Repository navigation
Conversation
Brings the lockfile in sync with package.json: version 4.1.1 -> 4.1.5, adds the markdown-table devDependency, and refreshes resolved dependency versions.
olafleur
changed the title
olafleur
marked this pull request as ready for review
October 18, 2026 03:53
…approvals - Delete the stale package-lock.json (master installs with pnpm since the switch to pnpm, so the npm lockfile was unused and drifted out of sync) - Bump devDependencies in package.json and regenerate pnpm-lock.yaml to pull in patched versions, fixing all 6 critical npm audit advisories - Fix pnpm-workspace.yaml build approvals: add the allowBuilds map required by pnpm 11 (fixes hard ERR_PNPM_IGNORED_BUILDS install failures) while keeping onlyBuiltDependencies/ignoredBuiltDependencies for pnpm 10 Co-Authored-By: OpenCode <noreply@opencode.github.io>
olafleur
changed the title
puppeteer 24 types the 'pageerror' event payload as unknown, so the (err: Error) => ... handlers in the integration specs no longer compile under the strict tsconfig. Annotate as unknown instead.
dedent 1.7 (pulled in by the dep refresh) re-interprets \xNN / \uNNNN escape sequences in tagged-template results, including interpolated values. generate-char-utils interpolates regExp.source, which is literal escape *text*, so the regenerated src/char-utils.ts and tests/char-utils.spec.ts contained raw control/surrogate characters, failing ts-node with TS1517 (range out of order in character class) when CI regenerated them before running tests. Pass plain strings to dedent() instead of using the tagged-template form, which disables the escape re-interpretation. Regenerated output is byte-identical to the previously committed files.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #440 +/- ##
=======================================
Coverage 99.50% 99.50%
=======================================
Files 23 23
Lines 1403 1403
Branches 350 350
=======================================
Hits 1396 1396
Misses 6 6
Partials 1 1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
package-lock.json: the repo switched to pnpm in 1610720, so the npm lockfile was unused and had drifted out of sync withpackage.jsondevDependenciesinpackage.jsonand regeneratepnpm-lock.yamlaccordingly, pulling in patched versionspnpm-workspace.yaml: pnpm 11 turns unapproved dependency build scripts into a hard install error (ERR_PNPM_IGNORED_BUILDS). Add the newallowBuildsmap while keepingonlyBuiltDependencies/ignoredBuiltDependencies, so both pnpm 10 and 11 install cleanlySecurity
pnpm auditon the regenerated lockfile:For comparison, the deleted
package-lock.jsonon master reported 81 advisories including 6 criticals vianpm audit --package-lock-only.The 14 remaining advisories are all in dev-only tooling and fixing them requires breaking major-version bumps (e.g.
webpack-dev-server@6). These are tracked separately and are not part of this change.Testing
pnpm installcompletes cleanly on both pnpm 10.34.7 and 11.17.0 — previously pnpm 11 installs failed withERR_PNPM_IGNORED_BUILDSpnpm run test:unit: 101,052 passing