docs: bump the docs-deps group across 1 directory with 4 updates - #127
docs: bump the docs-deps group across 1 directory with 4 updates#127dependabot[bot] wants to merge 3 commits into
Conversation
|
Major-version bump — holding for human review. Auto-merge is limited to patch and minor updates. Reviewers assigned. See dependency changelog / release notes before merging. |
|
@dependabot rebase |
Bumps the docs-deps group with 4 updates in the /docs directory: [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight), [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro), [typescript](https://github.com/microsoft/TypeScript) and [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler). Updates `@astrojs/starlight` from 0.38.3 to 0.39.2 - [Release notes](https://github.com/withastro/starlight/releases) - [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md) - [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.39.2/packages/starlight) Updates `astro` from 6.1.7 to 6.3.1 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@6.3.1/packages/astro) Updates `typescript` from 5.9.3 to 6.0.3 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v5.9.3...v6.0.3) Updates `wrangler` from 4.90.0 to 4.90.1 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.90.1/packages/wrangler) --- updated-dependencies: - dependency-name: "@astrojs/starlight" dependency-version: 0.39.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docs-deps - dependency-name: astro dependency-version: 6.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docs-deps - dependency-name: typescript dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: docs-deps - dependency-name: wrangler dependency-version: 4.90.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: docs-deps ... Signed-off-by: dependabot[bot] <support@github.com>
602db1a to
7c98eb1
Compare
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
📝 WalkthroughWalkthroughBumped ChangesDependency & TS directive updates
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/package.json`:
- Line 26: The package.json now bumps "typescript" to ^6.0.3 but `@astrojs/check`
(the dependency named "@astrojs/check") is incompatible; before merging, upgrade
the "@astrojs/check" dependency to a release that declares a peerDependency
allowing TypeScript 6 (e.g., peerDependency "typescript": "^6.0.0" or compatible
range), update the package.json entry for "@astrojs/check" to that version, run
npm/yarn install and verify "astro check" completes without peer dependency
errors, and if needed update any related lockfile changes.
🪄 Autofix (Beta)
✅ Autofix completed
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 2f0d2a93-31d9-4124-ab3a-037c16a8ad10
⛔ Files ignored due to path filters (1)
docs/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
docs/package.json
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Fixes Applied SuccessfullyFixed 2 file(s) based on 1 unresolved review comment. Files modified:
Commit: The changes have been pushed to the Time taken: |
Fixed 2 file(s) based on 1 unresolved review comment. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/package.json`:
- Line 17: The package bump to "astro": "^6.3.1" may introduce breaking changes;
before updating the dependency string in package.json, review and adjust Astro
configuration: update any SVG image handling to the new svgOptimizer API
(replace uses of the experimental svgo flag), ensure SVG optimization is
explicitly enabled if needed, audit image configuration to add any external
hosts to image.remotePatterns or image.domains to avoid redirect errors, replace
static AstroCookies.consume(cookies) usage with the instance cookie API, and
verify that version 6.3.1 exists on npm; make these config/code changes
alongside the package.json version change.
- Around line 16-17: Your package.json currently allows TypeScript 6.x which
conflicts with Astro's language-tools; update the package.json devDependencies
to pin TypeScript to a 5.x range (e.g., ^5.0.0) instead of 6.x, then reinstall
dependencies to resolve `@astrojs/check` peerDependency errors; specifically edit
the "typescript" entry under devDependencies (and any CI/lockfile references) to
a 5.x version, run npm install (or pnpm install/yarn install) and verify there
are no peer dependency warnings from `@astrojs/check` or conflicting TypeScript
versions.
🪄 Autofix (Beta)
✅ Autofix completed
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: a134da16-caf6-4f57-b064-73f942f10c36
⛔ Files ignored due to path filters (1)
docs/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
docs/package.json
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Fixes Applied SuccessfullyFixed 3 file(s) based on 2 unresolved review comments. Files modified:
Commit: The changes have been pushed to the Time taken: |
Fixed 3 file(s) based on 2 unresolved review comments. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
|
@coderabbitai why is the review still not passing, I thought you pushed a fix? |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chainLet me check the current state of the PR and any remaining review issues. 🏁 Script executed: Length of output: 35185
The most recent review pass (after autofix commit [approve] |
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
## Summary Closes #130 (the title-length and admin-bypass halves; the go-mod-tidy half is intentionally deferred — manual `make tidy && go mod tidy` after a failing CI run is the accepted workflow). `admin-approval.yml` previously short-circuited to `success` for **all** Dependabot PRs, on the assumption that "no bot approves itself + no auto-merge enabled = major bumps will sit." That assumption broke once CodeRabbit started auto-approving Dependabot PRs after autofixes. PR #127 (major-bump: TypeScript 5→6, Astro 5→6, etc.) reached `mergeStateStatus: CLEAN, reviewDecision: APPROVED` — one click from main — with no admin review: - CodeRabbit's `APPROVED` review satisfied the ruleset's `required_approving_review_count: 1` - The unconditional bypass posted `Admin approval: success` - CI was green ## Changes ### `admin-approval.yml` - New `Fetch Dependabot metadata` step at the top, gated on Dependabot author (`continue-on-error: true` so a metadata fetch failure on a Dependabot PR fail-safes to "no bypass" rather than erroring the workflow). - Bypass logic now only fires when `update-type` is `version-update:semver-patch` or `version-update:semver-minor`. Majors, unknown types, and empty `UPDATE_TYPE` (metadata fetch failed) fall through to the same admin-review evaluation as human PRs. - Updated header comment + inline comments to explain the new model and reference #130 / #127 as the trigger. ### `housekeeping.yml` - PR title length check (72-char cap) now exempts Dependabot. Format regex is still enforced; Dependabot's grouped-update titles already use lowercase `deps:` / `ci:` / `docs:` prefixes, so they pass naturally. Fixes the half of #130 about title-length blocking grouped bumps (e.g., #128's 80-char title). ### `AGENTS.md` - Three passages updated to reflect "Dependabot patch/minor PRs bypass; majors require admin review same as human PRs." - New note in the Dependabot section explaining that `required_approving_review_count: 0` in the ruleset is intentional — the `Admin approval` status check is the single admin-review gate, so any bot's `APPROVED` review is no longer load-bearing. ## Ruleset change (manual, after merge) The workflow changes alone close the security hole (majors now post `Admin approval: pending`, blocking merge). The ruleset count-rule change is **defense-in-depth** — without it, CodeRabbit's approval can still satisfy `count: 1` on a major bump even though the `Admin approval` status is now correctly pending. Easiest path is the GitHub UI: **Settings → Rules → main branch protection (ruleset 15353356) → Require a pull request before merging → set "Required approving reviews" to 0**. All other rule params should stay unchanged — especially `dismiss_stale_reviews_on_push: true`, `strict_required_status_checks_policy: true`, the required status checks list, and the admin bypass actor. (`gh api` works too but requires fetching the current ruleset, modifying the `required_approving_review_count` field inside the `pull_request` rule, and PUT-ing the full payload back. The UI is one click.) ## Behavior matrix after this PR (workflow only, before ruleset change) | PR type | Title cap | Admin approval status | Count rule | Merges? | |---|---|---|---|---| | Dependabot patch | exempt | success (bypassed) | bot self-approval | yes, auto | | Dependabot minor | exempt | success (bypassed) | bot self-approval | yes, auto | | Dependabot major (no admin) | exempt | **pending** | CodeRabbit may satisfy | **blocked** by status | | Dependabot major (admin approved) | exempt | success | yes | yes, manual | | Human PR (no admin) | 72-char | pending | — | blocked | | Human PR (admin approved) | 72-char | success | yes | yes, manual | After the ruleset change (count → 0), the third row stays blocked regardless of CodeRabbit's approval state, closing the defense-in-depth gap. ## Test plan - [ ] Once merged, next Monday's Dependabot patch/minor bumps auto-merge as before (no regression on the auto-merge path). - [ ] Open a draft test PR with an 80-char title to verify the title-cap exemption only applies to Dependabot (i.e., human long-title still fails). - [ ] On the next major-version Dependabot PR: confirm `Admin approval` status posts `pending` and the PR is blocked until an admin approves. - [ ] Apply ruleset change (`count: 0`) and verify the same major PR remains blocked even if CodeRabbit's review is `APPROVED`. ## Notes - I considered also touching `housekeeping.yml`'s reviewer-assign skip-for-Dependabot logic, but it's still correct: `dependabot-automerge.yml` already assigns both admins on majors, so housekeeping's skip avoids a double-request. Left as-is. - The CodeRabbit dashboard switch (from `APPROVED` to `COMMENTED`) is intentionally NOT part of this PR — it's a separate dashboard setting, not a repo change. 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Refined automated dependency update workflows with improved approval handling for different update types. * Enhanced pull request validation to better support automated dependency changes while maintaining code quality standards. * Updated development governance documentation with clearer guidelines and more explicit rules for approval processes and automation. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/Wave-RF/WaveHouse/pull/134) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
@dependabot rebase |
|
Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry! If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request |
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
Bumps the docs-deps group with 4 updates in the /docs directory: @astrojs/starlight, astro, typescript and wrangler.
