Skip to content

fix(deps): update all dependencies#20

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all
Open

fix(deps): update all dependencies#20
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all

Conversation

@renovate

@renovate renovate Bot commented Feb 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@biomejs/biome (source) ^2.4.4 → ^2.5.0 age confidence devDependencies minor
@changesets/changelog-github (source) ^0.5.2 → ^0.7.0 age confidence devDependencies minor
@changesets/cli (source) ^2.29.8 → ^2.31.0 age confidence devDependencies minor
@eslint-community/eslint-plugin-eslint-comments ^4.6.0 → ^4.7.2 age confidence devDependencies minor
@eslint/compat (source) 2.0.2 → 2.1.0 age confidence devDependencies minor
@eslint/eslintrc 3.3.3 → 3.3.5 age confidence devDependencies patch
@types/node (source) ^24.10.13 → ^24.13.2 age confidence devDependencies minor
@typescript-eslint/eslint-plugin (source) ^8.56.0 → ^8.61.1 age confidence devDependencies minor
@typescript-eslint/parser (source) ^8.56.0 → ^8.61.1 age confidence devDependencies minor
@vitest/coverage-v8 (source) ^4.0.18 → ^4.1.9 age confidence devDependencies minor
@vitest/eslint-plugin ^1.6.9 → ^1.6.20 age confidence devDependencies patch
actions/checkout v6 → v7 age confidence action major
actions/upload-artifact v6 → v7 age confidence action major
effect (source) ^3.19.18 → ^3.21.4 age confidence dependencies minor
eslint (source) ^10.0.1 → ^10.5.0 age confidence devDependencies minor
eslint-import-resolver-typescript ^4.4.4 → ^4.4.5 age confidence devDependencies patch
eslint-plugin-simple-import-sort ^12.1.1 → ^13.0.0 age confidence devDependencies major
eslint-plugin-sonarjs (source) ^4.0.0 → ^4.1.0 age confidence devDependencies minor
eslint-plugin-unicorn ^63.0.0 → ^68.0.0 age confidence devDependencies major
globals ^17.3.0 → ^17.6.0 age confidence devDependencies minor
jscpd (source) ^4.0.8 → ^5.0.11 age confidence devDependencies major
node 24.13.1 → 24.17.0 age confidence uses-with minor
pnpm (source) 10.30.1 → 11.8.0 age confidence packageManager major
pnpm/action-setup v4 → v6 age confidence action major
pnpm/action-setup v3 → v6 age confidence action major
typescript (source) ^5.9.3 → ^6.0.3 age confidence devDependencies major
typescript-eslint (source) ^8.56.0 → ^8.61.1 age confidence devDependencies minor
vite (source) ^7.3.1 → ^8.0.16 age confidence devDependencies major
vitest (source) ^4.0.18 → ^4.1.9 age confidence devDependencies minor

cc @skulidropek

Release Notes

biomejs/biome (@​biomejs/biome)

v2.5.0

Compare Source

Minor Changes

  • #​9539 f0615fd Thanks @​ematipico! - Added a new reporter called concise. When --reporter=concise is passed the commands format, lint, check and ci, the diagnostics are printed in a compact manner:

    ! index.ts:2:10: lint/correctness/noUnusedImports: Several of these imports are unused.
! main.ts:9:7: lint/correctness/noUnusedVariables: This variable f is unused.
× index.ts:8:5: lint/suspicious/noImplicitAnyLet: This variable implicitly has the any type.
× main.ts:2:10: lint/suspicious/noRedeclare: Shouldn't redeclare 'z'. Consider to delete it or rename it.

  • #​9495 2056b23 Thanks @​aviraldua93! - Added the useKeyWithClickEvents a11y lint rule for HTML files (.html, .vue, .svelte, .astro). This is a port of the existing JSX rule. The rule enforces that elements with an onclick handler also have at least one keyboard event handler (onkeydown, onkeyup, or onkeypress) to ensure keyboard accessibility.

    Inherently keyboard-accessible elements (<a>, <button>, <input>, <select>, <textarea>, <option>) are excluded, as are elements hidden from assistive technologies (aria-hidden) or with role="presentation" / role="none".

    <!-- Invalid: no keyboard handler -->
<div onclick="handleClick()">Click me</div>

<!-- Valid: has keyboard handler -->
<div onclick="handleClick()" onkeydown="handleKeyDown()">Click me</div>

<!-- Valid: inherently keyboard-accessible -->
<button onclick="handleClick()">Submit</button>

  • #​9152 9ec8500 Thanks @​ematipico! - Added new nursery lint rule noUndeclaredClasses for HTML, JSX, and SFC files (Vue, Astro, Svelte). The rule detects CSS class names used in class="..." (or className) attributes that are not defined in any <style> block or linked stylesheet reachable from the file.

    <!-- .typo is used but never defined -->
<html>
  <head>
    <style>
      .button {
        color: blue;
      }
    </style>
  </head>
  <body>
    <div class="button typo"></div>
  </body>
</html>

  • #​9152 9ec8500 Thanks @​ematipico! - Added new nursery lint rule noUnusedClasses for CSS. The rule detects CSS class selectors that are never referenced in any HTML or JSX file that imports the stylesheet. This is a project-domain rule that requires the module graph.

    /* styles.css — .ghost is never used in any importing file */
.button {
  color: blue;
}
.ghost {
  color: red;
}
    /* App.jsx */
import "./styles.css";
export default () => <div className="button" />;

  • #​9546 6567efa Thanks @​nhedger! - Added a biome upgrade command for standalone installations. It upgrades Homebrew installs with brew upgrade biome, updates manually installed binaries from the latest GitHub release, and tells npm users to upgrade with their package manager instead.

  • #​9716 701767a Thanks @​faizkhairi! - Added the HTML version of the useHeadingContent rule. The rule now enforces that heading elements (h1-h6) have content accessible to screen readers in HTML, Vue, Svelte, and Astro files.

    <!-- Invalid: empty heading -->
<h1></h1>

<!-- Invalid: heading hidden from screen readers -->
<h1 aria-hidden="true">invisible content</h1>

<!-- Valid: heading with text content -->
<h1>heading</h1>

<!-- Valid: heading with accessible name -->
<h1 aria-label="Screen reader content"></h1>

  • #​9582 f437ef8 Thanks @​rahuld109! - Added the HTML version of the useKeyWithMouseEvents rule. The rule now enforces that onmouseover is accompanied by onfocus and onmouseout is accompanied by onblur in HTML, Vue, Svelte, and Astro files.

    <!-- Invalid: onmouseover without onfocus -->
<div onmouseover="handleMouseOver()"></div>

<!-- Valid: onmouseover paired with onfocus -->
<div onmouseover="handleMouseOver()" onfocus="handleFocus()"></div>

  • #​9275 1fdbcee Thanks @​ff1451! - Added the new assist action useSortedTypeFields, which sorts the fields of GraphQL object types, interface types and input object types alphabetically, e.g. name, age, id becomes age, id, name.

  • #​10561 78075b7 Thanks @​Conaclos! - Added a new style option to useExportType,
    which enforces a style for exporting types.
    This is the same option as the one provided by useImportType.

  • #​8987 d16e32b Thanks @​DerTimonius! - Ported the useValidAnchor rule to HTML. This rule enforces that all anchors are valid and that they are navigable elements.

  • #​9533 4d251d4 Thanks @​ematipico! - The init command now prints the Biome logo.

  • #​10069 0eb9310 Thanks @​Netail! - Added the HTML lint rule noStaticElementInteractions, which enforces that static, visible elements (such as <div>) that have click handlers use the valid role attribute.

    Invalid:

    <div onclick="myFunction()"></div>

  • #​9134 2a43488 Thanks @​ematipico! - Added the assist action useSortedPackageJson.

    This action organizes package.json fields according to the same conventions as the popular sort-package-json tool.

  • #​9309 7daa18b Thanks @​Bertie690! - The allowDoubleNegation option has been added to noImplicitCoercions to allow ignoring double negations inside code.

    With the option enabled, the following example is considered valid and is ignored by the rule:

    const truthy = !!value;

  • #​9700 894f3fb Thanks @​ematipico! - The Biome Language server now supports the "go-to definition" feature.

    When the cursor of the mouse is hovering an entity (variable, CSS class, type, etc.), and the command CTRL + click is triggered, the editor jumps to where this entity is defined, if the language server can find it.

    Here's what Biome is able to resolve:

    • Variables and types used in JavaScript modules, defined in the same file or imported from another module.
    • JSX Components used in JavaScript modules, defined in the same file or imported from another module.
    • CSS classes used in JSX and HTML-ish files (Vue, Svelte and Astro), and defined in CSS files.
    • Components used in HTML-ish files and defined in other HTML-ish.
    • Variables used in HTML-ish files and defined in the same file or imported from another module (JavaScript or HTML-ish).

  • #​10070 bae0710 Thanks @​Conaclos! - Added the :STYLE: group matcher for organizeImports that matches style imports.

    For example, the following configuration...

    {
  "assist": {
    "actions": {
      "source": {
        "organizeImports": {
          "level": "on",
          "options": {
            "groups": ["**", "!:STYLE:"],
            "sortBareImports": true
          }
        }
      }
    }
  }
}

    ...places style imports last:

    - import "./style.css"
  import A from "./a.js"
+ import "./style.css"

  • #​9170 e3107de Thanks @​mdrobny! - Added bundleDependencies option to NoUndeclaredDependencies rule.

    This rule now supports imports of packages that are defined only in bundleDependencies and bundledDependencies arrays.

  • #​9547 01f8473 Thanks @​mujpao! - Added new assist rule useSortedAttributes for HTML, porting the existing JSX rule. This rule enforces sorted HTML attributes.

    Invalid

    <input type="text" id="name" name="name" />

  • #​9366 2ca1117 Thanks @​dyc3! - Added the html.parser.vue configuration option. When enabled, it adds support for the parsing of Vue in .html files. Most Vue users don't need to enable this option since Vue files typically use the .vue extension, but it can be useful for projects that embed Vue syntax in regular HTML files.

  • #​9073 74b20ee Thanks @​chocky335! - Added support for applying GritQL plugin rewrites as code actions. GritQL plugins that use the rewrite operator (=>) now produce fixable diagnostics for JavaScript, CSS, and JSON files. By default, plugin rewrites are treated as unsafe fixes and require --write --unsafe to apply. Plugin authors can pass fix_kind = "safe" to register_diagnostic() to mark a fix as safe, allowing it to be applied with just --write.

    Example plugin (useConsoleInfo.grit):

    language js

`console.log($msg)` as $call where {
    register_diagnostic(span = $call, message = "Use console.info instead of console.log.", severity = "warn", fix_kind = "safe"),
    $call => `console.info($msg)`
}

    Running biome check --write applies safe rewrites. Unsafe rewrites (the default, or fix_kind = "unsafe") still require --write --unsafe.

  • #​9384 f4c9edc Thanks @​Conaclos! - Added the sortBareImports option to organizeImports,
    which allows bare imports to be sorted within other imports when set to false.

    {
  "assist": {
    "actions": {
      "source": {
        "organizeImports": {
          "level": "on",
          "options": { "sortBareImports": true }
        }
      }
    }
  }
}
    - import "b";
  import "a";
+ import "b";
  import { A } from "a";
+ import "./file";
  import { Local } from "./file";
- import "./file";

  • #​8731 e7872bf Thanks @​siketyan! - Added the watch mode (--watch) to the CLI for check/format/lint commands. By enabling this option, Biome will re-run the check automatically when any file in the workspace has changed after the first run.

  • #​10106 9b35f78 Thanks @​ematipico! - Biome can now format and lint .svg files.

  • #​9967 e9b6c17 Thanks @​dyc3! - Added HTML support for noExcessiveLinesPerFile. Biome now reports HTML files that exceed the configured line limit, including when skipBlankLines is enabled.

  • #​9491 b3eb63c Thanks @​IxxyDev! - Added the HTML lint rule noAriaUnsupportedElements. This rule enforces that elements that do not support ARIA roles, states, and properties (meta, html, script, style) do not have role or aria-* attributes.

    <!-- Invalid: meta does not support aria attributes -->
<meta charset="UTF-8" role="meta" />

  • #​9306 afd57a6 Thanks @​viraxslot! - Added the noNoninteractiveTabindex lint rule for HTML. This rule enforces that tabindex is not used on non-interactive elements, as it can cause usability issues for keyboard users.

    <div tabindex="0">Invalid: non-interactive element</div>
`

  • #​9276 6d041d9 Thanks @​IxxyDev! - Added the HTML lint rule noRedundantRoles. This rule enforces that explicit role attributes are not the same as the implicit/default role of an HTML element. It supports HTML, Vue, Svelte, and Astro files.

    <!-- Invalid: role="button" is redundant on <button> -->
<button role="button"></button>

  • #​9813 69aadc2 Thanks @​ematipico! - Added a new linter configuration called preset. With the new option, users can enable different kinds of rules at once.

    The following presets are available:

    • "recommended": it enables all Biome-recommended rules, or recommended rules of a group;
    • "all": it enables all Biome rules, or enables all rules of a group;
    • "none": it disables all Biome rules, or disable all rules of a group.

    You can enable recommended rules:

    {
  "linter": {
    "rules": {
      "preset": "recommended"
    }
  }
}

    You can enable all rules at once:

    {
  linter: {
    rules: {
      preset: "all", // enables all rules
    },
  },
}

    Or enable all rules for a group:

    {
  linter: {
    rules: {
      style: {
        preset: "all", // enables all rules in the style group
      },
    },
  },
}

    This new option, however, doesn't affect how nursery rules work. Nursery rules must be enabled singularly, due to their nature.

