Weekly dependency upgrade (2026-08-23) - #668
Merged
Merged
Conversation
hono 4.13.1 -> 4.13.3, mapbox-gl 3.28.1 -> 3.29.0, lucide-react 1.31.0 ->
1.33.0, input-otp 1.4.2 -> 1.5.0, sonner 2.0.7 -> 2.0.8, shadcn 4.16.2 ->
4.19.0, @turf/{bbox,bearing,helpers} 7.3.5 -> 7.4.0, vitest 4.1.10 -> 4.1.11,
@types/react 19.2.2 -> 19.2.18, @types/react-dom 19.2.1 -> 19.2.5, @types/bun
1.3.14 -> 1.4.0. All drop-in patch/minor releases verified against
typecheck:all and test:all.
better-auth stays on 1.6.26 despite an in-range 1.7.1 — its changelog
requires a new Account.issuer column with manual identity-collision backfill
before deploying, which this comp uses social sign-in against, so it needs a
focused PR rather than a routine bump.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xs5DzKKdqznSNF1WFjZepj
…ance The routine's own instruction to force a stuck version with `bun update --filter '<workspace>' <pkg>` didn't hold this cycle: run from the repo root, it left the target workspace's package.json untouched and added several packages as stray new root dependencies instead — the exact failure --filter is meant to prevent. Correct the guidance to cd into the workspace directory instead, which resolved cleanly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xs5DzKKdqznSNF1WFjZepj
|
Preview Deployment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Routine weekly dependency upgrade. Bumps a batch of in-range patch/minor dependencies across the root and every workspace, and fixes a stale instruction in the upgrade routine itself discovered while running it.
Map.addSourceTyperemoval) is unusedbun auditis unchanged before/after: 3 pre-existing, already-deferred Astro XSS advisories (fixed only in Astro 7.x — not exploitable here, no View Transitions or dynamic spread attributes in the static pages). No new vulnerabilities this cycle.Deliberately not upgraded:
better-auth1.6.26 → 1.7.1 is in-range but its 1.7.0 release notes document several changes explicitly as breaking despite the minor version number — most importantly a required newAccount.issuercolumn with a manual identity-collision backfill, which applies here since this comp usessocialProviders. That needs a focused PR with a deliberate migration step, not a routine bump.wranglerstays capped at 4.116.0 (still the last release on stable, non-alphaminiflare, re-checked through 4.125.0). Full reasoning for every deferred package is in the log entry.Also fixes a stale line in
.claude/commands/upgrade-deps.md: its own guidance to force a stuck version with abun update --filtercall for a given workspace and package, run from the repo root, didn't hold this cycle — it left the target workspace'spackage.jsonuntouched and added several packages as new stray root dependencies instead. Corrected tocdinto the workspace directory and runbun updatefrom there.See the full write-up:
docs/dependency-review-log.md§ 2026-08-23Branch preview: https://claude-awesome-galileo-0vf6n.glidecomp.pages.dev
Test plan
bun run typecheck:all— all 6 workspace typechecks passbun run test:all— root/engine/airscore-api/dev-router/scripts + 724 frontend + 104 auth-api (6 todo) + 769 competition-api all passbun run test:e2e— 175 passed, 6 skipped, clean run, no flakesbun run test:e2e:ssr— 38/38 passed, clean, no flakesbun audit— 3 vulnerabilities before and after (all pre-existing, deferred, not exploitable)