-
Notifications
You must be signed in to change notification settings - Fork 5
build(deps): bump jsdom from 26.1.0 to 30.0.1 in /server - #2256
build(deps): bump jsdom from 26.1.0 to 30.0.1 in /server #2256dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [jsdom](https://github.com/jsdom/jsdom) from 26.1.0 to 30.0.1. - [Release notes](https://github.com/jsdom/jsdom/releases) - [Commits](jsdom/jsdom@v26.1.0...v30.0.1) --- updated-dependencies: - dependency-name: jsdom dependency-version: 30.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🟡 (optional) jsdom 30 requires Node "^22.22.2 || ^24.15.0 || >=26.0.0" (per package-lock.json line 9024-9026), but the repo's root package.json engines field only requires ">=24.0.0", leaving Node 24.0.0-24.14.x as a valid install target that fails jsdom's own engine check. Fix: bump the root engines.node floor to match jsdom's actual minimum (e.g. ">=24.15.0") or pin CI/Docker to a Node build already above that floor.
Extended reasoning...
A developer or CI runner with Node 24.10 (valid per root engines >=24.0.0) runs npm install in server/; npm emits an EBADENGINE warning for jsdom (and may hard-fail if npm's engine-strict or CI treats warnings as errors), whereas before this bump jsdom ^26 had no such narrow floor and any Node>=24 worked. This is a new install-time inconsistency introduced by the version bump, not present on the base branch, and CLAUDE.md's engines contract (root package.json line 148) is now silently violated by one of its own runtime dependencies.
Verification: Severity: nit. The mismatch is real: server/package-lock.json (lines 9024-9026) shows the resolved jsdom now requires "node": "^22.22.2 || ^24.15.0 || >=26.0.0", while the root package.json:148 engines is "node": ">=24.0.0" (server/package.json has no engines field). So Node 24.0.0-24.14.x satisfies the repo contract but fails jsdom's declared engine range — a real inconsistency...
Bumps jsdom from 26.1.0 to 30.0.1.
Release notes
Sourced from jsdom's releases.
... (truncated)
Commits
658448530.0.10c51df6Update dependencies and dev dependencies32adb34Bump@asamuzakjp/dom-selector70f014aSpeed up range operations on large documents250d7eePartially fix getComputedStyle with calc()20a01fc30.0.08c8e583Precompute WPT expectation matchesf32245cBump Node.js floor and dependencies03ef23bAdd background-position longhandsded056fTest CSS.escape() with numeric IDsMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for jsdom since your current version.
Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Dependabot compatibility score
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)