    This new option is meant to replace recommended, so make sure to run the migrate command.

  • #​10022 3422d71 Thanks @​Netail! - Added the HTML lint rule noNoninteractiveElementToInteractiveRole, which enforces that interactive ARIA roles are not assigned to non-interactive HTML elements.

    Invalid:

    <h1 role="checkbox"></h1>

  • #​8396 13785fc Thanks @​apple-yagi! - Biome now supports pnpm catalogs (default and named) when resolving dependencies for linting. This behavior is opt-in and requires setting javascript.resolver.experimentalPnpmCatalogs to true.

  • #​10028 1009414 Thanks @​Netail! - Added the HTML lint rule noInteractiveElementToNoninteractiveRole, which enforces that non-interactive ARIA roles are not assigned to interactive HTML elements.

    Invalid:

    <input role="img" />

  • #​9853 816302f Thanks @​Netail! - Added the new assist action useSortedSelectionSet, which sorts GraphQL selection sets alphabetically, e.g. name, age, id becomes age, id, name.

    Invalid:

    query {
  name
  age
  id
}

  • #​10074 9c7c6eb Thanks @​georgephillips! - Added a kind field to the ImportMatcher used by the organizeImports assist action. The new field selects imports by their syntactic kind and currently supports bare (matching side-effect imports such as import "polyfill") with optional ! negation (!bare). The matcher composes with the existing type and source fields, so users can express patterns such as "only bare imports that import a CSS file" ({ "kind": "bare", "source": "**/*.css" }).

    For example, with the following configuration:

    {
  "assist": {
    "actions": {
      "source": {
        "organizeImports": {
          "level": "on",
          "options": {
            "sortBareImports": true,
            "groups": [
              { "kind": "!bare" },
              ":BLANK_LINE:",
              { "kind": "bare" }
            ]
          }
        }
      }
    }
  }
}

    ...the following code:

    import "./register-my-component";
import { render } from "react-dom";
import "./polyfill";
import { Button } from "@&#8203;/components/Button";

    ...is organized as:

    import { render } from "react-dom";
import { Button } from "@&#8203;/components/Button";

import "./polyfill";
import "./register-my-component";

  • #​9171 ce65710 Thanks @​chocky335! - Added includes option for plugin file scoping. Plugins can now be configured with glob patterns to restrict which files they run on. Use negated globs for exclusions.

    {
  "plugins": [
    "global-plugin.grit",
    {
      "path": "scoped-plugin.grit",
      "includes": ["src/**/*.ts", "!**/*.test.ts"]
    }
  ]
}

  • #​9617 dcb99ef Thanks @​faizkhairi! - Ported useAriaActivedescendantWithTabindex a11y rule to HTML.

  • #​9496 1dfb829 Thanks @​aviraldua93! - Added HTML support for the noAriaHiddenOnFocusable accessibility lint rule, which enforces that aria-hidden="true" is not set on focusable elements. Focusable elements include native interactive elements (<button>, <input>, <select>, <textarea>), elements with href (<a>, <area>), elements with tabindex >= 0, and editing hosts (contenteditable). Includes an unsafe fix to remove the aria-hidden attribute.

    <!-- Invalid: aria-hidden on a focusable element -->
<button aria-hidden="true">Submit</button>

<!-- Valid: aria-hidden on a non-focusable element -->
<div aria-hidden="true">decorative content</div>

  • #​9792 f516854 Thanks @​Maximiliano-Zeballos! - Added the useSemanticElements lint rule for HTML. The rule now detects the use of role attributes in HTML elements and suggests using semantic elements instead.

    For example, the following code is now flagged:

    <div role="navigation"></div>

    The rule suggests using <nav> instead.

  • #​9761 cbbb7d5 Thanks @​Maximiliano-Zeballos! - Ported the useValidAriaProps lint rule to HTML. This rule checks that all aria-* attributes used in HTML elements are valid ARIA attributes as defined by the WAI-ARIA specification.

  • #​9928 aa82576 Thanks @​aviraldua93! - Ported useValidAriaValues to HTML. Biome now validates static aria-* attribute values in HTML elements against WAI-ARIA types, catching invalid values such as aria-hidden="yes".

  • #​10562 6642895 Thanks @​ematipico! - Promoted 73 nursery rules to stable groups.

    Four rules were renamed as part of the promotion:

Correctness

Promoted the following rules to the correctness group:

Suspicious

Promoted the following rules to the suspicious group:

Style

Promoted the following rules to the style group:

Complexity

Promoted the following rules to the complexity group:

Performance

Promoted the following rules to the performance group:

Security

Promoted the following rules to the security group:

A11y

Promoted the following rules to the a11y group:

  • noAmbiguousAnchorText (recommended)

  • #​10121 450f8e1 Thanks @​jongwan56! - Biome now applies Git's local exclude file when VCS ignore files are enabled. Files listed in .git/info/exclude are skipped the same way as files listed in .gitignore, including in linked worktrees.

  • #​9397 d5913c9 Thanks @​mvarendorff! - Added ignore option to the noUnusedVariables rule. The option allows excluding identifiers by providing a list of ignored names. It also allows excluding kinds of identifiers from this rule entirely, which may be useful when loading classes dynamically.

    For example, unused classes as well as all unused variables, functions, etc. called "unused" may be ignored entirely with the following configuration:

    {
  "ignore": {
    "*": ["unused"],
    "class": ["*"]
  }
}

  • #​10089 71a21f0 Thanks @​Netail! - Added the lint rule noLabelWithoutControl to HTML, which enforces that a label element or component has a text label and an associated input.

    <label></label>

  • #​10015 1828261 Thanks @​Netail! - Added the HTML lint rule useAriaPropsSupportedByRole, which enforces that ARIA properties are valid for the roles that are supported by the element.

    <a href="#" aria-checked></a>

  • #​10234 1a51569 Thanks @​ematipico! - Added the delimiterSpacing formatter option. This option inserts spaces inside delimiters (after the opening delimiter and before the closing delimiter) when the content fits on a single line. Empty delimiters are not affected, and no space is added before the opening delimiter. The specific delimiters affected depend on the language. It can be configured globally via formatter.delimiterSpacing or per-language via javascript.formatter.delimiterSpacing, json.formatter.delimiterSpacing, and css.formatter.delimiterSpacing. Defaults to false.

    - callFn(foo)
+ callFn( foo )
    - const arr = [1, 2, 3];
+ const arr = [ 1, 2, 3 ];
    JavaScript

    When enabled, Biome inserts spaces inside parentheses (e.g., foo( a, b )), square brackets (e.g., [ a, b ]), template literal interpolations (e.g., ${ expr }), and the logical NOT operator (e.g., ! x, but in chains only after the last one: !! x). Only applies when the content fits on a single line. Empty delimiters and the space before the opening delimiter are not affected.

