build(deps): bump the npm_and_yarn group across 2 directories with 1 update#340
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
…update Bumps the npm_and_yarn group with 1 update in the /vscode-extension directory: [linkify-it](https://github.com/markdown-it/linkify-it). Bumps the npm_and_yarn group with 1 update in the /website directory: [linkify-it](https://github.com/markdown-it/linkify-it). Updates `linkify-it` from 5.0.1 to 5.0.2 - [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/linkify-it@5.0.1...5.0.2) Updates `linkify-it` from 5.0.1 to 5.0.2 - [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/linkify-it@5.0.1...5.0.2) --- updated-dependencies: - dependency-name: linkify-it dependency-version: 5.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: linkify-it dependency-version: 5.0.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
Collaborator
|
Changes merged into the bug-fixes-101 branch. |
abdushakoor12
deleted the
dependabot/npm_and_yarn/vscode-extension/npm_and_yarn-b9dce415db
branch
July 24, 2026 09:53
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
abdushakoor12
added a commit
that referenced
this pull request
Jul 24, 2026
A full-branch merge of a security bump (based on current main) into a drifted staging branch dragged main's workflow-file edits along, and the Actions token can never push .github/workflows/* changes (no workflows scope, not grantable). PR #340's sweep failed exactly this way and the PR was left sitting on main. The sweep now copies only the PR's own changed paths (merge-base diff) onto the live staging tip, so main's drift never rides along. Bumps that themselves edit workflow files are left open with a comment for human review instead of failing.
1 task
abdushakoor12
added a commit
that referenced
this pull request
Jul 24, 2026
…st preview-discard intent; path-restrict the Dependabot sweep (#350) ## TLDR Fixes false `imports_module_attribute` errors when a user stub star-re-exports from a module owned by the active Typeshed source (the MicroPython `uio.pyi` → `from io import *` case, GitHub #312 follow-up), fixes a lost-`cancelPreview` race in the configuration editor's impact dialog, and makes the Dependabot sweep path-restricted so security-bump sweeps can no longer fail on workflow-file pushes (the failure that stranded #340). ## What Was Added? - `parse_snapshot_stub` (`crates/basilisk-checker/src/exports.rs`): the single producer of a snapshot-backed `StubModule`, extracted from the cross-module loader closure so the re-export fallback gets the same target-filtered parse. - `reexported_member_names_with_fallback` (`crates/basilisk-stubs/src/reexports.rs`): like `reexported_member_names`, but consults a fallback loader for star targets that don't resolve inside the stub's own source root. Local resolution always wins; the fallback never overrides a sibling stub. - `discardPreview()` in the configuration editor webview runtime: every user-initiated dialog dismissal (Cancel button, Escape) posts `cancelPreview` synchronously with the action. - A workflow-file guard in the Dependabot sweep: a bump that itself edits `.github/workflows/*` is left open with an explanatory comment (the Actions token cannot push workflow files by construction) instead of failing the job. - `.vscode-test.mjs` honours `BSK_TEST_GREP` so one webview test can be run in isolation. - Five integration tests in `import_apply_tests.rs` and one end-to-end CLI test (see below). - `linkify-it` 5.0.1 → 5.0.2 (transitive dev dependency of `@vscode/vsce`) in the vscode-extension and website lockfiles. ## What Was Changed or Deleted? - `build_stub_api` (`crates/basilisk-checker/src/imports/apply.rs`) now takes the import search paths and falls back to the active step-3 Typeshed snapshot when a user stub's star target doesn't resolve beside the stub — so `uio.pyi` containing only `from io import *` picks up `io`'s members from the custom typeshed's `stdlib/` tree instead of producing "Module `uio` has no attribute `StringIO`" on every re-exported name. - Configuration editor discard reporting: the webview previously told the host a preview was discarded only from the `<dialog>` `close` event, which Chromium dispatches on a queued element task — an occluded webview's throttled task queue can drop it, silently losing the discard and leaving the host holding a pending preview. The Cancel/Escape