test: beta prerelease vehicle for dependency bumps (do not merge) - #332
Closed
maximizeIT wants to merge 4 commits into
Closed
test: beta prerelease vehicle for dependency bumps (do not merge)#332maximizeIT wants to merge 4 commits into
maximizeIT wants to merge 4 commits into
Conversation
- bump GitHub Actions workflow versions (checkout, setup-node, create-github-app-token, semantic-release-action, yarn-lock-changes, gha-workflows techdocs template) - bump npm/yarn dependencies incl. major versions (eslint 8->9, prettier 2->3, jest-environment-jsdom 29->30, @rollup/plugin-commonjs 24->29, @commitlint/config-conventional 17->20, jsdoc-to-markdown 8->9, rollup-plugin-license, compare-versions) - migrate ESLint config from .eslintrc to flat config (eslint.config.js) via @eslint/eslintrc FlatCompat, required by ESLint 9 - bump eslint-plugin-prettier 4->5 for Prettier 3 compatibility - fix no-unused-vars error on unused catch binding, remove stale eslint-disable/eslint-env directives in test files - add yarn resolutions to patch Dependabot-flagged vulnerabilities: lodash, js-yaml (two branches), browserslist, baseline-browser-mapping - add yarn resolutions to patch additional transitive vulnerabilities surfaced by yarn audit: ajv, underscore, brace-expansion Verified locally: yarn lint, yarn test-unit, yarn build, prettier --check, and yarn audit (0 vulnerabilities) all pass. Co-authored-by: GitHub Copilot <copilot@noreply.github.com>
Temporary change to publish a beta prerelease of the dependency-bumps-and-security-fixes branch so it can be installed and verified in cc-plugins-client-sdk-showcase before merging to main. This commit must NOT be merged into main; revert before that PR lands. Co-authored-by: GitHub Copilot <copilot@noreply.github.com>
size-limit report 📦
|
actions/setup-node@v7 writes an .npmrc auth line referencing the NODE_AUTH_TOKEN env var for the scoped GitHub Packages registry. Unlike v4, yarn classic now fails to parse .npmrc during `yarn install --frozen-lockfile` if that env var isn't defined at all (not just empty), since the token was only set later for the actual Release step. Set it for the install step too so it's available when .npmrc is parsed. Co-authored-by: GitHub Copilot <copilot@noreply.github.com>
Co-authored-by: GitHub Copilot <copilot@noreply.github.com>
Contributor
Author
|
Validated end-to-end: beta |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This branch exists solely to trigger a beta prerelease publish of #331 (
chore/dependency-bumps-and-security-fixes) so the changes can be installed and manually verified in cc-plugins-client-sdk-showcase before that PR is merged.It contains one extra commit on top of #331 that temporarily adds a
betaprerelease branch to.releaserc. Once CI runs, semantic-release should publish a newx.y.z-beta.Nversion to GitHub Packages and npm under thebetadist-tag (existinglatestconsumers are unaffected).Plan:
cc-plugins-client-sdk-showcase'spackage.jsonto that version and test.betabranch without merging — the real changes ship via chore: bump dependencies and fix security vulnerabilities #331.🤖 Generated with assistance from GitHub Copilot.