chore(deps): bump @commitlint/config-conventional from 21.2.0 to 21.2.2 - #182
Open
dependabot[bot] wants to merge 1 commit into
Open
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional) from 21.2.0 to 21.2.2. - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/config-conventional/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.2/@commitlint/config-conventional) --- updated-dependencies: - dependency-name: "@commitlint/config-conventional" dependency-version: 21.2.2 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
AsiaOstrich
added a commit
that referenced
this pull request
Sep 16, 2026
…nd that could not run them. 合併 11 個 dependabot PR，以及那個跑不動的 npm 指令。 Eleven open dependabot PRs, the oldest from 2026-08-21, none of them mergeable against a main that has moved since. Applied as one change instead, following the precedent set by 386d535. root @commitlint/cli 21.2.1→21.2.2, @commitlint/config-conventional 21.2.0→21.2.2, opencc-js 1.4.1→1.4.2, tsx 4.23.12→4.23.13 (#181 #182 #188 #194) cli vitest + @vitest/coverage-v8 4.1.10→4.1.11, @inquirer/prompts 8.5.2→8.7.2, js-yaml 5.2.3→5.4.2, eslint 10.8.0→10.9.1 (#183 #185 #189 #190 #191) workflows actions/checkout and actions/setup-node, the last five @v4 pins, to @v7 (#187 #193) `cli` also carried six advisories — one high (nanoid), five moderate (vitest's @vitest/mocker, postcss, @humanfs/node) — all dev-only, none of them reaching a published artifact, and all cleared by the same bumps. Both trees now audit clean. `npm update` and `npm audit fix` both fail in `cli/` with "Cannot read properties of null (reading 'edgesOut')", an arborist fault raised while resolving vitest 4.1.11's peer set (npm 10.9.8). `--legacy-peer-deps` gets past it and produces a lockfile `npm ci` then rejects — it drops three `@emnapi/*` packages that normal resolution keeps, which is exactly how this would have failed in CI and not here. The lockfile was reconciled with a plain `npm install` afterwards; `npm ci` now succeeds in both trees, and the final diff removes nothing. Verified: `npm ci` in both trees, 3,564 tests, lint clean, and every docs/registry/translation gate. eslint keeps its exact pin rather than gaining a caret, matching `globals` beside it. 十一個開啟中的 dependabot PR，最舊的來自 2026-08-21，沒有一個能對已經前進的 main 自動合併。改為一次套用，比照 386d535 的前例。 `cli` 另外帶著六則安全公告——一則 high（nanoid）、五則 moderate（vitest 的 @vitest/mocker、postcss、@humanfs/node）——全部只在開發相依，不會進入發布產物， 而且同一批升級就清掉了。兩棵樹現在 audit 皆為零。 `npm update` 與 `npm audit fix` 在 `cli/` 都以 "Cannot read properties of null (reading 'edgesOut')" 失敗，那是 arborist 在解析 vitest 4.1.11 的 peer 集合時 拋出的錯（npm 10.9.8）。`--legacy-peer-deps` 繞得過去，但它產出的 lockfile 會被 `npm ci` 拒絕——它少了三個 `@emnapi/*`，而那正是這件事**會在 CI 而不是在這裡** 爆掉的方式。之後以一般的 `npm install` 對帳；`npm ci` 現在兩棵樹都成功，最終 差異沒有移除任何套件。 驗證：兩棵樹的 `npm ci`、3,564 個測試、lint 乾淨、所有文件／registry／翻譯閘門。 eslint 維持精確釘選而非加上 caret，與旁邊的 globals 同慣例。 Refs #181 #182 #183 #185 #187 #188 #189 #190 #191 #193 #194 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W5rYbz3prheikozWh7pgcv
AsiaOstrich
added a commit
that referenced
this pull request
Sep 16, 2026
…ed one missing peer. 剩下四個，含那個只差一個 peer 的 vitest 大版本。
Dependabot rebased its open PRs after the last batch and came back with four:
- @commitlint/config-conventional: the declared range, ^21.2.0 → ^21.2.2,
to match what was already resolved (#182)
- eslint 10.9.1 → 10.10.0, exact pin kept (#189)
- vitest and @vitest/coverage-v8 4.1.11 → 5.0.0 (#183 #185)
The vitest major was tried in a throwaway copy first rather than on the branch
about to be released. It fails to start with `Cannot find package 'vite'`: v5
takes vite as a peer and stops bundling it, and `--legacy-peer-deps` — needed
to get past npm's arborist fault on this tree at all — does not install peers.
With `vite` declared explicitly the whole suite passes unchanged, 183 files and
3,564 tests, and the coverage gate holds at 65.7% statements. So it ships,
with `vite` as a devDependency it did not have before.
The lockfile was again reconciled with a plain `npm install` after the legacy
one, and `npm ci` verified in both trees — the same step that caught the
dropped `@emnapi/*` packages last time.
Verified: npm ci, 3,564 tests, coverage gate, lint, bundle parity (185/185),
and every docs/registry/translation gate.
Dependabot 在上一批之後重新 rebase，回來剩四個：
- @commitlint/config-conventional：宣告範圍 ^21.2.0 → ^21.2.2，對齊已解析的版本
- eslint 10.9.1 → 10.10.0，維持精確釘選
- vitest 與 @vitest/coverage-v8 4.1.11 → 5.0.0
vitest 大版本先在拋棄式副本試，而不是在正要發版的分支上試。它一啟動就以
`Cannot find package 'vite'` 失敗：v5 把 vite 改成 peer 而不再內含，而
`--legacy-peer-deps`（在這棵樹上是繞過 npm arborist 錯誤的唯一辦法）不會安裝
peer。明確宣告 `vite` 之後，整套測試原封不動全過——183 個檔案、3,564 個測試，
覆蓋率閘門維持在 65.7% statements。因此採用，並多一個先前沒有的 `vite` 開發相依。
lockfile 同樣在 legacy 安裝之後用一般的 `npm install` 對帳，兩棵樹都驗過
`npm ci`——正是上一次抓到三個 `@emnapi/*` 被丟掉的那一步。
Refs #182 #183 #185 #189
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W5rYbz3prheikozWh7pgcv
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps @commitlint/config-conventional from 21.2.0 to 21.2.2.
Release notes
Sourced from @commitlint/config-conventional's releases.
Changelog
Sourced from @commitlint/config-conventional's changelog.
Commits
d00d190v21.2.23146d04docs(config-conventional): document rules that go beyond the spec (#4910)f2e8daechore: update dependency typescript to v7 (#4886)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)