LiteSun opened a new pull request, #3476:
URL: https://github.com/apache/apisix-dashboard/pull/3476
Please answer these questions before submitting a pull request, **or your PR
will get closed**.
**Why submit this pull request?**
- [ ] Bugfix
- [ ] New feature provided
- [ ] Improve performance
- [ ] Backport patches
- [x] Dependency maintenance
**What changes will this PR take into?**
Consolidates the ten Dependabot PRs still open after #3475 into one reviewed
change. Each dependency is taken to its current release rather than the (now
stale) version the bot proposed, and the release notes between the two versions
were checked for breaking changes.
npm:
| Package | Before | After | Notes |
| --- | --- | --- | --- |
| @tanstack/react-router | ^1.168.3 | ^1.170.44 | supersedes #3401; the two
minor bumps (1.169 `params.parse` may return `false`, 1.170 "clean minor bump")
add nothing we rely on |
| @tanstack/router-plugin | ^1.167.4 | ^1.168.46 | supersedes #3403; moves
to chokidar 5 and drops its @babel/* and recast dependencies |
| @tanstack/react-router-devtools | ^1.166.11 | ^1.167.2 | kept in step with
the router |
| monaco-editor | ^0.52.2 | ^0.57.0 | supersedes #3402; see the code changes
below |
| jiti | ^2.4.2 | ^2.7.0 | supersedes #3400 |
| dayjs | ^1.11.20 | ^1.11.23 | supersedes #3399; 1.11.22/23 are
timezone-plugin fixes |
| dompurify (override) | 3.4.15 | >=3.4.16 | new; monaco-editor pins 3.4.15,
which has two low-severity advisories |
GitHub Actions:
| Action | Before | After | Notes |
| --- | --- | --- | --- |
| actions/checkout | v6 | v7 | supersedes #3407; v7 only blocks fork
checkouts on `pull_request_target` / `workflow_run`, which none of our
workflows use |
| actions/setup-node | v6 | v7 | supersedes #3430; ESM migration, no input
changes |
| actions/github-script | v6 | v9 | supersedes #3375; v9 drops
`require('@actions/github')` and injects `getOctokit`, neither of which the e2e
label script uses |
| apache/skywalking-eyes/header | commit ab3d1fe (May) | commit a196742 `#
v0.9.0` | supersedes #3425 and #3406 (both bump the same line to different main
commits); pinned to the v0.9.0 release with a version comment, the same style
as the pnpm/action-setup pin |
Code changes the bumps required:
- monaco-editor 0.56 reorganised its ESM entry points: `exports` now maps
`./*` to `./esm/vs/*.js`, so the `monaco-editor/esm/vs/...` deep imports in
`src/utils/monaco.ts` stopped resolving (and `editor.all.js` no longer exists).
The file now imports the public `monaco-editor` entry plus the
`editor/editor.worker` and `languages/features/json/json.worker` workers. 0.55
moved the JSON language namespace to the top level, so `FormItemEditor` reads
`monaco.json.jsonDefaults` instead of `monaco.languages.json.jsonDefaults`.
- TanStack Router now types `ErrorComponentProps.error` as `unknown`;
`PageError` narrows it before reading `.message`.
- `src/routeTree.gen.ts` was regenerated by the new router-plugin. The
generator now orders routes deterministically, so the diff is a pure reorder
(358 lines moved, nothing added or removed).
Things to be aware of:
- The `monaco-editor-vendor` chunk grows from 3.3 MB to 4.1 MB (gzip 846 kB
→ 1.07 MB). The `manualChunks` entry names the whole `monaco-editor` package,
so the chunk has always bundled every language and feature; the 0.57 entry
simply bundles more (LSP client, new features). Switching to the modular
`monaco-editor/editor` + `features/register.all` +
`languages/features/json/register` entry points and a function-form
`manualChunks` would shrink it well below the old size. Left as a follow-up to
keep this PR to the dependency bumps.
- `pnpm audit` is down to the single `braces` finding, now reachable only
through lint-staged → micromatch (chokidar 5 dropped the other path). braces
has no fixed release.
**Related issues**
Supersedes #3401, #3403, #3402, #3400, #3399, #3407, #3430, #3375, #3425 and
#3406.
**Checklist:**
- [x] Did you explain what problem does this PR solve? Or what new features
have been added?
- [ ] Have you added corresponding test cases? (dependency bumps; covered by
the existing unit and e2e suites)
- [ ] Have you modified the corresponding document? (no documentation impact)
- [x] Is this PR backward compatible? If it is not backward compatible,
please discuss on the mailing list first
Verification (pnpm 10.34.4):
- `pnpm install --frozen-lockfile`, `pnpm lint`, `pnpm exec tsc -b`, `pnpm
test` (163 tests) and `vite build` all pass
- The Playwright e2e suite is left to CI on this PR
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
