Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
There was a problem hiding this comment.
Pull request overview
This PR bumps the @node-core/ui-components package from version 1.5.3 to 1.5.4, continuing work from a previous review. This is a patch version update that includes the corresponding lockfile updates.
Changes:
- Updated
@node-core/ui-componentsdependency version in package.json - Updated npm-shrinkwrap.json with new package version and automatic peer dependency flag adjustments
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| package.json | Bumped @node-core/ui-components from 1.5.3 to 1.5.4 |
| npm-shrinkwrap.json | Updated lockfile with new package version, integrity hash, and automated peer dependency flags |
Files not reviewed (1)
- npm-shrinkwrap.json: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #564 +/- ##
=======================================
Coverage 79.97% 79.97%
=======================================
Files 127 127
Lines 12276 12276
Branches 866 866
=======================================
Hits 9818 9818
Misses 2455 2455
Partials 3 3 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
How long is the Dependabot update cycle? Moreover, it seems that simply updating the component library is not enough, it appears that related logic also needs to be added. |
2 weeks, probably, but I can trigger Dependabot earlier if needed
Noted. In my opinion, non-members shouldn't be updating dependencies, since it sets a bad precedent security-wise. wdyt @nodejs/web-infra @nodejs/security-wg |
|
Yep completely agree, and quite honestly, I'd prefer the no one is manually bumping deps, leaving it completely with Dependabot. If code changes are needed as a result of a dep bump, a member can push code changes to the Dependabot branch when it is created. |
|
Given that, I appreciate your contributions @btea, but we won't accept a manual version bump PR at this time, thank you! |
4 participants
Description
continue #562 (review)
Validation
Related Issues
Check List
node --run testand all tests passed.node --run format&node --run lint.