chore(deps): update all dependencies#318
Conversation
📝 WalkthroughSummary by CodeRabbit
WalkthroughВ devDependencies обновлён ChangesОбновление devDependencies
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related issues
Possibly related PRs
Suggested reviewers
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning)
✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
renovate
Bot
force-pushed
the
renovate/all
branch
from
9255104 to
dff5d4e
Compare
renovate
Bot
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/api/package.json`:
- Around line 42-45: Update the invalid dependency versions in package.json:
change "`@types/node`" to a published version (e.g., ^25.7.0) and align the
TypeScript ESLint packages so both "`@typescript-eslint/eslint-plugin`" and
"`@typescript-eslint/parser`" use the same existing release (e.g., ^8.59.3); save
the package.json, install, then run the project checks with `bun run typecheck`
and `bun run check` to validate compatibility of the updated versions (focus
edits around the dependency entries for "`@types/node`",
"`@typescript-eslint/eslint-plugin`", and "`@typescript-eslint/parser`").
In `@packages/docker-git-session-sync/package.json`:
- Line 41: The dependency "`@types/node`": "^25.9.0" is incompatible with the
project's Node targets (vite target "node20" and Docker Node 24); update the
package.json entry for "`@types/node`" to a matching major for your runtime (use
"^24.x" if the Docker images run Node 24, or "^20.x" if you intend Node 20),
then reinstall/update lockfile (npm/yarn/pnpm) and ensure the vite config target
and Docker base images remain consistent with the chosen `@types/node` version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 9af3857a-48c8-48b7-a807-392a7c71e6ef
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (4)
packages/api/package.jsonpackages/app/package.jsonpackages/docker-git-session-sync/package.jsonpackages/lib/package.json
📜 Review details
⏰ Context from checks skipped due to timeout of 900000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (9)
- GitHub Check: Test
- GitHub Check: Final build (windows-latest)
- GitHub Check: E2E (Clone cache)
- GitHub Check: E2E (Runtime volumes + SSH)
- GitHub Check: E2E (Browser command)
- GitHub Check: E2E (OpenCode)
- GitHub Check: Lint
- GitHub Check: E2E (Login context)
- GitHub Check: Snapshot
🧰 Additional context used
📓 Path-based instructions (3)
**/*.{js,ts,jsx,tsx,py,java,go,rb,php,sh,bash,yml,yaml,json,env*,toml,cfg,config,dockerfile,dockerignore}
📄 CodeRabbit inference engine (Custom checks)
Fail if changed files expose credentials, tokens, private-keys, or PII in source, generated config, logs, or CI output
Files:
packages/api/package.jsonpackages/lib/package.jsonpackages/docker-git-session-sync/package.jsonpackages/app/package.json
**/{package*.json,requirements*.txt,setup.py,setup.cfg,Pipfile,Pipfile.lock,pyproject.toml,pom.xml,build.gradle,Gemfile,Gemfile.lock,go.mod,go.sum,composer.json,Cargo.toml,Cargo.lock}
📄 CodeRabbit inference engine (Custom checks)
Fail if dependency or package-manager changes materially increase supply-chain risk without justification
Files:
packages/api/package.jsonpackages/lib/package.jsonpackages/docker-git-session-sync/package.jsonpackages/app/package.json
**/*
⚙️ CodeRabbit configuration file
**/*: Ты строгий ревьюер SPEC DRIVEN DEVELOPMENT.Перед выводами изучи README.md, другие *.md файлы, linked issues,
PR description, PR comments/discussion и релевантную кодовую базу.Сверь изменения с исходным ТЗ/спекой и обсуждением. Флагай любой уход
от спеки, недокументированное изменение поведения, отсутствие тестов
для заявленного поведения и security-риск. Если спека не видна,
попроси автора добавить ее в issue или PR description.Проверь решение с точки зрения формальной верификации: какие инварианты,
предусловия и постусловия можно доказать математически, а где доказуемость
слабая. Оцени решение с точки зрения теории игр: устойчивы ли стимулы,
нет ли выгодного обхода правил, и какое решение было бы сильнее.
Files:
packages/api/package.jsonpackages/lib/package.jsonpackages/docker-git-session-sync/package.jsonpackages/app/package.json
🔇 Additional comments (4)
packages/api/package.json (1)
44-45: Несоответствие с AI-сводкой.AI-сводка утверждает, что изменилась только версия
@types/node, но строки 44-45 показывают, что также обновлены@typescript-eslint/eslint-pluginи@typescript-eslint/parserдо версии^8.59.4.packages/lib/package.json (2)
65-67: Несоответствие с AI-сводкой.AI-сводка утверждает, что обновлен только пакет
@types/node, но строки 65-67 показывают, что также обновлены@typescript-eslint/eslint-plugin,@typescript-eslint/parserиtypescript-eslintдо версии^8.59.4.
64-67: ⚡ Quick winПроверьте совместимость обновленных зависимостей.
Обновления
@types/node@^25.9.0 и инструментов@typescript-eslintмогут вызвать проблемы типизации в общей библиотеке. CI автоматически проверяет совместимость черезtypecheckиlintдля packages/lib, но убедитесь, что эти проверки проходят без ошибок.> Likely an incorrect or invalid review comment.packages/app/package.json (1)
99-104: ⚡ Quick winCI-конвейер уже автоматически проверяет совместимость этих зависимостей.
Обновления будут проверены автоматически при запуске GitHub Actions на этом PR. В рабочем процессе
check.ymlуже определены задачиTypes,LintиTest, которые выполняют необходимые проверки:
bun run --cwd packages/app check(typecheck)bun run --cwd packages/app lintbun run --cwd packages/app testВерсии совместимы: все пакеты
@typescript-eslint/*используют одинаковую версию^8.59.4, что необходимо для правильной работы.> Likely an incorrect or invalid review comment.
| "@types/node": "^25.9.0", | ||
| "@types/ws": "^8.18.1", | ||
| "@typescript-eslint/eslint-plugin": "^8.59.3", | ||
| "@typescript-eslint/parser": "^8.59.3", | ||
| "@typescript-eslint/eslint-plugin": "^8.59.4", | ||
| "@typescript-eslint/parser": "^8.59.4", |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Does @types/node version 25.9.0 exist on npm and are there any known security issues?
💡 Result:
The npm package @types/node does not have a version 25.9.0 [1][2]. While Node.js itself has a version 25.9.0 [3][4], the @types/node package follows a different versioning scheme where the major and minor versions align with Node.js, but the patch version is managed independently by the DefinitelyTyped project [5]. As of May 18, 2026, the latest available version of @types/node is 25.7.0 [2]. Regarding security, there are no direct vulnerabilities reported for the @types/node package in the Snyk vulnerability database [2]. It is important to note that @types/node is a development dependency containing only TypeScript type definitions and does not contain executable code, which significantly reduces its security risk profile. Users should be aware of a separate, malicious package named types-node (note the missing @ symbol), which has been identified as malicious and should be avoided [6]. Additionally, while there have been recent, unrelated supply chain attacks targeting other popular Node.js packages like node-ipc [7][8][9], these do not affect @types/node.
Citations:
- 1: https://registry.npmjs.org/%40types%2Fnode
- 2: https://security.snyk.io/package/npm/%40types%2Fnode
- 3: https://nodejs.org/en/blog/release/v25.9.0
- 4: https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V25.md
- 5: https://libraries.io/npm/%40types%2Fnode
- 6: https://security.snyk.io/vuln/SNYK-JS-TYPESNODE-8551185
- 7: https://www.bleepingcomputer.com/news/security/popular-node-ipc-npm-package-compromised-to-steal-credentials/
- 8: https://www.csoonline.com/article/4171926/expired-domain-leads-to-supply-chain-attack-on-node-ipc-npm-package.html
- 9: https://undercodenews.com/npm-supply-chain-attack-compromised-node-ipc-packages-turn-into-credential-stealing-malware-campaign/
🌐 Web query:
Does @typescript-eslint/eslint-plugin version 8.59.4 exist on npm and are there any known security issues?
💡 Result:
As of May 18, 2026, version 8.59.4 of @typescript-eslint/eslint-plugin does not exist on npm [1][2]. The latest stable releases for the 8.x branch have reached 8.59.3 [1]. There are no known direct security vulnerabilities associated with the current versions of @typescript-eslint/eslint-plugin [3]. While security tools like Snyk and other vulnerability databases monitor the package, it is consistently reported as having no known direct security issues [3][4]. Users are generally advised to keep the package updated to the latest stable version to ensure they have the most recent security patches for any transitive dependencies [5]. If you encounter security warnings in your project, they often stem from transitive dependencies (such as minimatch) rather than the plugin itself, and these are typically resolved by updating to the latest version of @typescript-eslint/eslint-plugin [5].
Citations:
- 1: https://github.com/typescript-eslint/typescript-eslint/releases
- 2: https://www.npmjs.com/package/@typescript-eslint/eslint-plugin?activeTab=versions
- 3: https://security.snyk.io/package/npm/%40typescript-eslint%2Feslint-plugin
- 4: https://secure.software/npm/packages/@typescript-eslint/eslint-plugin/8.11.1-alpha.3
- 5: Update typescript-eslint to fix minimatch vulnerability erdembircan/plugin-rescope#25
🏁 Script executed:
#!/bin/bash
# Verify that typecheck passes with updated dependencies
cd packages/api
bun run typecheckRepository: ProverCoderAI/docker-git
Length of output: 112
Указанные версии пакетов не существуют на npm.
Версия @types/node@25.9.0 не опубликована на npm. На май 2026 г. последняя доступная версия — 25.7.0. Версия @typescript-eslint/eslint-plugin@8.59.4 также не существует; в ветке 8.x последняя стабильная версия — 8.59.3.
Обновите package.json, используя существующие версии:
@types/node@^25.7.0(или актуальнейшую доступную)@typescript-eslint/eslint-plugin@^8.59.3(или актуальнейшую доступную)@typescript-eslint/parser@^8.59.3(синхронизируйте версию с eslint-plugin)
После исправления разрешений версий выполните bun run typecheck и bun run check для проверки совместимости обновленных зависимостей с кодовой базой.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/api/package.json` around lines 42 - 45, Update the invalid
dependency versions in package.json: change "`@types/node`" to a published version
(e.g., ^25.7.0) and align the TypeScript ESLint packages so both
"`@typescript-eslint/eslint-plugin`" and "`@typescript-eslint/parser`" use the same
existing release (e.g., ^8.59.3); save the package.json, install, then run the
project checks with `bun run typecheck` and `bun run check` to validate
compatibility of the updated versions (focus edits around the dependency entries
for "`@types/node`", "`@typescript-eslint/eslint-plugin`", and
"`@typescript-eslint/parser`").
| "devDependencies": { | ||
| "@effect/vitest": "^0.29.0", | ||
| "@types/node": "^25.8.0", | ||
| "@types/node": "^25.9.0", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify typecheck passes with updated `@types/node`
cd packages/docker-git-session-sync
bun run typecheckRepository: ProverCoderAI/docker-git
Length of output: 112
🏁 Script executed:
#!/bin/bash
# Check Node.js version target and existing dependencies
cd packages/docker-git-session-sync
echo "=== package.json content ==="
cat package.json | head -50
echo -e "\n=== Root package.json for Node version info ==="
cat ../../package.json | grep -A 5 -B 5 "engines\|node"
echo -e "\n=== Check for tsconfig.json ==="
find . -name "tsconfig.json" -o -name "tsconfig*.json" | xargs cat 2>/dev/null || echo "No tsconfig found in this package"Repository: ProverCoderAI/docker-git
Length of output: 3023
🏁 Script executed:
#!/bin/bash
# Search for `@types/node` and TypeScript version info in repository
echo "=== Looking for TypeScript version ==="
rg "`@types/node`|typescript" package.json --max-count=5 -A 1 | head -30
echo -e "\n=== Check root package.json ==="
cat package.json | grep -E "typescript|`@types/node`" -A 1 -B 1
echo -e "\n=== Node.js engine requirements ==="
cat package.json | grep -E "engines|\"node\""Repository: ProverCoderAI/docker-git
Length of output: 177
🏁 Script executed:
#!/bin/bash
# Check root tsconfig.base.json and Node.js version requirement
echo "=== Root tsconfig.base.json ==="
cat tsconfig.base.json | head -30
echo -e "\n=== Root package.json - engines/node requirement ==="
cat package.json | grep -A 10 "\"engines\""Repository: ProverCoderAI/docker-git
Length of output: 939
🌐 Web query:
@types/node 25.9.0 TypeScript 6.0 compatibility Node.js version
💡 Result:
The @types/node package version 25.9.0 is designed to provide TypeScript type definitions for Node.js version 25.9.0 [1]. Regarding compatibility and versioning: 1. Node.js Version: The major and minor versions of @types/node generally correspond directly to the Node.js version they support [2]. Therefore, @types/node 25.9.0 is intended for use with Node.js 25.9.0 [1]. 2. TypeScript Compatibility: There is no strict, hard-coded dependency between specific versions of @types/node and TypeScript versions [3]. Instead, @types/node is compatible with any TypeScript version that supports the syntax used in its declaration files [3]. As of May 2026, TypeScript 6.0 is the current stable release [4][5], and @types/node 25.9.0 is fully compatible with it. While older versions of @types/node have occasionally dropped support for very old TypeScript versions (e.g., versions older than 3.7) [3], modern releases like 25.9.0 are designed to work with contemporary TypeScript environments, including TypeScript 6.0 [4]. In summary, you can safely use @types/node 25.9.0 with Node.js 25.9.0 and TypeScript 6.0 [1][4][2].
