chore(deps): consolidated dependency update by prisis · Pull Request #1071 · anolilab/javascript-style-guide

prisis · 2026-07-21T21:50:13Z

Summary

Consolidates the pending Renovate updates from the Dependency Dashboard (#245) and open PRs #1064–#1068 into one reviewed change, and includes the urgent js-yaml release fix (also in #1070).

Important

This also fixes the broken Semantic Release workflow on main. The audit-fix override js-yaml@>=4.0.0 <4.3.0: ">=4.3.0" was unbounded, so pnpm pulled js-yaml 5.x (ESM-only, no default export), which broke multi-semantic-release. Bounded to ^4.3.0. If you want the fastest unblock, merge #1070 first (the one-line subset); merging this PR fixes it too.

Included

Safe catalog bumps (all >24h old): @anolilab/eslint-config 28.0.2, @anolilab/prettier-config 10.0.2, @eslint-react/eslint-plugin 5.17.3, eslint-plugin-jsdoc 63.2.0, eslint-plugin-storybook + storybook 10.5.3, typescript-eslint / @typescript-eslint/* 8.65.0, browserslist-config-anolilab 9.0.1, @visulima/package 5.0.5, @visulima/tsconfig 3.2.0.

Security overrides → latest patched (non-major): axios >=1.18.1, chrono-node >=2.10.0, fast-uri >=3.1.4, @hono/node-server >=2.0.10, hono >=4.12.30, ip-address >=10.2.0, picomatch >=4.0.5, postcss >=8.5.19, shell-quote >=1.10.0, undici >=6.27.0 / 8.7.0, yaml >=2.9.0, +svgo >=4.0.2 (GHSA-2p49-hgcm-8545, newly surfaced).

Peer-range alignments: stylelint-config +17.x, commitlint-config +^21.0.0, eslint-config eslint-plugin-format >=2.0.1, lint-staged-config husky ^9.1.7 / jest +^30 / lint-staged +^17 / secretlint ^11.7.1 || ^12 || ^13.

CI actions: anolilab/workflows v20.2.10 → v21.0.0 (13 workflows), actions/labeler v6 → v7.

Node: .nvmrc 22.22 → 22.23.

Excluded (deliberately — each needs its own tested PR)

typescript 7 — the whole ecosystem caps at <6.1.0 (typescript-eslint, @visulima/packem-rollup); it broke this repo before.
Override majors (js-yaml 5, undici 8, fast-uri 4, brace-expansion 5) — js-yaml 5 is the exact thing that broke releases; the others carry the same release/runtime-break risk that build/test can't catch. Overrides stay at latest patched instead.
Node 24 — .nvmrc=24 would need a matching CI node-version bump (workflows run 22.x; preinstall is skipped in CI so .nvmrc isn't even enforced there), and it can't be verified from a node-22 machine. Deferred to a dedicated, node-24-tested PR.
24h-quarantined patches — prettier 3.9.6, react 19.2.8, secretlint 13.0.3, browserslist 4.28.7, postcss 8.5.21, @tanstack/eslint-plugin-query 5.101.4, pkg-pr-new 0.0.79 (all published <24h ago; minimumReleaseAge blocks them). They age out and Renovate picks them up.

Verification

install, dedupe, pnpm audit (clean at moderate and low), build (8), types (9), lint (6), attw (9), prettier (9), tests (6), and multi-semantic-release --dry-run (the js-yaml guard) all pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_014Hm4zrh4o8w3Qcs24BvpV9

Summary by CodeRabbit

Maintenance
- Updated automated project workflows to newer revisions for more reliable checks, releases, security scanning, and issue management.
- Updated the supported Node.js runtime version.
Compatibility
- Expanded support for newer versions of commit, linting, testing, and styling tools.
- Refreshed development tooling and package version management.
Security
- Updated version constraints to incorporate current security patches across the toolchain.

