chore(deps): bump the npm-dependencies group across 2 directories with 2 updates#2204
chore(deps): bump the npm-dependencies group across 2 directories with 2 updates#2204dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF ScorecardScorecard details
Scanned Files
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2204 +/- ##
==========================================
+ Coverage 81.32% 81.39% +0.07%
==========================================
Files 130 120 -10
Lines 19140 19064 -76
Branches 12 0 -12
==========================================
- Hits 15565 15517 -48
+ Misses 3572 3547 -25
+ Partials 3 0 -3
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
Eval Execution✅ Status: Passed
No changed AI artifacts required evaluation. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Dependency Review — Automated Safety Check
Two npm dependencies updated across two directories. No GitHub Actions, devcontainer, or copilot-setup-steps.yml files were changed, so SHA pinning and environment sync checks are not applicable.
Dependencies Updated
| Package | Directory | From | To | Classification |
|---|---|---|---|---|
eslint |
docs/docusaurus/ |
9.39.4 | 10.6.0 | |
@github/copilot |
evals/beval/ |
1.0.63 | 1.0.65 | ✅ Patch |
@github/copilot 1.0.63 → 1.0.65 — ✅ PASS
Patch bump. Release notes (1.0.64–1.0.65) show only new features and bug fixes—no breaking changes, no deprecations. License unchanged (proprietary GitHub tooling, already a project dependency). All safety checks pass for this update.
eslint 9.39.4 → 10.6.0 — ⚠️ Human Review Required
This is a major version bump (v9 → v10). ESLint v10 introduced breaking changes from v9, including:
- Removal of several deprecated rule options and APIs
- Changes to the
Linterclass API - Stricter requirements for flat config (
eslint.config.js) compliance - Dropped support for older Node.js versions
The Dependabot PR body includes release notes starting at v10.0.0 only; it does not link to the [ESLint v9 → v10 migration guide]((eslint.org/redacted)
Recommended human review steps for docs/docusaurus/:
- Confirm the Docusaurus project uses flat config (
eslint.config.js) — if it still uses.eslintrc.*, that format was removed in v10. - Verify that
eslint-plugin-jsx-a11y,eslint-plugin-mdx, and@typescript-eslint/parser(all present in the project) are compatible with eslint v10. - Run the linter locally (
npm run lint:mdor the project's eslint command indocs/docusaurus/) to confirm no new errors.
License remains MIT — compatible with the project. No vulnerabilities reported by Dependabot.
Summary
| Check | Result |
|---|---|
| License compatibility | ✅ Pass |
| SHA pinning (GitHub Actions) | ✅ N/A — no workflow files changed |
| Devcontainer / setup sync | ✅ N/A — no environment files changed |
| New dependencies introduced | ✅ None (existing deps bumped only) |
| Dependabot vulnerability report | ✅ None reported |
| Major version bump | eslint v9 → v10 — see above |
The
eslintmajor bump requires a human to verify config and plugin compatibility before merging. The@github/copilotpatch is safe to merge independently.
Generated by Dependabot PR Review for issue #2204 · 247.6 AIC · ⌖ 12.7 AIC · ⊞ 46.4K
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/npm-dependencies-a6830253b1
branch
from
7b3355c to
3d7fc8f
Compare
There was a problem hiding this comment.
Dependency Review — Safety Check Results
Two dependency groups updated across three directories. All licensing and SHA-pinning checks passed; one item needs human attention before merge.
eslint · docs/docusaurus · 9.39.4 → 10.6.0 — ⚠️ Major version bump
| Check | Result |
|---|---|
| License | ✅ MIT — compatible |
| SHA pinning | N/A (npm) |
| Vulnerability | ✅ Dependabot reports none |
| Breaking changes |
ESLint 10 breaking changes to verify before merging:
- Node.js engine raised: v10 requires
^20.19.0 || ^22.13.0 || >=24. Node 18 and Node 21.x are no longer supported. Confirm the docs site CI runner and any local tooling meet this constraint. @eslint/eslintrcremoved: Legacy.eslintrc.*configuration format is no longer bundled. ESLint 10 requires flat config (eslint.config.*). If thedocs/docusaurustree still uses an.eslintrc.*file, linting will break after this bump.- Transitive package reshuffling: Several
@eslint/*packages moved to new major versions (e.g.@eslint/config-array0.21 → 0.23,@eslint/core0.17 → 1.2). These are internal to eslint and should be transparent, but worth a quicknpm run lintpass in the docusaurus directory post-merge.
Recommended action: Confirm that
docs/docusaurususes flat config and that CI builds on Node ≥ 20.19. Then merge.
@github/copilot · /evals/beval and root package-lock.json · 1.0.63 → 1.0.65 (evals), 1.0.62 → 1.0.65 (root) — ✅ Patch bump
| Check | Result |
|---|---|
| License | ✅ Existing dependency, proprietary GitHub license — no change in kind |
| SHA pinning | N/A (npm) |
| Vulnerability | ✅ Dependabot reports none |
| Breaking changes | None — patch release, os-theme transitive dep removed (cleanup) |
Changelog highlights (1.0.63 → 1.0.65): new copilot skill subcommand, /diff for non-git folders, inline image rendering, OTLP compaction span attributes. No breaking changes. Clean to merge.
