build(deps): take seven dependency majors the slog can verify - #2937
Merged
Conversation
v2 is ESM-only and reorganized: import sha256 from /sha2.js (with the now- mandatory .js extension), and inputs are Uint8Array-only — makeDigest now UTF-8-encodes via utf8ToBytes, which yields the identical digest v1 produced internally. @noble/hashes is statically-importable ESM (Class 1), so jest can load it once transformed: add it to transformIgnoreModules in defaultConfig (every projects entry spreads it; the top-level transform does not cascade into projects) and in jest.config.simple.ts. Documented the Class-1/Class-2 ESM triage in the pin ledger.
Root devDependency with no source imports (only the English word 'unified' appears in comments), so this is a lockfile-only update.
Aligns all three declarations (root + malloy + malloy-filter) on ^30.4.1 instead of leaving a 27/29/30 split with duplicate copies. jest-diff 30 still ships CJS (require export intact), so it loads under jest unchanged. Also moves jest-diff to devDependencies in malloy and malloy-filter: it's imported only from *.spec.ts, so declaring it a runtime dependency needlessly pulled it (and its chalk subtree) into consumers' production installs.
Not to 6: @types/jasmine tracks the jasmine-core major, and syntax-highlight runs on jasmine-core 5. Dependabot's 4->6 would put the types a major ahead of the runtime (the same footgun @types/node is pinned against), so this bumps to the latest 5.x to match, and ignores the major in dependabot.yml until a deliberate jasmine-core 5->6 bump moves both together.
yargs 18 is ESM-only. Its only consumer is scripts/gen-flow.ts (run via ts-node during the femto flow-type build); verified it loads and parses there on Node 24 via require(esm), so no transform/migration is needed. devDependency, not shipped.
Used in malloy-render's vite.config.base.mts to emit the library .d.ts bundle. Verified a real `vite build` generates the declarations cleanly under v5.
Unholds uuid. The hold rested on PR #2779 being "unmergeable," but its CI was red on a stale `jest-util` lockfile error, not anything uuid — and our code already uses the v7+ named-import style (`import {v4} from 'uuid'`), so the six-major jump needs no source change. uuid 14 is ESM-only (its `node` export condition is itself ESM), i.e. the same Class-1 case as @noble/hashes: add `uuid` to transformIgnoreModules in both jest configs and jest loads it. Dropped the now-redundant @types/uuid (v9+ bundles its own types), removed the dependabot major-ignore, and deleted the uuid pin from the ledger.
mtoy-googly-moogly
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Working through the Dependabot major backlog by hand, since each major needs a deliberate decision rather than a blind merge. This is the batch that compiles, tests, and builds green — seven bumps, each verified locally (full
npm run build+precheckpass). Supersedes Dependabot PRs #2936, #2912, #2917, #2927, #2935, #2913, #2779.Taken
sha256moved to/sha2.js, the.jsextension is now mandatory, and string inputs are gone (encode viautf8ToBytes, which reproduces v1's internal encoding — identical digest). It's static ESM, so jest loads it once transformed: added totransformIgnoreModulesindefaultConfig(theprojectsentries spread it; the top-leveltransformdoesn't cascade) and the simple config. The pin ledger now documents the Class-1 (static ESM → transform & take) vs Class-2 (runtime dynamicimport()of ESM, e.g. the bigquery/gaxios hold → can't) distinction so this is a known triage, not a recurring surprise.jest-utillockfile error, not uuid; our code already uses the v7+ named-import style, so the six-major jump needs no source change. uuid 14 is ESM-only (Class 1, same as noble) → added totransformIgnoreModules. Dropped the now-redundant@types/uuid(v9+ bundles types), removed the dependabot major-ignore, and deleted the uuid pin from the ledger.devDependenciesinmalloy/malloy-filter: it's imported only from*.spec.ts, so declaring it a runtime dependency was needlessly shipping it (and its chalk subtree) to consumers.jasmine-coremajor, which syntax-highlight holds at 5; 4→6 would put the types a major ahead of the runtime (the footgun@types/nodeis pinned against). Bumped to latest 5.x and ignored the major until a deliberatejasmine-core5→6.scripts/gen-flow.ts(ts-node), which loads it fine viarequire(esm)on Node 24..d.tsbundler; a realvite buildemits declarations cleanly under v5.Deliberately left out
@storybook/*packages to 10. Storybook needs one major across all packages, so this is a coordinated 8→10 migration (all packages + thestorybook upgradecodemod +.storybookconfig), not a piecemeal bump. Left to sit.