The audit-fix override `js-yaml@>=4.0.0 <4.3.0: ">=4.3.0"` was unbounded above, so pnpm resolved js-yaml 5.x, which is ESM-only with no default export. That broke multi-semantic-release (`import ... from "js-yaml"`) and failed the Semantic Release workflow on main, blocking all publishes. Bounds the override to `^4.3.0` — still patches GHSA-52cp-r559-cp3m but keeps js-yaml on 4.x with its default export. Verified: `multi-semantic-release --dry-run` loads every package again, and `pnpm audit --audit-level=moderate` reports no known vulnerabilities. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Consolidates the pending Renovate updates (dashboard #245, PRs #1064-1068) into one reviewed change. Excludes known-breaking updates. Safe catalog bumps: @anolilab/eslint-config 28.0.2, @anolilab/prettier-config 10.0.2, @eslint-react/eslint-plugin 5.17.3, eslint-plugin-jsdoc 63.2.0, eslint-plugin-storybook + storybook 10.5.3, typescript-eslint / @typescript-eslint/* 8.65.0, browserslist-config-anolilab 9.0.1, @visulima/package 5.0.5, @visulima/tsconfig 3.2.0. Security overrides bumped to latest PATCHED (non-major): axios >=1.18.1, chrono-node >=2.10.0, fast-uri >=3.1.4, @hono/node-server >=2.0.10, hono >=4.12.30, ip-address >=10.2.0, picomatch >=4.0.5, postcss >=8.5.19, shell-quote >=1.10.0, undici >=6.27.0 / 8.7.0, yaml >=2.9.0. Adds svgo >=4.0.2 (GHSA-2p49-hgcm-8545). js-yaml stays ^4.3.0 (5.x breaks multi-semantic-release). Peer-range alignments: stylelint-config +17.x, commitlint-config +^21.0.0, eslint-config eslint-plugin-format >=2.0.1, lint-staged-config husky ^9.1.7 / jest +^30 / lint-staged +^17 / secretlint ^11.7.1||^12||^13. CI actions: anolilab/workflows v20.2.10 -> v21.0.0, actions/labeler v6 -> v7. Node: .nvmrc 22.22 -> 22.23. Excluded (need separate, individually-tested PRs): typescript 7 (ecosystem caps at <6.1.0), override majors (js-yaml 5 / undici 8 / fast-uri 4 / brace-expansion 5), node 24 (needs CI node-version bump + can't verify on node 22), and patch bumps still inside the 24h release-age quarantine (prettier 3.9.6, react 19.2.8, secretlint 13.0.3, browserslist 4.28.7, postcss 8.5.21, @tanstack/eslint-plugin-query 5.101.4, pkg-pr-new 0.0.79). Verified: install, dedupe, audit (moderate+low clean), build, types, lint, attw, prettier, tests, and multi-semantic-release --dry-run all pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

github-actions · 2026-07-21T21:50:28Z

Thank you for following the naming conventions! 🙏

coderabbitai · 2026-07-21T21:50:31Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 4e8d7ede-7ac9-4d74-8233-282ab677c71b

📥 Commits

Reviewing files that changed from the base of the PR and between 6aa21f9 and 5f370fe.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (20)

.github/workflows/allo-allo.yaml
.github/workflows/cache-clear.yml
.github/workflows/codeql.yml
.github/workflows/dependency-review.yml
.github/workflows/labeler.yml
.github/workflows/lint.yml
.github/workflows/lock-file-maintenance.yml
.github/workflows/lock-issues.yaml
.github/workflows/preview-release.yaml
.github/workflows/scorecards.yml
.github/workflows/semantic-release.yml
.github/workflows/stale-issues.yml
.github/workflows/test.yml
.github/workflows/zizmor.yml
.nvmrc
packages/commitlint-config/package.json
packages/eslint-config/package.json
packages/lint-staged-config/package.json
packages/stylelint-config/package.json
pnpm-workspace.yaml

📝 Walkthrough

Walkthrough

GitHub Actions pins were updated to newer revisions. Node.js moved to 22.23, package peer ranges and catalog references were revised, workspace tooling versions were bumped, and dependency override constraints were updated.