Summary
| Dependency | Directory | Bump | Verdict |
|---|---|---|---|
eslint |
docs/docusaurus |
9.39.4 → 10.6.0 (major) | |
@github/copilot |
evals/beval |
1.0.63 → 1.0.65 (patch) | ✅ Safe |
@github/copilot |
root package-lock.json |
1.0.62 → 1.0.65 (patch) | ✅ Safe |
No GitHub Actions references were changed. No .devcontainer / copilot-setup-steps.yml synchronization issues. All license checks pass.
Generated by Dependabot PR Review for issue #2204 · 178.5 AIC · ⌖ 12.7 AIC · ⊞ 46.4K
…h 2 updates Bumps the npm-dependencies group with 1 update in the /docs/docusaurus directory: [eslint](https://github.com/eslint/eslint). Bumps the npm-dependencies group with 1 update in the /evals/beval directory: [@github/copilot](https://github.com/github/copilot-cli). Updates `eslint` from 9.39.4 to 10.6.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v9.39.4...v10.6.0) Updates `@github/copilot` from 1.0.63 to 1.0.65 - [Release notes](https://github.com/github/copilot-cli/releases) - [Changelog](https://github.com/github/copilot-cli/blob/main/changelog.md) - [Commits](github/copilot-cli@v1.0.63...v1.0.65) --- updated-dependencies: - dependency-name: "@github/copilot" dependency-version: 1.0.65 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: eslint dependency-version: 10.6.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/npm-dependencies-a6830253b1
branch
from
3d7fc8f to
cffd5ce
Compare
There was a problem hiding this comment.
Dependency Review — Safety Check Results
Summary of Updates
| Package | Directory | Old Version | New Version | Bump Type |
|---|---|---|---|---|
eslint |
docs/docusaurus/ |
9.39.4 | 10.6.0 | MAJOR |
@github/copilot |
evals/beval/ + root |
1.0.62/1.0.63 | 1.0.65 | patch ✅ |
⚠️ eslint 9.39.4 → 10.6.0 — Major Version Bump (human review required)
This is a major version bump crossing the v9 → v10 boundary. ESLint v10 introduces breaking changes that require human verification before merging:
- Legacy config system removed: ESLint v10 drops support for the legacy
.eslintrc.*/.eslintrc.js/.eslintrc.jsonconfiguration format. Only flat config (eslint.config.js/eslint.config.mjs) is supported. Ifdocs/docusaurus/uses a legacy config file, linting will break. - Node.js compatibility: ESLint v10 requires Node.js ≥ 18.18.0. Verify the CI environment and Docusaurus build pipeline meet this requirement.
- License: MIT — compatible ✅
Action required: Verify that docs/docusaurus/ uses flat config format and that the Node.js version constraint is satisfied before merging.
✅ @github/copilot 1.0.62/1.0.63 → 1.0.65 — Patch Bump
Clean patch-level update with no breaking changes noted in the Dependabot changelog. The os-theme optional dependency was removed in this update (visible in the root lockfile diff), which is a reduction in the dependency surface — a positive change.
License note: The package declares "SEE LICENSE IN LICENSE.md" rather than an SPDX identifier. As a GitHub-owned package already present in the repository, this is expected and not a new licensing concern.
Remaining Safety Checks
| Check | Result |
|---|---|
| New dependencies introduced | None — bumps only ✅ |
| SHA pinning (GitHub Actions) | N/A — no workflow files changed ✅ |
| Environment sync (devcontainer / setup-steps) | N/A — no devcontainer changes ✅ |
| Known vulnerabilities (per Dependabot) | None reported ✅ |
Verdict:
COMMENT— The@github/copilotpatch bump is safe to merge. Theeslintmajor version bump requires a human to confirm flat config compatibility indocs/docusaurus/before merging.
Generated by Dependabot PR Review for issue #2204 · 170.3 AIC · ⌖ 12.6 AIC · ⊞ 46.4K
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/npm-dependencies-a6830253b1
branch
1 participant
Bumps the npm-dependencies group with 1 update in the /docs/docusaurus directory: eslint.
Bumps the npm-dependencies group with 1 update in the /evals/beval directory: @github/copilot.
Updates
eslintfrom 9.39.4 to 10.6.0Release notes
Sourced from eslint's releases.
... (truncated)
Commits
5d12a0410.6.0f7ca54bBuild: changelog update for 10.6.06a42034ci: run ecosystem tests on main branch (#20891)b1f9106feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981)3dbacdbci: bump actions/checkout from 6 to 7 (#21014)c3abfcachore: correct JSDoc param types in html formatter (#21018)a83683ddocs: Update READMEa832320ci: split ecosystem tests into separate jobs (#21001)6b05784fix: prefer-exponentiation-operator invalid autofix at statement start (#20997)bb9eb2afix: account for shadowedBooleaninno-extra-boolean-cast(#21013)Updates
@github/copilotfrom 1.0.63 to 1.0.65Release notes
Sourced from @github/copilot's releases.
... (truncated)
Changelog
Sourced from @github/copilot's changelog.
... (truncated)
Commits
e7d294dUpdate changelog.md for version 1.0.64b71d117Update changelog.md for version 1.0.63