Citations:
- 1: https://nodejs.org/en/blog/release/v25.9.0
- 2: https://stackoverflow.com/questions/42035263/relationship-between-the-version-of-node-js-and-the-version-of-types-node
- 3: [@types/node] Drops support for TypeScript < 3.7 in 12.20.21 ("assert.d.ts:2:68 - error TS1144: '{' or ';' expected.") DefinitelyTyped/DefinitelyTyped#55429
- 4: https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/
- 5: https://typescript.news/articles/2026-03-26-typescript-6-0-final-javascript-release
🏁 Script executed:
#!/bin/bash
# Check for Node.js version specifications
echo "=== Looking for .nvmrc or .node-version ==="
find . -name ".nvmrc" -o -name ".node-version" | xargs cat 2>/dev/null || echo "Not found"
echo -e "\n=== Check CI/CD workflows ==="
find . -path "*/.*github/workflows" -o -path "*/.gitlab-ci.yml" | head -10
echo -e "\n=== Look for Dockerfile Node base image ==="
find . -name "Dockerfile*" | xargs grep -i "FROM.*node" 2>/dev/null | head -5
echo -e "\n=== Check package.json packageManager and Node version ==="
cat package.json | grep -E "packageManager|engines|node" || echo "No explicit engine requirement"
echo -e "\n=== Check if there are other `@types/node` versions in workspace ==="
find packages -name "package.json" | xargs grep "`@types/node`" | head -20Repository: ProverCoderAI/docker-git
Length of output: 794
🏁 Script executed:
#!/bin/bash
# Search for actual Node.js usage and version clues
echo "=== Check for minimum Node.js version in code comments ==="
rg "node.*20|node.*22|node.*24|Node.js.*2[0-9]" --max-count=10
echo -e "\n=== Check if this is a type definitions only package ==="
cat packages/docker-git-session-sync/package.json | grep -E "\"main\"|\"types\"|\"exports\"" -A 1Repository: ProverCoderAI/docker-git
Length of output: 4078
Версия @types/node 25.9.0 несовместима с целевыми версиями Node.js проекта.
Проект использует target: "node20" в vite конфигах и Docker образы с Node.js 24, но @types/node: ^25.9.0 соответствует Node.js 25.x (будущая версия). Версионирование @types/node напрямую следует за версиями Node.js: @types/node 20.x для Node.js 20, @types/node 24.x для Node.js 24.x и т.д.
Используйте:
@types/node: ^24.xесли проект ориентирован на Node.js 24@types/node: ^20.xесли проект ориентирован на Node.js 20
Текущая версия вызовет несоответствия типов и проблемы при типизации.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/docker-git-session-sync/package.json` at line 41, The dependency
"`@types/node`": "^25.9.0" is incompatible with the project's Node targets (vite
target "node20" and Docker Node 24); update the package.json entry for
"`@types/node`" to a matching major for your runtime (use "^24.x" if the Docker
images run Node 24, or "^20.x" if you intend Node 20), then reinstall/update
lockfile (npm/yarn/pnpm) and ensure the vite config target and Docker base
images remain consistent with the chosen `@types/node` version.
1 participant
This PR contains the following updates:
^25.8.0→^25.9.0^8.59.3→^8.59.4^8.59.3→^8.59.4^8.59.3→^8.59.4cc @skulidropek
Release Notes
typescript-eslint/typescript-eslint (@typescript-eslint/eslint-plugin)
v8.59.4Compare Source
🩹 Fixes
❤️ Thank You
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
typescript-eslint/typescript-eslint (@typescript-eslint/parser)
v8.59.4Compare Source
This was a version bump only for parser to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
typescript-eslint/typescript-eslint (typescript-eslint)
v8.59.4Compare Source
🩹 Fixes
❤️ Thank You
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.