paths now post synchronously; the `close` listener remains as a guarded, double-post-proof fallback re-armed per preview state. - `.github/workflows/dependabot-automerge.yml`: the sweep no longer `git merge`s the whole bump branch into `dependabot-upgrades`. It copies exactly the PR's own changed paths (merge-base diff, deletions included) onto the live staging tip. A full merge of a security bump (based on current `main`) into a drifted staging branch dragged main's workflow-file edits along, and the push was rejected — the `workflows` scope cannot be granted to `GITHUB_TOKEN`. Path-copying makes the sweep immune to staging-branch drift while keeping clobber semantics (latest bump of a file wins) and the retry-on-race loop. - `make_custom_typeshed` test helper now emits one `VERSIONS` line per top-level module, so package stubs (`asyncio/__init__.pyi` + `asyncio/tasks.pyi`) can be modelled. ## How Do The Automated Tests Prove It Works? - `user_stub_star_reexport_from_stdlib_stub_is_captured` — mirrors micropython-esp32-stubs' `uio.pyi` verbatim; asserts `StringIO`/`BytesIO` land in the captured member API via the snapshot fallback. - `user_stub_star_reexport_follows_stdlib_package_reexports` — the chained `uasyncio.pyi` → `from asyncio import *` case; proves the walk keeps resolving the stdlib package's own relative re-exports (`from .tasks import *`) inside the snapshot. - `user_stub_star_reexport_honours_stdlib_dunder_all` — a stdlib stub's `__all__` stays authoritative across the boundary (`BytesIO` excluded when absent from `__all__`). - `user_stub_alias_reexport_from_stdlib_stub_is_captured` — the `from io import StringIO as StringIO` redundant-alias convention crosses the boundary too. - `user_stub_star_reexport_prefers_sibling_stub_over_snapshot` — guard: a sibling `machine.pyi` in the same stub dir shadows a same-named snapshot module; the snapshot is a fallback, never an override. - `cli_accepts_user_stub_reexports_from_the_custom_typeshed_stdlib` (e2e, real CLI) — the reporter's exact configuration (`stub-paths` and `typeshed-path` both at `typings/`) checks `uio.StringIO()`/`uio.BytesIO()` with exit code 0 and no `imports_module_attribute`. - "a dismissed rule preview discards the change and restores the control" (VSIX real-webview DOM test) — previously flaked under full-suite load because the queued `close` event never fired (instrumentation showed `dialog.open` flipping with zero `close` events delivered and no `cancelPreview` intent reaching the host). The driver now dismisses through the Cancel button exactly as a user would and the test passes deterministically — 793ms vs 5–6s before, since nothing waits on the throttled task queue. - The workflow change has no automated test (no harness for Actions runs); the sweep script's path-copy, deletion handling, drift immunity, and workflow-file guard were exercised in a scratch-repo simulation of both a security bump and a github-actions bump. ## Spec / Doc Changes `docs/specs/CHECKER-STUB-RESOLUTION-SPEC.md` ([STUBRES-PYI-REEXPORTS]): documents local-first star-target resolution with fallback to the active step-3 Typeshed source, recursive resolution within whichever source resolved each target, and sibling-shadowing semantics. The dependabot-automerge workflow's header comments were rewritten to describe the path-restricted sweep and the workflow-file constraint. ## Breaking Changes - [x] None --------- Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 1 update in the /vscode-extension directory: linkify-it.
Bumps the npm_and_yarn group with 1 update in the /website directory: linkify-it.
Updates
linkify-itfrom 5.0.1 to 5.0.2Changelog
Sourced from linkify-it's changelog.
Commits
50a0c915.0.2 releasedde3b885Update package hooks13effaaAdd package lock39d748dBump c800ce877Drop tlds depsecde823Update benchmark to mitata23c62cdRefactor demo / doc build and publishfd63f3bCI config updatef4ea5afdemo: update bootstrap & layout1454fb6lint: dim warningsUpdates
linkify-itfrom 5.0.1 to 5.0.2Changelog
Sourced from linkify-it's changelog.
Commits
50a0c915.0.2 releasedde3b885Update package hooks13effaaAdd package lock39d748dBump c800ce877Drop tlds depsecde823Update benchmark to mitata23c62cdRefactor demo / doc build and publishfd63f3bCI config updatef4ea5afdemo: update bootstrap & layout1454fb6lint: dim warningsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.