    - if (condition) {}
+ if ( condition ) {}
    - `Hello ${name}!`
+ `Hello ${ name }!`
    JSX

    When enabled, Biome inserts spaces inside JSX expression braces (e.g., attr={ value }) and spread attributes (e.g., { ...props }). Only applies when the content fits on a single line. Empty delimiters are not affected.

    - <Foo bar={value} />
+ <Foo bar={ value } />
    TypeScript

    When enabled, Biome inserts spaces inside TypeScript angle brackets (e.g., foo< T >()), indexed access types (e.g., T[ K ]), mapped types, tuple types, type parameters, and index signatures. Only applies when the content fits on a single line. Empty delimiters are not affected.

    - type Result = Map<string, number>;
+ type Result = Map< string, number >;
    JSON

    When enabled, Biome inserts spaces inside square brackets when the content fits on a single line. Empty brackets are not affected.

    - [1, 2, 3]
+ [ 1, 2, 3 ]
    CSS

    When enabled, Biome inserts spaces inside parentheses and square brackets when the content fits on a single line. Empty delimiters are not affected.

    - rgba(0, 0, 0, 1)
+ rgba( 0, 0, 0, 1 )
    - [data-attr]
+ [ data-attr ]

  • #​10461 6bac1c3 Thanks @​TXWSLYF! - Implements #​9445. Added the allowImplicit option to useIterableCallbackReturn. When enabled, callbacks can use return; to implicitly return undefined, matching ESLint's array-callback-return rule.

  • #​9571 5a8eb75 Thanks @​dyc3! - Added configurable options to the useNumericSeparators rule. Users can now customize the minimum number of digits required before adding separators and the group length for each type of numeric literal (binary, octal, decimal, hexadecimal).

    {
  "linter": {
    "rules": {
      "style": {
        "useNumericSeparators": {
          "level": "error",
          "options": {
            "decimal": {
              "minimumDigits": 7,
              "groupLength": 3
            },
            "hexadecimal": {
              "minimumDigits": 4,
              "groupLength": 2
            }
          }
        }
      }
    }
  }
}

  • #​10067 6064312 Thanks @​Netail! - Added the lint rule useFocusableInteractive to HTML, which enforces elements with an interactive role and interaction handler to be focusable.

    Invalid:

    <div role="button"></div>

  • #​10026 fb42ac4 Thanks @​Netail! - Added the HTML lint rule noNoninteractiveElementInteractions, which disallows use event handlers on non-interactive elements.

    Invalid:

    <div onclick="myFunction()">button</div>

  • #​10000 2093e3e Thanks @​Netail! - Added the new assist action useSortedEnumMembers, which sorts TypeScript & GraphQL enum members.

    Invalid:

    enum Role {
  SUPER_ADMIN
  ADMIN
  USER
  GOD
}

  • #​10013 ad01d3d Thanks @​Netail! - Added the HTML lint rule useValidAutocomplete, which enforces using valid values for the autocomplete attribute on input elements.

    <input autocomplete="incorrect" />
Patch Changes

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot requested a review from skulidropek February 21, 2026 13:44
@renovate renovate Bot changed the title fix(deps): update dependency effect to ^3.19.19 fix(deps): update all dependencies Feb 23, 2026
@renovate renovate Bot force-pushed the renovate/all branch 9 times, most recently from 52aba09 to 16d549f Compare March 2, 2026 17:40
@renovate renovate Bot force-pushed the renovate/all branch 10 times, most recently from f240877 to 3c2e51f Compare March 9, 2026 23:06
@renovate renovate Bot force-pushed the renovate/all branch 7 times, most recently from 9456c54 to 0ff8d9f Compare March 17, 2026 14:38
@renovate renovate Bot force-pushed the renovate/all branch 5 times, most recently from 6ff8486 to 4c77644 Compare April 24, 2026 02:39
@coderabbitai

coderabbitai Bot commented May 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Bump CI action versions, pin pnpm to 11.1.2 in root and app, and update Changesets plus many app dependencies/devDependencies (Effect stack, TypeScript tooling, linting, testing, and build tools).

Changes

Toolchain and dependency upgrades

Layer / File(s) Summary
GitHub Actions versions
.github/actions/setup/action.yml, .github/workflows/checking-dependencies.yml, .github/workflows/snapshot.yml		 pnpm action bumped to @v6 in composite and workflow; actions/setup-node Node input updated to 24.15.0; artifact upload action bumped to actions/upload-artifact@v7.
pnpm version pins
package.json, packages/app/package.json		 Workspace and app packageManager updated from pnpm@10.30.1 to pnpm@11.1.2.
Dependency and toolchain upgrades
package.json, packages/app/package.json		 Root Changesets packages (@changesets/changelog-github, @changesets/cli) bumped; app package dependencies and devDependencies refreshed (Effect packages, ts-morph, Biome/ESLint, TypeScript tooling, Vitest/Vite, etc.).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related issues

Poem

🐇 I nudged a YAML line, made pnpm climb to eleven,
Actions hum a newer tune, workflows light as heaven.
Packages refreshed, linters wake and play,
Tests tiptoe cleaner paths, building through the day.
✨

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title 'fix(deps): update all dependencies' directly matches the changeset, which updates dependencies across multiple configuration files and package manifests.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description check ✅ Passed The PR description clearly documents this as a Renovate-generated dependency update with a comprehensive table of all updated packages across multiple categories.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch renovate/all

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

coderabbitai[bot]
coderabbitai Bot requested changes May 14, 2026
View reviewed changes

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/actions/setup/action.yml:
- Line 13: The workflow currently uses a mutable tag "pnpm/action-setup@v6";
replace that with an immutable full commit SHA (40-hex) for pnpm/action-setup to
pin the action (e.g., "pnpm/action-setup@<full-commit-sha>"). Locate the "uses:
pnpm/action-setup@v6" entry in the action.yml and update it to the exact commit
SHA from the pnpm/action-setup repository, verify the SHA is full-length (40
characters) and that the workflow still runs correctly after the change.

In @.github/workflows/checking-dependencies.yml:
- Line 15: Replace the mutable tag reference "uses: pnpm/action-setup@v6" with
an immutable pin to the full commit SHA for the pnpm/action-setup action (e.g.,
"uses: pnpm/action-setup@<full-commit-sha>"); locate the occurrences of
"pnpm/action-setup@v6" in the workflow and update them to the corresponding
release commit SHA from the action's repository, then verify the workflow runs
successfully.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4cd2e52a-a23f-4849-8bc7-20b25e799703

📥 Commits

Reviewing files that changed from the base of the PR and between 6b3e168 and 373422e.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (5)
  • .github/actions/setup/action.yml
  • .github/workflows/checking-dependencies.yml
  • .github/workflows/snapshot.yml
  • package.json
  • packages/app/package.json

Comment thread .github/actions/setup/action.yml
steps:
- name: Install pnpm
uses: pnpm/action-setup@v3
uses: pnpm/action-setup@v6

@coderabbitai coderabbitai Bot May 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify mutable action refs under .github (tag-based refs like `@v1/`@v6).
# Expected: no matches after SHA pinning.
rg -n --iglob '*.yml' --iglob '*.yaml' 'uses:\s*[^@[:space:]]+@v[0-9]+(\.[0-9]+){0,2}\b' .github

Repository: ProverCoderAI/openapi-effect

Length of output: 1009

Pin pnpm/action-setup to an immutable commit SHA.

Line 13 uses a mutable tag (@v6). Please pin to a full-length commit SHA to reduce supply-chain risk and avoid policy breaks in hardened org settings.

🔒 Suggested change 
-      uses: pnpm/action-setup@v6
+      uses: pnpm/action-setup@<full-length-commit-sha> # v6.x

Reference: https://docs.github.com/actions/security-guides/security-hardening-for-github-actions

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/actions/setup/action.yml at line 13, The workflow currently uses a
mutable tag "pnpm/action-setup@v6"; replace that with an immutable full commit
SHA (40-hex) for pnpm/action-setup to pin the action (e.g.,
"pnpm/action-setup@<full-commit-sha>"). Locate the "uses: pnpm/action-setup@v6"
entry in the action.yml and update it to the exact commit SHA from the
pnpm/action-setup repository, verify the SHA is full-length (40 characters) and
that the workflow still runs correctly after the change.

Comment thread .github/workflows/checking-dependencies.yml
steps:
- uses: actions/checkout@v6
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v6

@coderabbitai coderabbitai Bot May 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify mutable action refs under .github (tag-based refs like `@v1/`@v6).
# Expected: no matches after SHA pinning.
rg -n --iglob '*.yml' --iglob '*.yaml' 'uses:\s*[^@[:space:]]+@v[0-9]+(\.[0-9]+){0,2}\b' .github

Repository: ProverCoderAI/openapi-effect

Length of output: 1009

Pin pnpm/action-setup to a commit SHA instead of a mutable tag.

Line 15 uses @v6, which is a mutable tag reference. Per GitHub's security hardening guidelines, action references should be pinned to full commit SHAs to ensure immutability and prevent unintended updates from tag rewrites.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/checking-dependencies.yml at line 15, Replace the mutable
tag reference "uses: pnpm/action-setup@v6" with an immutable pin to the full
commit SHA for the pnpm/action-setup action (e.g., "uses:
pnpm/action-setup@<full-commit-sha>"); locate the occurrences of
"pnpm/action-setup@v6" in the workflow and update them to the corresponding
release commit SHA from the action's repository, then verify the workflow runs
successfully.

coderabbitai[bot]
coderabbitai Bot requested changes May 17, 2026
View reviewed changes

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Line 6: The package.json currently sets "packageManager": "pnpm@11.1.2" but
pnpm v11 requires config and environment changes; run the recommended codemod
(pnpx codemod run pnpm-v10-to-v11) and then: move any settings under the
package.json "pnpm" field into pnpm-workspace.yaml, strip .npmrc to only
auth/registry entries, update .nvmrc and CI to Node.js 22+ to match pnpm v11,
rename any environment variables from npm_config_* to pnpm_config_ and manually
review remaining envs, and rename or invoke scripts named
clean/setup/deploy/rebuild using pnpm pm to avoid shadowing built-ins.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 78ded05a-1811-4eac-8349-84f29cb8618e

📥 Commits

Reviewing files that changed from the base of the PR and between 6898c52 and 57c74f4.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (5)
  • .github/actions/setup/action.yml
  • .github/workflows/checking-dependencies.yml
  • .github/workflows/snapshot.yml
  • package.json
  • packages/app/package.json
🚧 Files skipped from review as they are similar to previous changes (4)
  • .github/actions/setup/action.yml
  • .github/workflows/checking-dependencies.yml
  • .github/workflows/snapshot.yml
  • packages/app/package.json

Comment thread package.json Outdated
"private": true,
"description": "Monorepo workspace for effect-template",
"packageManager": "pnpm@10.30.1",
"packageManager": "pnpm@11.1.2",

@coderabbitai coderabbitai Bot May 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

pnpm 11 breaking changes and migration guide

💡 Result:

pnpm 11 is a major release that introduces significant breaking changes, security-first defaults, and architectural improvements [1]. The official migration guide is available at https://pnpm.io/11.x/migration [2]. Key Breaking Changes and Migration Steps Configuration Changes pnpm 11 significantly changes how configuration is handled [3][1]: - Configuration is no longer read from the pnpm field in package.json; move these settings to pnpm-workspace.yaml [3][2]. -.npmrc files are now restricted to auth and registry settings only [3][1]. All other settings (e.g., hoist-pattern, node-linker) must be moved to pnpm-workspace.yaml using camelCase keys [3][2]. - npm_config_* environment variables are no longer supported; rename them to pnpm_config_* [3][1]. - pnpm no longer reads npm's global config at $PREFIX/etc/npmrc [1]. Dependency and Script Management - Build-dependency settings (onlyBuiltDependencies, neverBuiltDependencies, etc.) are consolidated into a single allowBuilds map in pnpm-workspace.yaml [3][1]. - Package manager strictness settings are collapsed into a single pmOnFail setting [3][2]. - Script names now shadow built-in commands [3]. If you have scripts named clean, setup, deploy, or rebuild, pnpm will execute your script instead of the built-in command; use pnpm pm to access the built-in version [3]. - pnpm install -g (with no arguments) is no longer supported; use pnpm add -g instead [3][1]. Environment and Infrastructure - Node.js 18, 19, 20, and 21 are no longer supported; Node.js 22+ is required [1]. - pnpm is now distributed as pure ESM [1]. - Global installs are now isolated using a global-virtual-store, preventing interference between global packages [1]. Security and New Features - Minimum Release Age: By default, pnpm 11 blocks the installation of package versions published within the last 24 hours to mitigate supply chain attacks [4][5][6]. - Exotic Subdependencies: pnpm 11 blocks dependencies resolved from non-standard sources (e.g., Git repositories or direct tarball URLs) by default [4][6]. - Native Publish: The npm CLI fallback for publishing has been removed in favor of a native implementation [1]. - Store Index: The store index has been migrated from a JSON-per-package format to a single SQLite database for improved performance [1][5]. Migration Tooling The pnpm team provides a codemod to automate many of these changes [2]. You can run it in your project directory: pnpx codemod run pnpm-v10-to-v11 [2] For changes that cannot be automated, such as environment variable updates, manual review is required [3][2].

Citations:

🌐 Web query:

pnpm 11.1.2 release notes and security advisories

💡 Result:

As of May 17, 2026, pnpm version 11.1.2 is the latest release [1]. Release Notes for pnpm 11.1.2 Specific release notes for version 11.1.2 were not explicitly detailed in the provided search results, as it is a very recent patch release [1]. However, it follows the major 11.1.0 and 11.1.1 releases, which introduced several significant features and fixes [2][3][4]: - New Commands: Added pnpm audit signatures (to verify ECDSA registry signatures), pnpm bugs (to open package bug trackers), and pnpm owner (to manage package owners) [3][4]. - Named Registries: Added support for installing packages from arbitrary named registries, including a built-in gh: prefix for the GitHub Packages npm registry [3][4]. - CI Improvements: Introduced the --no-runtime flag (config: runtime=false) to skip installing runtime entries (e.g., Node.js) in CI environments [3][4]. - Fixes: Version 11.1.1 included fixes for installability validation in workspace projects, resolved issues with pnpm add for named registries, and updated @zkochan/cmd-shim to improve compatibility with Git Bash on Windows [2]. Security Advisories There are no specific security advisories listed for version 11.1.2. Users should monitor the official pnpm GitHub Security Advisories page for any future disclosures [5]. Recent security-related updates in the pnpm 11 series include: - Minimum Release Age: pnpm 11 introduced a default Minimum Release Age of 24 hours (1440 minutes), which prevents the installation of newly published package versions to mitigate supply chain attacks [6][7][8]. - Enhanced Auditing: pnpm audit now queries the registry's bulk security advisories endpoint and filters by GitHub Advisory ID (GHSA) rather than CVE identifiers [9]. - Security Hardening: pnpm 11 requires Node.js 22+ and is distributed as pure ESM [10][11]. It also includes improved control over lifecycle scripts via the allowBuilds model [7][8]. For the most up-to-date information, always check the official pnpm releases page on GitHub and the security advisories section [12][5].

Citations:

Review pnpm 11 migration requirements before merging.

This major version upgrade introduces breaking changes that require configuration updates and environment adjustments:

  • Configuration files: Settings in package.json's pnpm field must move to pnpm-workspace.yaml. Update .npmrc to contain only auth and registry settings.
  • Node.js requirement: pnpm 11 requires Node.js 22+. Verify your project's .nvmrc and CI configuration specify a compatible version.
  • Environment variables: Any npm_config_* variables must be renamed to pnpm_config_*.
  • Script behavior: Scripts named clean, setup, deploy, or rebuild now shadow built-in commands; use pnpm pm to access built-in versions.

Run the migration codemod to automate configuration changes:

pnpx codemod run pnpm-v10-to-v11

Refer to https://pnpm.io/11.x/migration for the complete migration guide. Manual review is needed for environment variable updates that the codemod cannot automate.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 6, The package.json currently sets "packageManager":
"pnpm@11.1.2" but pnpm v11 requires config and environment changes; run the
recommended codemod (pnpx codemod run pnpm-v10-to-v11) and then: move any
settings under the package.json "pnpm" field into pnpm-workspace.yaml, strip
.npmrc to only auth/registry entries, update .nvmrc and CI to Node.js 22+ to
match pnpm v11, rename any environment variables from npm_config_* to
pnpm_config_ and manually review remaining envs, and rename or invoke scripts
named clean/setup/deploy/rebuild using pnpm pm to avoid shadowing built-ins.

@skulidropek

skulidropek commented Jun 19, 2026

Copy link
Copy Markdown
Member

Надо смержить сюда main ветку и исправить все ошибки в CI/CD что бы код был с актуальными библиотеками

@konard

konard commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

🤖 AI Work Session Started

Starting automated work session at 2026-06-19T19:17:51.406Z

The PR has been converted to draft mode while work is in progress.

This comment marks the beginning of an AI work session. Please wait for the session to finish, and provide your feedback.

@konard

konard commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

Update: the CI/CD fix is implemented and verified, but I cannot push it directly to this PR head branch.

Blocker:

  • PR fix(deps): update all dependencies #20 head is ProverCoderAI/openapi-effect:renovate/all.
  • Current GitHub credentials are konard and git push upstream renovate/all fails with 403 Permission to ProverCoderAI/openapi-effect.git denied to konard.

Prepared fix:

  • Commit: b16eac4b7948745fcd49d07e270b92f77b0ccb7d (fix(ci): adapt renovate update to pnpm 11)
  • Branch with the commit: konard/ProverCoderAI-openapi-effect:renovate/all

What the fix covers:

  • merged main into renovate/all locally;
  • moved pnpm 11 config from package.json#pnpm into pnpm-workspace.yaml and kept release-age policy with exact excludes;
  • pinned pnpm/action-setup to full SHA 0ebf47130e4866e96fce0953f49152a61190b271 (v6.0.9);
  • updated CI Node runtime to 24.17.0 so pnpm 11 can load node:sqlite;
  • fixed TypeScript 6/lint fallout while preserving legacy public aliases;
  • added consumer compile proof for the legacy serializer aliases.

Verification:

Needed human action: either grant/push access to ProverCoderAI/openapi-effect:renovate/all, or cherry-pick b16eac4b7948745fcd49d07e270b92f77b0ccb7d from the fork branch into the PR head branch.

@konard

konard commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

  • Model: GPT-5.5
  • Provider: OpenAI
  • Public pricing estimate: $21.304392

📊 Context and tokens usage:

  • 508.9K / 200K (254%) input tokens, 68.4K / 128K (53%) output tokens

Total: (508.9K + 13.1M cached) input tokens, 68.4K output tokens, $21.304392 cost

🤖 Models used:

  • Tool: OpenAI Codex
  • Requested: gpt-5.5
  • Thinking level: max (~31999 tokens)
  • Model: GPT-5.5 (gpt-5.5)

📎 Log file uploaded as Repository (75696KB)

Now working session is ended, feel free to review and add any feedback on the solution draft.

@konard

konard commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

🔄 Auto-restart triggered (iteration 1)

Reason: CI failures detected

Starting new session to address the issues.

Auto-restart-until-mergeable mode is active. This run will stop after 5 restart iterations.

@konard

konard commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

Rechecked the failing CI/CD status in this restart session.

Findings:

  • Latest upstream PR runs are still for old SHA 48c4a8472fb0d70d3d48c14f5963a2d421a90ec7 from 2026-06-19T13:11:52Z.
  • Logs saved locally during investigation show the failures are from pnpm 11 running on Node 20.16.0 / 22.12.0 and from pnpm 11 ignoring package.json#pnpm, causing minimumReleaseAge violations.
  • The prepared fix commit is still b16eac4b7948745fcd49d07e270b92f77b0ccb7d on konard/ProverCoderAI-openapi-effect:renovate/all.

Verification repeated locally with Node 24.17.0 and pnpm 11.8.0:

  • pnpm install --frozen-lockfile
  • pnpm check
  • pnpm build
  • pnpm lint:effect
  • pnpm lint
  • pnpm test
  • pnpm --filter @prover-coder-ai/openapi-effect test:consumer
  • pnpm dlx @prover-coder-ai/dist-deps-prune scan --package ./packages/app/package.json --prune-dev true --silent
  • snapshot fallback artifact check via npm pack

Fork CI also has successful runs for b16eac4: Check 27845776274, Checking Dependencies 27845776279.

