Repository navigation
chore(deps): apply pending Dependabot updates - #118
Merged
Merged
Conversation
@types/node, @typescript-eslint/*, eslint, globals, inquirer, prettier, cssnano, jsdom, postcss and rollup to their latest minor/patch releases.
Only a root devDependency; nothing in the repo imports it, so the v17 default of logging on config() has no effect.
…rsedes #101) The search UI already moved to typesense-js 3.0.6 (b4fec95) and keeps its exact pin. This brings the indexer (core), the config peer range and the playground seed script onto the same major. Core only uses collections().retrieve/create/delete and documents() import/upsert/delete, whose signatures are unchanged. Checked against a Typesense 28 server: create/recreate, paginated bulk import (including a rejected document), single-post upsert, gated-post and explicit delete, and clear give the same results as 1.8.2.
No test changes needed; all five workspaces pass unchanged.
Drops the last copy of esbuild <= 0.24.2 (pulled in by vite 5), which Dependabot flagged for its dev server answering cross-origin requests. vite.config.js uses import.meta.dirname instead of __dirname, which vite 8 warns is unsupported by its upcoming native config loader.
turbo 2 renamed the turbo.json "pipeline" key to "tasks", which is why #105 failed CI. Also: - envMode "loose": turbo 2 defaults to strict and would hide undeclared environment variables from tasks (e.g. TYPESENSE_* for the playground seed). Loose keeps the turbo 1 behaviour. - agentGuidance false: otherwise turbo writes an AGENTS.md into the repo root whenever it detects an AI coding agent.
Lockfile only (npm audit fix, no --force). axios 1.19 -> 1.20 is the one that ships: typesense-js bundles it into search.min.js (+2.9 kB) and the indexer uses it at runtime. svgo, brace-expansion and colord are build tools. The remaining moderate findings all sit under rollup-plugin-postcss's bundled cssnano 6 and only process our own stylesheet at build time.
|
Warning Review limit reached
This review includes 10 billable files and costs up to $2.50.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Or wait 15 minutes for your next included review. View limit details
Comment |
This was referenced Oct 13, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #97, #98, #100, #101, #102, #103, #104, #105, #107. Dependabot closes those on its own once this lands. #99 (TypeScript 7) is not included; see below.
What
One commit per Dependabot PR, applied to current
mainand re-resolved, so a few versions are newer than in the original PRs:@types/node)@rollup/plugin-terser0.4 → 1.0@rollup/plugin-commonjs25 → 293.0.6pin from b4fec95vite.config.jsusesimport.meta.dirnamepipeline→tasks(why #105 failed CI),envMode: "loose",agentGuidance: falsePlus
npm audit fix(lockfile only, no--force) and CHANGELOG entries.Why
main, the esbuild alert comes from vite 5 in the playground; vite 8 removes it. The form-data and tar-fs alerts point at versionsmain's lockfile no longer contains (form-data is already 4.0.6, tar-fs is gone), so they should close on the next scan.npm auditalso listed axios ≤ 1.19 advisories. typesense-js bundles axios intosearch.min.jsand the indexer uses it, so it ships. It now resolves to 1.20.TYPESENSE_*, so loose mode keeps the turbo 1 behaviour.agentGuidance: falsestops turbo writing anAGENTS.mdinto the repo root when it detects an AI coding agent.^3.1.1, so a project installing it next to typesense-js 1.x gets a peer conflict.Not included: TypeScript 7 (#99)
Its CI failed with
ERESOLVE: typescript-eslint (latest 8.71.2) declarestypescript >=4.8.4 <6.1.0. TypeScript 7 is the Go port and lacks the JS compiler API that typescript-eslint and tsup's d.ts build use. #99 stays open until typescript-eslint supports it.Verification
npm ci, thennpm run lint,typecheck,testandbuildat the root. Tests: search-ui 290, config 18, core 23, webhook 5, cli 3, all passing. Each commit was checked the same way before the next one.search.min.jsis 214,335 bytes, up from 211,199 (axios). Opened the playground on vite 8 against a seeded Typesense 28 and searched "ghost" in modal, palette and discovery: 4 results in each, with highlights, gated badges and the discovery preview. Author profiles also work against the mock backend.turbo run test --dry=jsonreportsenvMode: loose, and noAGENTS.mdappears after turbo runs.Found while testing, not changed here: when one document in a bulk import is rejected, typesense-js throws for the whole batch, and core then reports
0 succeeded, 20 failedeven though 19 were indexed. It behaves the same on 1.8.2 and 3.1.