-
Notifications
You must be signed in to change notification settings - Fork 5
build(deps-dev): bump the all-patches group with 2 updates - #2247
build(deps-dev): bump the all-patches group with 2 updates #2247dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the all-patches group with 2 updates: [@testing-library/react](https://github.com/testing-library/react-testing-library) and [eslint](https://github.com/eslint/eslint). Updates `@testing-library/react` from 16.3.2 to 16.3.3 - [Release notes](https://github.com/testing-library/react-testing-library/releases) - [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md) - [Commits](testing-library/react-testing-library@v16.3.2...v16.3.3) Updates `eslint` from 10.9.0 to 10.9.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.9.0...v10.9.1) --- updated-dependencies: - dependency-name: "@testing-library/react" dependency-version: 16.3.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-patches - dependency-name: eslint dependency-version: 10.9.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-patches ... Signed-off-by: dependabot[bot] <support@github.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, straightforward devDependency patch bump.
What was reviewed: confirmed the diff only touches two devDependencies (@ testing-library/react ^16.2.0 → ^16.3.3, eslint ^10.9.0 → ^10.9.1) in package.json with matching package-lock.json updates; no source, config, or documentation files are touched.
Extended reasoning...
Overview
This PR is a Dependabot-authored dependency bump touching only package.json and package-lock.json. The diff confirms exactly two devDependency version changes: @ testing-library/react from ^16.2.0 to ^16.3.3 and eslint from ^10.9.0 to ^10.9.1. No application, server, or client source code is modified, and no configuration files under contents/ are touched.
Security risks
None identified. Both packages are well-known, widely-used devDependencies (a React testing utility and the ESLint linter) with no runtime footprint in production code. The version bumps are patch-level releases per the upstream changelogs referenced in the PR description (a bugfix for act() re-entrancy in testing-library, and a false-positive fix in an ESLint rule plus doc/chore updates). There is no indication of supply-chain risk beyond the inherent trust already placed in these ecosystem-standard packages.
Level of scrutiny
This warrants minimal scrutiny. Per CLAUDE.md, dependency bumps that don't touch contents/ config files require no migration, and pure dependency bumps are exempted from the changelog requirement. The change is mechanical, self-contained, and matches its stated description exactly.
Other factors
The lockfile diff is consistent with the package.json change (verified via the provided diff), and there's no indication of unrelated or unexpected modifications. This is exactly the kind of small, well-scoped, low-risk change suited for automated approval.
Looks like these dependencies are updatable in another way, so this is no longer needed.
Uh oh!
There was an error while loading. Please reload this page.
Bumps the all-patches group with 2 updates: @testing-library/react and eslint.
Updates
@testing-library/reactfrom 16.3.2 to 16.3.3Release notes
Sourced from @testing-library/react's releases.
Commits
20ce75ffix: Avoid act() re-entrant when dispatching events (#1468)be9d81ddocs: fix typos in comments and types (#1446)Updates
eslintfrom 10.9.0 to 10.9.1Release notes
Sourced from eslint's releases.
Commits
5c8c24110.9.1a7f3b7dBuild: changelog update for 10.9.11e641c9fix: no-loss-of-precision false positive with trailing decimal point (#21251)ad74a8ddocs: add deprecation steps for EOL package versions (#21248)3c3ae53chore: update ecosystem plugins (#21249)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions