Conversation
Adds automated dependency updates: weekly schedule, grouped PRs for the opencode-ai packages, vite, test tooling, type definitions and dev non-majors, pinned GitHub Actions digests, and lockfile maintenance.
Enables supply-chain/malware checks on dependency-changing pull requests and the dependency overview comment. The Socket for GitHub app still has to be installed on the repository for this to take effect.
Runs `bun audit fix` + `bun update`: 23 advisories (15 high) resolved
within existing ranges; only a low-severity esbuild dev-server advisory
remains (addressed by the vite 8 bump in the next commit).
Adapts to the APIs pulled in by the range refresh:
- @opencode-ai/plugin 1.18 returns `ToolResult` (string | { output }) from
tool execute, so the pty-spawn test narrows before asserting.
- Bun's websocket `open` handler must return void; `ws.subscribe` returns
boolean, so the handler no longer returns it.
Also aligns engines.opencode with the plugin version floor (>=1.18.31).
- vite 8, @vitejs/plugin-react 6 - react 19 + @types/react / @types/react-dom 19 - jsdom 30 + @types/jsdom 30 - @biomejs/biome 2.5, @playwright/test + playwright-core 1.63 Also applies the new biome 2.5 `useOptionalChain` suggestions it flagged. TypeScript stays on 5.x because the package declares `typescript: ^5` as a peer dependency for consumers. All of these are devDependencies, so there is no consumer-facing break. Verified: `bun audit` clean, build, typecheck, lint and tests pass (only the pre-existing `main` test failures remain).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
There wasn't any dependency-update automation set up here yet, so the tree had drifted a fair
bit:
bun auditreported 23 advisories (15 high) across the build/test toolchain, and severalpackages were well behind current releases (
@opencode-ai/plugin1.3 → 1.18, plusvite,react,jsdom,@playwright/test,@biomejs/biome, …).Rather than leave that as a one-off cleanup, this PR sets up ongoing automation and
refreshes the backlog in the same pass, so keeping things current becomes low-effort from here on.
What this does
renovate.json) — weekly schedule, grouped update PRs (@opencode-ai/*,vite, test tooling, type definitions, dev non-majors), GitHub Actions with pinned digests,and lockfile maintenance.
socket.yml) — supply-chain / malware checks on dependency-changingpull requests, plus the dependency-overview comment.
vite8,@vitejs/plugin-react6,react19,jsdom30,@biomejs/biome2.5,@playwright/test/playwright-core1.63,@opencode-ai/*1.18.The committed configs are inert on their own — the apps have to be installed on the GitHub
account, which can't be done from a pull request:
Once enabled,
renovate.jsonandsocket.ymltake effect. This is offered as a suggestion —happy to switch to a different setup (e.g. Dependabot, or a self-hosted Renovate Action) if
you'd prefer.
Notes
@opencode-ai/*bump to 1.18 changes the tool API slightly (ToolResultis nowstring | { output }), which the affected test now handles; the Bun websocketopenhandlerno longer returns the boolean from
subscribe.typescript: ^5as a peerdependency, so a TS 7 jump would affect consumers and belongs in its own PR.
Verification
bun audit: no vulnerabilities foundbun run format,bun run lint,bun run typecheck,bun run build:prod: passbun test: passes apart from a few pre-existing failures that also occur onmain(unrelated to this change)