chore(deps): update non-major dependencies - #1703
Merged
Merged
Conversation
Refresh age-eligible direct deps (MUI 9.3, React 19.2.8, Vite 8.2.1, Biome 2.5.7, Vitest 4.1.10, TanStack Query/Router/Start patches), pnpm 11.20.0, and GitHub Action pins. Override nanoid to 3.3.18 for GHSA-2v37-7h3g-55p8. Retarget the Netlify edge-functions-dev fetch patch to 1.0.23.
UseFormHandleSubmit now returns Promise<unknown> instead of Promise<void>. Alias FormTriggerSubmit to the library type so tsc passes after the 7.74 → 7.84 bump.
✅ Deploy Preview for aptos-explorer ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
gregnazario
marked this pull request as ready for review
August 12, 2026 22:13
✅ Deploy Preview for aptos-explorer ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1703 +/- ##
==========================================
+ Coverage 35.87% 35.89% +0.01%
==========================================
Files 202 202
Lines 9563 9565 +2
Branches 3742 3742
==========================================
+ Hits 3431 3433 +2
Misses 6116 6116
Partials 16 16 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Bundle ReportChanges will increase total bundle size by 66.93kB (0.64%) ⬆️. This is within the configured threshold ✅ Detailed changes
Affected Assets, Files, and Routes:view changes for bundle: aptos-explorer-client-esmAssets Changed:
Files in
view changes for bundle: aptos-explorer-server-esmAssets Changed:
|
Pin SAFE_CHAIN_MINIMUM_PACKAGE_AGE_HOURS=48 in the setup action and document the no-bypass rules: never skip the age gate, never widen exclusions past @aptos-labs/*, and re-scan lockfile tarballs through Safe Chain after dependency bumps.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Refresh age-eligible non-major npm dependencies (5-day
minimumReleaseAge), matching the Renovateall-minor-patchgrouping, plus related lockfile / CI pins.The lockfile was re-fetched through Aikido Safe Chain (same wrapper CI uses): 1057 packages scanned, no malware found. Safe Chain's 48-hour minimum package age is now set explicitly in
.github/actions/setup-node-pnpm, with@aptos-labs/*as the only age-check exclusion. Agent docs (AGENTS.md, modernizer/reviewer rules) forbid skipping the age gate or widening that exclusion list.Direct bumps (selected)
@mui/material/@mui/icons-material9.0.1→9.3.1react-dom19.2.5→19.2.88.2.0→8.2.12.4.9→2.5.7(config:recommended: true→preset: "recommended")@vitest/coverage-v8→ pinned4.1.10(coverage was previously a^range)5.100.11→5.101.4react-router1.170.23,react-start1.168.40,router-plugin1.168.27,router-cli1.167.25)1.59.1→1.62.1react-hook-form7.74.0→7.84.0,date-fns4.4.0,es-toolkit1.50.0,@tanstack/react-virtual3.14.9@netlify/vite-plugin-tanstack-start1.3.5→1.3.1711.9.0→11.20.0Overrides / tooling
nanoid@3.3.18override for GHSA-2v37-7h3g-55p8axios@1.19.0,js-yaml@5.2.3,postcss@8.5.26,h3@2.0.1-rc.26minimumReleaseAgeExcludeentriesactions/checkoutv7.0.1,pnpm/action-setupv6.0.10@netlify/edge-functions-devduplex: "half"fetch patch from1.0.16→1.0.23SAFE_CHAIN_MINIMUM_PACKAGE_AGE_HOURS=48(explicit) +SAFE_CHAIN_MINIMUM_PACKAGE_AGE_EXCLUSIONS=@aptos-labs/*Code fix
FormTriggerSubmitin the modules View/Run form now aliasesUseFormHandleSubmitso TypeScript acceptsreact-hook-form7.84'sPromise<unknown>submit return type.Intentionally skipped
pako3,undici8,fast-uri4,@babel/core8,@aptos-labs/wallet-standard2,@types/jsdom30minimumReleaseAge, which is stricter than Safe Chain's 48h):@aptos-labs/ts-sdk7.3.0, Biome2.5.8, latest TanStack Router/Start patches,react-hook-form7.85.0,@scure/base2.3.0,esbuild0.28.2image-size(claimed>=2.0.3unpublished),extract-zip(claimed>=2.0.2unpublished) — both transitive via Netlify local toolingRelated Links
Supersedes the stale Renovate group PR in spirit: #1557 (
renovate/all-minor-patch).Checklist
[Unreleased]updatedpublic/llms-full.txtTechnical Stack: MUI v7 → v9pnpm fmt/pnpm lint(tsc + biome)pnpm test --run— 945 passed, 1 skippedpnpm build— production client + SSR build succeeded