Changes

Toolchain and dependency refresh

Layer / File(s)	Summary
Reusable workflow pin updates `.github/workflows/*`	Reusable workflows and the labeler action now use newer pinned revisions, primarily moving from v20.2.10 to v21.0.0.
Package compatibility declarations `packages/*/package.json`	Package manifests now use shared catalog references and expand compatibility ranges for commitlint, ESLint format, Husky, Jest, Secretlint, and Stylelint.
Workspace catalog updates `pnpm-workspace.yaml`	Linting, Storybook, Stylelint, TypeScript tooling, browserslist, and internal package catalog versions were updated.
Security overrides and runtime pin `pnpm-workspace.yaml`, `.nvmrc`	Dependency override constraints were revised, and the Node.js version changed from 22.22 to 22.23.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

anolilab/monorepo-template#2 — Tracks overlapping GitHub Actions and workspace dependency updates.
anolilab/resume#3 — Covers dependency versions, workflow pins, and tooling manifests.
anolilab/workflows#3 — Directly overlaps on workflow pins, Node.js, and dependency updates.

Possibly related PRs

anolilab/javascript-style-guide#1070 — Updates overlapping pnpm-workspace.yaml dependency override rules for js-yaml.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change set: a consolidated dependency update across packages and workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/consolidated-deps-update

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

socket-security · 2026-07-21T21:51:17Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@typescript-eslint/parser@8.65.0
	typescript-eslint@8.65.0
	@typescript-eslint/types@8.65.0
	@visulima/package@5.0.5
	eslint-plugin-jsdoc@63.2.0
	storybook@10.5.3
	@eslint-react/eslint-plugin@5.17.3
	stylelint@17.14.1
	eslint-plugin-storybook@10.5.3

View full report

socket-security · 2026-07-21T21:51:19Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `eslint-plugin-jsdoc` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: packages/eslint-config/package.json → `npm/eslint-plugin-jsdoc@63.2.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/eslint-plugin-jsdoc@63.2.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

pkg-pr-new · 2026-07-21T21:54:54Z

Open in StackBlitz

browserslist-config-anolilab

npm i https://pkg.pr.new/browserslist-config-anolilab@1071

@anolilab/commitlint-config

npm i https://pkg.pr.new/@anolilab/commitlint-config@1071

@anolilab/eslint-config

npm i https://pkg.pr.new/@anolilab/eslint-config@1071

@anolilab/lint-staged-config

npm i https://pkg.pr.new/@anolilab/lint-staged-config@1071

@anolilab/oxfmt-config

npm i https://pkg.pr.new/@anolilab/oxfmt-config@1071

@anolilab/oxlint-config

npm i https://pkg.pr.new/@anolilab/oxlint-config@1071

@anolilab/prettier-config

npm i https://pkg.pr.new/@anolilab/prettier-config@1071

@anolilab/stylelint-config

npm i https://pkg.pr.new/@anolilab/stylelint-config@1071

@anolilab/textlint-config

npm i https://pkg.pr.new/@anolilab/textlint-config@1071

commit: 5f370fe

prisis and others added 2 commits July 21, 2026 22:13

github-actions Bot added package: eslint-config package: commitlint-config package: lint-staged-config package: stylelint-config labels Jul 21, 2026

prisis merged commit db9bb06 into main Jul 21, 2026
27 checks passed

prisis deleted the chore/consolidated-deps-update branch July 21, 2026 21:57

prisis mentioned this pull request Jul 21, 2026

fix(deps): pin js-yaml override to 4.x to unbreak semantic-release #1070

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(deps): consolidated dependency update - #1071

chore(deps): consolidated dependency update#1071
prisis merged 2 commits into
mainfrom
chore/consolidated-deps-update

prisis commented Jul 21, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

github-actions Bot commented Jul 21, 2026

Uh oh!

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

socket-security Bot commented Jul 21, 2026

Uh oh!

socket-security Bot commented Jul 21, 2026

Uh oh!

pkg-pr-new Bot commented Jul 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

prisis commented Jul 21, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Included

Excluded (deliberately — each needs its own tested PR)

Verification

Summary by CodeRabbit

Uh oh!

github-actions Bot commented Jul 21, 2026

Uh oh!

coderabbitai Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

socket-security Bot commented Jul 21, 2026

Uh oh!

socket-security Bot commented Jul 21, 2026

Uh oh!

pkg-pr-new Bot commented Jul 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

prisis commented Jul 21, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading