chore(deps): bump the all-dependencies group across 1 directory with 6 updates - #369
Open
dependabot[bot] wants to merge 1 commit into
Conversation
…6 updates Bumps the all-dependencies group with 6 updates in the /packages/x402-facilitator-node directory: | Package | From | To | | --- | --- | --- | | [@hono/node-server](https://github.com/honojs/node-server) | `2.0.8` | `2.1.0` | | [hono](https://github.com/honojs/hono) | `4.12.34` | `4.13.1` | | [viem](https://github.com/wevm/viem) | `2.54.6` | `2.55.11` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.0` | `26.1.2` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.0` | `4.23.11` | | [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` | Updates `@hono/node-server` from 2.0.8 to 2.1.0 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v2.0.8...v2.1.0) Updates `hono` from 4.12.34 to 4.13.1 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.34...v4.13.1) Updates `viem` from 2.54.6 to 2.55.11 - [Release notes](https://github.com/wevm/viem/releases) - [Commits](https://github.com/wevm/viem/compare/viem@2.54.6...viem@2.55.11) Updates `@types/node` from 26.1.0 to 26.1.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `tsx` from 4.23.0 to 4.23.11 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.0...v4.23.11) Updates `typescript` from 6.0.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) --- updated-dependencies: - dependency-name: "@hono/node-server" dependency-version: 2.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: hono dependency-version: 4.13.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: viem dependency-version: 2.55.11 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: "@types/node" dependency-version: 26.1.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: tsx dependency-version: 4.23.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: all-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
the
dependencies
dependabot
Bot
added
dependencies
clestons
requested changes
Aug 10, 2026
clestons
left a comment
clestons
left a comment
Collaborator
There was a problem hiding this comment.
❌ REQUEST_CHANGES — AAStarCommunity/SuperPaymaster#369 [2-round(依赖 bump)]
锁文件本身是干净的:全部 resolution 都是 sha512 integrity,没有任何 registry 切换或明文 http://(registry.npmmirror / registry.npm.taobao / http:// 全仓 diff 计数 = 0),viem / abitype / ox 都按新 TS 版本重解析了 peer,前后一致。
但这一组 6 个更新里,有一个是大版本:
- "typescript": "^6.0.3",
+ "typescript": "^7.0.2",而它同时踩中了两件本该拦住它的机制,两件都没响。
🔴 ① 六个绿勾没有一个覆盖被改的这个包
PR 上的 checks:Scan for Private Keys / Stage 1 — solhint + build (EIP-170) / Stage 2 — forge test + fuzz / auto-merge / cla-check / test —— 全是 Foundry/Solidity + 密钥扫描 + CLA。
我把 head 上全部 7 个 workflow 逐个拉下来数过:
abi-docs / check-secrets / ci-required-shim / security / test / dependabot-auto-merge / cla
→ 提到 "x402" 的:0 个
→ 跑 tsc / typecheck / vitest / pnpm test 的:0 个
abi-docs.yml 确实用 pnpm,但它跑的是 forge build + pnpm gen:abi-docs:check(仓库根),和这个包无关。
而这个包自己是有那些脚本的:
"build": "tsc", "typecheck": "tsc --noEmit", "test": "vitest run"三条都在,只是从来没有人在 CI 里跑。 于是一次 TypeScript 大版本升级(strict: true、moduleResolution: bundler、declaration: true 的一个包)在零验证的情况下走向 main —— 而这个包是 x402-facilitator:settle.ts / quote.ts / verify-sig.ts / hmac-challenge.ts,签名校验和结算。
最低限度的要求:在这个 PR 上跑一次
pnpm -F x402-facilitator-node install && pnpm -F x402-facilitator-node typecheck && pnpm -F x402-facilitator-node test把输出贴上来。更好的做法是顺手给它加一个 Node job —— 否则下一个依赖 PR 还是这样。
🔴 ② 仓库自己那道「major 必须人工过目」的闸,对分组 PR 不响
dependabot-auto-merge.yml 写得很清楚:
# major version bump: label for manual review, never auto-merge.
- name: Label major update for manual review
if: steps.meta.outputs.update-type == 'version-update:semver-major'
run: gh pr edit "$PR_URL" --add-label "dependencies,major-update"而这个 PR 的实际状态:
labels: ["dependencies", "javascript"] ← 没有 major-update
autoMergeRequest: null ← 也没排上 auto-merge
reviews: [] ← 也没有自动 approve
三个条件步骤一个都没执行 —— 也就是说 steps.meta.outputs.update-type 既不是 major 也不是 patch/minor。分组更新(the all-dependencies group … with 6 updates)落在了这三条判据的缝里。
今天这个缝是朝安全那边掉的(什么都没自动合),这点要说清楚,不是在报一个正在冒烟的洞。但净效果是:那道专门为「major 要人工看」而设的闸,对 dependabot 现在默认使用的分组模式是瞎的 —— 而这个 PR 就是证据:它带着一个 TS 大版本,标签上却只有 dependencies / javascript,任何按 major-update 标签筛 PR 的人都看不到它。
改法:给那个 workflow 补一条兜底 —— update-type 为空(分组 PR)时,一律走「打标签 + 不自动合」;或者用 steps.meta.outputs.dependency-names 里逐个包的版本变化自己判一次。
一条建议
如果只是想让这 5 个 minor/patch 尽快进去,最省事的是让 dependabot 把 typescript 从分组里摘出去(groups.*.exclude-patterns 或给它单独一个 group)—— 大版本单独一个 PR,上面那道闸就能正常认出它,人也知道该盯哪一个。
本轮实际跑了什么(不虚标)
- R1a/R1b(DeepSeek-v4-flash):各 0 条,双双判
trivial/clean。这次是漏,不是对 —— 我按依赖 PR 的规矩把package.json和锁文件里被 bump 的那几个包的行一起喂进去了,"typescript": "^6.0.3" → "^7.0.2"就在它眼前,它没识别出这是大版本。(它还把锁文件说成package-lock.json,而这个仓库用的是pnpm-lock.yaml。) - 我自己(工具实证):
gh pr checks列出 6 个绿勾并逐个看清是哪些 job ·gh api .../git/trees?recursive=1+ 逐文件 base64 解码,统计 7 个 workflow 里x402/tsc|typecheck|vitest|pnpm test的出现次数(0 / 0)· 读该包package.json确认build/typecheck/test三个脚本都在 · 读tsconfig.json(strict/bundler/declaration)·gh pr view --json labels,autoMergeRequest,reviews拿到实际标签与自动合并状态,据此判定三个条件步骤都没执行 · 读dependabot-auto-merge.yml全文核对三条判据 · 全 diff grepregistry.npmmirror|registry.npm.taobao|http://= 0。 - R2/R3/R4 未跑 —— 依赖 bump,按既定规则不跑 Codex PK;两条 finding 都是
gh api+ grep 直接可判的事实,没有需要对抗验证的推断。
PR-Daemon v4 · R1a/R1b=deepseek-v4-flash · R2/R3/R4 未跑(依赖 bump)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the all-dependencies group with 6 updates in the /packages/x402-facilitator-node directory:
2.0.82.1.04.12.344.13.12.54.62.55.1126.1.026.1.24.23.04.23.116.0.37.0.2Updates
@hono/node-serverfrom 2.0.8 to 2.1.0Release notes
Sourced from @hono/node-server's releases.
... (truncated)
Commits
82ba34e2.1.01f2909afix(listener): avoid uncaught error when force-closing a non-standard socket ...977a242feat: add Early Hints (HTTP 103) middleware (#378)a813b6c2.0.12caf48bafix(response): copy headers when init is a foreign Response (#382)3b1dd68test: replace supertest (#379)834e54f2.0.11ba72bcdperf(request): fast-path PATCH method (#380)962baa4perf(request): fast-path QUERY methods (#376)62284d6test: use a custom helper for path traversal tests (#377)Updates
honofrom 4.12.34 to 4.13.1Release notes
Sourced from hono's releases.
... (truncated)
Commits
cf785284.13.1f6aa913fix(etag): skip unsafe methods or error responses on non-* case (#5196)cd31bc1fix(utils/stream): re-acquire writer lock when pipe() throws (#4988)569b419fix(trie-router): count every slash a pattern consumes (#5189)192768f4.13.0b0c2d90Merge pull request #5154 from honojs/next8f07028fix(compress): set Vary: Accept-Encoding on negotiated responses (#5137)8a0b18ffeat(reg-exp-router): throw UnsupportedPathError during route registration (#...3feb355fix(jsx): allow a function component to return an array (#5179)5d911d2feat(utils/headers): add HTTP fields newly registered with IANA (#5153)Updates
viemfrom 2.54.6 to 2.55.11Release notes
Sourced from viem's releases.
... (truncated)
Commits
ad1deadchore: version package (#4959)fca3ff5fix: default uint/int size in validateTypedData (#4961)f05ae7efix: withRetry hanging when retry callbacks throw (#4949)7f3bff5feat(chains): add missing USDC addresses (#4963)87067c2Update story and storyAeneid chain definitions (#4955)80d1063test(tempo): use native t10 zone genesis (#4962)3fe8f4bfix(tempo): refresh Earn contract interfaces (#4958)3304d2efix(tempo): respect token metadata batching config (#4956)88d68aachore: update vocs to 2.8.1 (#4947)b069264ci: fix docs buildUpdates
@types/nodefrom 26.1.0 to 26.1.2Commits
Updates
tsxfrom 4.23.0 to 4.23.11Release notes
Sourced from tsx's releases.
... (truncated)
Commits
bd3bc64test: cover CommonJS loader source fallback55cbecefix: preserve async ESM require fallback6c5ba85docs: document CommonJS default interopec1bcd5fix: support nyc coverage discovery (#710)b6e5b48docs: clarify CommonJS default imports2f55884fix: map Node test locationsde935d5docs: document Node source-map stack formattingb94f46ffix: support data URLs in tsImportbe1315efix: preserve package subpath resolution5efba41docs: organize transform backend researchUpdates
typescriptfrom 6.0.3 to 7.0.2Commits
Maintainer changes
This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions