: 148d12cc-9777-46e4-bfb9-a422479153a5
🖖 Grace, Claude Opus 5, Claude Code. Eligibility rules: pr-review-guide §6.4.
|
@dependabot rebase |
Bumps [monaco-editor](https://github.com/microsoft/monaco-editor) from 0.50.0 to 0.56.0. - [Release notes](https://github.com/microsoft/monaco-editor/releases) - [Changelog](https://github.com/microsoft/monaco-editor/blob/main/CHANGELOG.md) - [Commits](microsoft/monaco-editor@v0.50.0...v0.56.0) --- updated-dependencies: - dependency-name: monaco-editor dependency-version: 0.56.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
365baad to
c8577a0
Compare
2 participants
Bumps monaco-editor from 0.50.0 to 0.56.0.
Release notes
Sourced from monaco-editor's releases.
... (truncated)
Changelog
Sourced from monaco-editor's changelog.
... (truncated)
Commits
13f0c87Bump websocket-driver from 0.7.4 to 0.7.5 in /website (#5392)b5f23a3Merge pull request #5396 from microsoft/hediet/b/release-0.56.09d053abImprove Monaco Editor 0.56.0 changelog0ba33d0Release Monaco Editor 0.56.06d961b1Bump websocket-driver from 0.7.4 to 0.7.5 in /samples (#5385)d8c9ff0Removes leftover debugger statements. (#5379)59285abfixes pipeline (#5376)aaf58dbBump webpack-dev-server from 5.2.4 to 5.2.5 in /samples (#5374)d8ac38eBump webpack-dev-server from 5.2.4 to 5.2.5 in /website (#5373)874af57Bump undici from 7.24.7 to 7.28.0 (#5371)Maintainer changes
This version was pushed to npm by microsoft1es, a new releaser for monaco-editor since your current version.