Updates
@astrojs/starlightfrom 0.38.3 to 0.39.2Release notes
Sourced from @astrojs/starlight's releases.
... (truncated)
Changelog
Sourced from @astrojs/starlight's changelog.
... (truncated)
Commits
76ff51e[ci] release (#3891)2d05e18Make sure to enabletext-autospaceeven in non-Firefox browsers (#3890)0c0acc0[ci] release (#3886)b3c6990Add new icons to Starlight’s built-in set (#3887)010eed1fix: update the version mentioned inautogenerateerror message (#3885)c89c144[ci] release (#3883)dcf6d09Refactor autogenerated sidebar groups (#3618)6672c35Update i18next (#3858)6b18976[ci] format417a66cEnabletext-autospacein Chinese and Japanese documents (#3872)Updates
astrofrom 6.1.7 to 6.3.1Release notes
Sourced from astro's releases.
... (truncated)
Changelog
Sourced from astro's changelog.
... (truncated)
Commits
868892b[ci] release (#16651)8abfc7d[ci] format15fbc41Skip isRemoteAllowed check for local images in generic endpoint (#16646)4886184test: merge astro-assets-prefix test files into one (#16645)c397908[ci] format5311b78test: parallel testing (#16382)2ffa0ba[ci] release (#16596)c68a9dafix(docs): missing version and verb tense (#16632)f54be80fix(logger): add flush/close to AstroIntegrationLogger (#16629)9c6efc5Escape interpolated values in redirect HTML template (#16592)Updates
typescriptfrom 5.9.3 to 6.0.3Release notes
Sourced from typescript's releases.
Commits
050880cBump version to 6.0.3 and LKGeeae9dd🤖 Pick PR #63401 (Also check package name validity in...) into release-6.0 (#...ad1c695🤖 Pick PR #63368 (Harden ATA package name filtering) into release-6.0 (#63372)0725fb4🤖 Pick PR #63310 (Mark class property initializers as...) into release-6.0 (#...607a22aBump version to 6.0.2 and LKG9e72ab7🤖 Pick PR #63239 (Fix missing lib files in reused pro...) into release-6.0 (#...35ff23d🤖 Pick PR #63163 (Port anyFunctionType subtype fix an...) into release-6.0 (#...e175b69Bump version to 6.0.1-rc and LKGaf4caacUpdate LKG8efd7e8Merge remote-tracking branch 'origin/main' into release-6.0Updates
wranglerfrom 4.90.0 to 4.90.1Release notes
Sourced from wrangler's releases.
Commits
b7d79a9Version Packages (#13859)b0cee1d[wrangler] fix: suppress status badge when printBanner returns false (#13837)d878e13[wrangler] Fix remote bindings hanging on shutdown (#13887)4e44ce6chore(deps): bump the workerd-and-workers-types group with 2 updates (#13866)971dfe3[wrangler] Fix races in RemoteProxySession reload and remote tail WebSocket (...Summary by CodeRabbit