Skip to content

chore: bump dependabot dependencies - #353

Merged
DanWebb merged 3 commits into
mainfrom
chore/dependabot-bundle
Oct 8, 2026
Merged

DanWebb merged 3 commits into
mainfrom
chore/dependabot-bundle

Conversation

@DanWebb

@DanWebb DanWebb commented Oct 7, 2026 •

Copy link
Copy Markdown
Member

Summary

Twelve dependabot PRs are open. This PR applies their updates in one change.

  • The lockfile updates js-yaml, axios, joi, brace-expansion, source-map-js, svgo, browserslist, fast-uri, nanoid, postcss-selector-parser, immutable and ws. Each one is at or above the dependabot target version.
  • The lockfile on main no longer contains npm or tar. Commit bb28098 removed them. chore: bump tar and npm #338 has nothing left to update.
  • @svgr/webpack stays on 5.5.0. Version 8 breaks the Icon component. Webpack fails to resolve the inline loader query in Icon.tsx. Without that query, svgo 3 rejects the .svgo.yml file that ships with mono-icons. chore: bump svgo and @svgr/webpack #343 stays open for a separate migration.
  • The svgo copy under postcss-svgo goes to 2.8.4. The svgo 1.3.2 copy under @svgr/webpack 5 remains. Icon disables svgo for that loader.

Closes #333
Closes #336
Closes #338
Closes #339
Closes #340
Closes #341
Closes #342
Closes #347
Closes #348
Closes #349
Closes #350
Closes #352

Testing

npm run build exits with code 0. npm run build-storybook exits with code 0. npm run lint reports one error in Section.stories.tsx. The same error occurs on main.

Bundles the open dependabot updates into one change.
@mergify
mergify Bot requested review from a team and ella-etch and removed request for a team October 7, 2026 15:30
@mergify mergify Bot assigned DanWebb Oct 7, 2026
@mergify
mergify Bot requested a review from a team October 7, 2026 15:31
@github-actions

github-actions Bot commented Oct 7, 2026 •

Copy link
Copy Markdown

🦙 MegaLinter status: ✅ SUCCESS

Descriptor Linter Files Fixed Errors Elapsed time
✅ EDITORCONFIG editorconfig-checker 1 0 0.0s
✅ JSON jsonlint 1 0 0.19s
✅ JSON npm-package-json-lint yes no 0.39s
✅ JSON prettier 1 0 1.06s
✅ JSON v8r 1 0 2.38s
✅ REPOSITORY checkov yes no 12.66s
✅ REPOSITORY gitleaks yes no 4.34s
✅ REPOSITORY git_diff yes no 0.05s
✅ REPOSITORY secretlint yes no 1.02s
✅ REPOSITORY trivy-sbom yes no 1.96s
✅ REPOSITORY trufflehog yes no 3.02s

See detailed report in MegaLinter reports
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by OX Security

svgr 8 breaks the inline loader query in Icon and the mono-icons svgo config.
npm 10 needs this entry for npm ci on Node 18.
@mergify
mergify Bot requested review from a team and JoshTheWanderer and removed request for a team October 8, 2026 09:05
@DanWebb
DanWebb merged commit 2e22eb6 into main Oct 8, 2026
14 checks passed
@DanWebb
DanWebb deleted the chore/dependabot-bundle branch October 8, 2026 09:32
DanWebb pushed a commit that referenced this pull request Oct 23, 2026
## <small>9.4.1 (2026-10-23)</small>

* Merge pull request #334 from etchteam/mergify/configuration-deprecated-update ([6042157](6042157)), closes [#334](#334)
* Merge pull request #353 from etchteam/chore/dependabot-bundle ([2e22eb6](2e22eb6)), closes [#353](#353)
* Merge pull request #357 from etchteam/dependabot/npm_and_yarn/follow-redirects-1.16.1 ([8bff529](8bff529)), closes [#357](#357)
* Merge pull request #358 from etchteam/fix/checkbox-ref-unmount ([9712883](9712883)), closes [#358](#358)
* fix: pass null to combined refs on unmount ([8cba5a4](8cba5a4))
* chore: bump dependabot dependencies ([f95b5ac](f95b5ac))
* chore: bump follow-redirects from 1.16.0 to 1.16.1 ([4802969](4802969))
* chore: keep @svgr/webpack on 5.5.0 ([fc2f63c](fc2f63c))
* chore: restore stylelint typescript peer in lockfile ([391436c](391436c))
* ci(mergify): upgrade configuration to current format ([08a419d](08a419d))
@DanWebb

DanWebb commented Oct 23, 2026

Copy link
Copy Markdown
Member Author

🎉 This PR is included in version 9.4.1 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Development

Successfully merging this pull request may close these issues.

2 participants