Remaining blocker is repository permissions, not code: git push upstream renovate/all still fails with 403 Permission to ProverCoderAI/openapi-effect.git denied to konard. Please either grant push access to ProverCoderAI/openapi-effect:renovate/all or cherry-pick/push b16eac4b7948745fcd49d07e270b92f77b0ccb7d from the fork branch into the upstream PR head branch.

@konard

konard commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

🔄 Auto-restart-until-mergeable Log (iteration 1)

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

  • Model: GPT-5.5
  • Provider: OpenAI
  • Public pricing estimate: $4.197492
  • Token usage: 93,621 input, 17,194 output, 5,819 reasoning, 2,487,552 cache read

🤖 Models used:

  • Tool: OpenAI Codex
  • Requested: gpt-5.5
  • Model: GPT-5.5 (gpt-5.5)

📎 Log file uploaded as Repository (96784KB)

Now working session is ended, feel free to review and add any feedback on the solution draft.

@konard

konard commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

🔄 Auto-restart triggered (iteration 2)

Reason: CI failures detected

Starting new session to address the issues.

Auto-restart-until-mergeable mode is active. This run will stop after 5 restart iterations.

@konard

konard commented Jun 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Rechecked and updated the prepared fix in this restart session.

Current prepared commit:

  • b52bed11666e71930f1d563062826936f36fd5f3 on konard/ProverCoderAI-openapi-effect:renovate/all
  • This includes the earlier CI/pnpm 11 fix plus a small follow-up commit fix(app): satisfy strict type lint example so lint:types also passes.

Root causes confirmed from upstream CI logs for old SHA 48c4a8472fb0d70d3d48c14f5963a2d421a90ec7:

  • Check/Snapshot: pnpm 11 ran under an old Node runtime and failed on node:sqlite / Node >= 22.13 requirement.
  • dist-deps-prune: pnpm 11 minimum release age policy rejected fresh lockfile entries.

Verification on current SHA b52bed1:

  • Local with Node 24.17.0 and pnpm 11.8.0: pnpm install --frozen-lockfile, pnpm check, pnpm build, pnpm lint, pnpm lint:effect, pnpm test, pnpm lint:tests, pnpm --filter @prover-coder-ai/openapi-effect lint:types, pnpm --filter @prover-coder-ai/openapi-effect test:consumer, pnpm dlx @prover-coder-ai/dist-deps-prune scan --package ./packages/app/package.json --prune-dev true --silent, and package pack check all passed.
  • Fork CI Check passed: https://github.com/konard/ProverCoderAI-openapi-effect/actions/runs/27846721442
  • Fork CI Checking Dependencies passed: https://github.com/konard/ProverCoderAI-openapi-effect/actions/runs/27846721454
  • Fork Snapshot is skipped by the workflow owner guard (github.repository_owner == 'ProverCoderAI'); the equivalent local pnpm build plus fallback npm pack artifact path passed.

Remaining blocker is repository permission, not code. git push upstream renovate/all still fails with:

remote: Permission to ProverCoderAI/openapi-effect.git denied to konard.
fatal: unable to access 'https://github.com/ProverCoderAI/openapi-effect.git/': The requested URL returned error: 403

Needed maintainer action: push/cherry-pick b52bed11666e71930f1d563062826936f36fd5f3 from the fork branch into ProverCoderAI/openapi-effect:renovate/all. Until that happens, PR #20 remains on the old upstream head SHA 48c4a8472fb0d70d3d48c14f5963a2d421a90ec7 and will keep showing stale failing checks.

@konard

konard commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

🔄 Auto-restart-until-mergeable Log (iteration 2)

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

  • Model: GPT-5.5
  • Provider: OpenAI
  • Public pricing estimate: $4.788024
  • Token usage: 95,677 input, 18,030 output, 5,431 reasoning, 3,019,904 cache read

🤖 Models used:

  • Tool: OpenAI Codex
  • Requested: gpt-5.5
  • Model: GPT-5.5 (gpt-5.5)

📎 Log file uploaded as Repository (2 chunks) (116514KB)

Now working session is ended, feel free to review and add any feedback on the solution draft.

@konard

konard commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

🔄 Auto-restart triggered (iteration 3)

Reason: CI failures detected

Starting new session to address the issues.

Auto-restart-until-mergeable mode is active. This run will stop after 5 restart iterations.

@konard

konard commented Jun 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Restart iteration 3 rechecked the prepared CI fix.

Current verified head:

  • b52bed11666e71930f1d563062826936f36fd5f3 on konard/ProverCoderAI-openapi-effect:renovate/all
  • Local branch includes upstream/main via merge commit f43684a.
  • PR fix(deps): update all dependencies #20 still points to ProverCoderAI/openapi-effect:renovate/all@48c4a8472fb0d70d3d48c14f5963a2d421a90ec7, so its failing checks are stale for the old head.

Fresh upstream CI logs downloaded in this session confirm old-head root causes:

  • Check: pnpm 11 under Node 20.16.0 fails on node:sqlite / Node >= 22.13 requirement.
  • Snapshot: pnpm 11 under Node 22.12.0 fails the Node >= 22.13 requirement.
  • Checking Dependencies: pnpm 11 ignores package.json#pnpm and then fails minimumReleaseAge for the refreshed lockfile entries.

Verification repeated on b52bed1 with Node 24.17.0 and pnpm 11.8.0:

  • pnpm install --frozen-lockfile
  • pnpm check
  • pnpm build
  • pnpm lint
  • pnpm lint:effect
  • pnpm test
  • pnpm lint:tests
  • pnpm --filter @prover-coder-ai/openapi-effect lint:types
  • pnpm --filter @prover-coder-ai/openapi-effect test:consumer
  • pnpm dlx @prover-coder-ai/dist-deps-prune scan --package ./packages/app/package.json --prune-dev true --silent
  • snapshot fallback npm pack artifact path

Push blocker remains external:
git push upstream HEAD:renovate/all fails with 403 Permission to ProverCoderAI/openapi-effect.git denied to konard.

Needed maintainer action: push or cherry-pick b52bed11666e71930f1d563062826936f36fd5f3 from the fork branch into ProverCoderAI/openapi-effect:renovate/all.

@konard

konard commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

🔄 Auto-restart-until-mergeable Log (iteration 3)

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

  • Model: GPT-5.5
  • Provider: OpenAI
  • Public pricing estimate: $4.433867
  • Token usage: 92,361 input, 16,725 output, 5,362 reasoning, 2,757,632 cache read

🤖 Models used:

  • Tool: OpenAI Codex
  • Requested: gpt-5.5
  • Model: GPT-5.5 (gpt-5.5)

📎 Log file uploaded as Repository (2 chunks) (139990KB)

Now working session is ended, feel free to review and add any feedback on the solution draft.

@konard

konard commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

🔄 Auto-restart triggered (iteration 4)

Reason: CI failures detected

Starting new session to address the issues.

Auto-restart-until-mergeable mode is active. This run will stop after 5 restart iterations.

@konard

konard commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

Restart iteration 4 rechecked the CI/CD fix.

Current verified head:

  • b52bed11666e71930f1d563062826936f36fd5f3 on konard/ProverCoderAI-openapi-effect:renovate/all
  • upstream/main is merged into this branch.
  • PR fix(deps): update all dependencies #20 upstream head is still ProverCoderAI/openapi-effect:renovate/all@48c4a8472fb0d70d3d48c14f5963a2d421a90ec7, so the visible failing checks are still for the old head.

Fresh upstream logs downloaded in this session confirm the old-head failures:

  • Check: pnpm 11 runs under Node 20.16.0 and fails on node:sqlite / Node >= 22.13.
  • Snapshot: pnpm 11 runs under Node 22.12.0 and fails the Node >= 22.13 requirement.
  • Checking Dependencies: pnpm 11 rejects fresh lockfile entries through minimumReleaseAge.

Verification repeated locally on b52bed1 with Node 24.17.0 and pnpm 11.8.0:

  • pnpm install --frozen-lockfile
  • pnpm check
  • pnpm build
  • pnpm lint
  • pnpm lint:effect
  • pnpm test
  • pnpm lint:tests
  • pnpm --filter @prover-coder-ai/openapi-effect lint:types
  • pnpm --filter @prover-coder-ai/openapi-effect test:consumer
  • pnpm dlx @prover-coder-ai/dist-deps-prune scan --package ./packages/app/package.json --prune-dev true --silent
  • snapshot fallback artifact check via npm pack

Push status:

  • git push origin HEAD:renovate/all: up to date.
  • git push upstream HEAD:renovate/all: blocked with 403 Permission to ProverCoderAI/openapi-effect.git denied to konard.

Needed maintainer action: push or cherry-pick b52bed11666e71930f1d563062826936f36fd5f3 from konard/ProverCoderAI-openapi-effect:renovate/all into ProverCoderAI/openapi-effect:renovate/all. Until then PR #20 cannot receive fresh CI for the verified fix.

@konard

konard commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

🔄 Auto-restart-until-mergeable Log (iteration 4)

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

  • Model: GPT-5.5
  • Provider: OpenAI
  • Public pricing estimate: $4.654120
  • Token usage: 127,152 input, 17,640 output, 5,582 reasoning, 2,588,800 cache read

🤖 Models used:

  • Tool: OpenAI Codex
  • Requested: gpt-5.5
  • Model: GPT-5.5 (gpt-5.5)

📎 Log file uploaded as Repository (2 chunks) (154923KB)

Now working session is ended, feel free to review and add any feedback on the solution draft.

@konard

konard commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

🔄 Auto-restart triggered (iteration 5)

Reason: CI failures detected

Starting new session to address the issues.

Auto-restart-until-mergeable mode is active. This run will stop after 5 restart iterations.

@konard

konard commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

Restart iteration 5 rechecked the CI/CD failures and the prepared fix.

Current verified fix:

  • b52bed11666e71930f1d563062826936f36fd5f3 on konard/ProverCoderAI-openapi-effect:renovate/all
  • This branch includes upstream/main and has origin/renovate/all up to date.

Fresh upstream CI status:

  • PR fix(deps): update all dependencies #20 still points to ProverCoderAI/openapi-effect:renovate/all@48c4a8472fb0d70d3d48c14f5963a2d421a90ec7.
  • Latest upstream runs are still from 2026-06-19T13:11:52Z for that old SHA:
    • Check 27827776411: failure
    • Checking Dependencies 27827776440: failure
    • Snapshot 27827776423: failure

Root causes confirmed from downloaded upstream logs:

  • Check jobs (Build, Types, Lint, Lint Effect-TS, Test) fail before project code because pnpm 11 runs under Node 20.16.0 and errors with No such built-in module: node:sqlite / Node >= 22.13 requirement.
  • Snapshot fails for the same pnpm 11 runtime requirement under Node 22.12.0.
  • dist-deps-prune fails with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION for effect@3.21.4, eslint-plugin-sonarjs@4.1.0, and eslint-plugin-unicorn@68.0.0.

Verification repeated locally on b52bed1 with Node 24.17.0 and pnpm 11.8.0:

  • pnpm install --frozen-lockfile
  • pnpm check
  • pnpm build
  • pnpm lint
  • pnpm lint:effect
  • pnpm test
  • pnpm lint:tests
  • pnpm --filter @prover-coder-ai/openapi-effect lint:types
  • pnpm --filter @prover-coder-ai/openapi-effect test:consumer
  • pnpm dlx @prover-coder-ai/dist-deps-prune scan --package ./packages/app/package.json --prune-dev true --silent
  • snapshot fallback artifact path via npm pack

Fork CI on b52bed1:

Push status:

  • git push origin HEAD:renovate/all: up to date.
  • git push upstream HEAD:renovate/all: blocked with 403 Permission to ProverCoderAI/openapi-effect.git denied to konard.

Needed maintainer action: push or cherry-pick b52bed11666e71930f1d563062826936f36fd5f3 from konard/ProverCoderAI-openapi-effect:renovate/all into ProverCoderAI/openapi-effect:renovate/all. Until that upstream PR head moves off 48c4a84, the visible PR checks remain stale failures for the old commit.

@konard

konard commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

🔄 Auto-restart-until-mergeable Log (iteration 5)

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

  • Model: GPT-5.5
  • Provider: OpenAI
  • Public pricing estimate: $4.888533
  • Token usage: 166,658 input, 16,101 output, 4,054 reasoning, 2,497,408 cache read

🤖 Models used:

  • Tool: OpenAI Codex
  • Requested: gpt-5.5
  • Model: GPT-5.5 (gpt-5.5)

📎 Log file uploaded as Repository (2 chunks) (177139KB)

Now working session is ended, feel free to review and add any feedback on the solution draft.

@konard

konard commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

⚠️ Auto-restart limit reached

Hive Mind stopped auto-restart-until-mergeable after 5 restart iterations.

Configured limit: 5
Remaining reason: CI failures detected

No further AI sessions will be started automatically for this run. Please review the remaining blockers manually or rerun with a higher --auto-restart-max-iterations value.

Auto-restart-until-mergeable stopped by the safety limit.

@konard

konard commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

🤖 AI Work Session Completed

Work session ended at 2026-06-19T20:58:19.771Z

The PR will be converted back to ready for review.

This comment marks the end of an AI work session. New comments after this time will be considered as feedback.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] requested changes

@skulidropek skulidropek Awaiting requested review from skulidropek

Assignees

@skulidropek skulidropek

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@skulidropek @konard