👷 Update all non-major dependencies (minor/patch) - #162
Conversation
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
PR Review — Score: 3.0 / 5
Routine Renovate dependency bumps for dev tooling and the runtime dd-trace dependency. Root and playground lockfiles are in sync, but four e2e integration apps have package.json version bumps without matching yarn.lock updates — Renovate's artifact step failed for those apps. I would not merge as-is; regenerate the integration lockfiles (or rebase/retry the Renovate branch) so installs are deterministic before approval.
Why 3.0: The core SDK lockfile updates look correct and the version bumps are all minor/patch. The integration-app lockfile drift is a concrete merge risk that Renovate already flagged.
Why not 5: Four integration yarn.lock files are stale relative to their package.json changes, leaving package/lock mismatch on the bundler apps this repo exercises in CI.
Findings
- [Blocking] Stale integration lockfiles —
vite/webpackbumps in four e2e apps lack correspondingyarn.lockupdates after Renovate artifact failure.
CI was still running (dd-gitlab/* pending) when this review was posted.
Sent by Cursor Automation: electron-sdk reviews
| "electron": "41.1.0", | ||
| "typescript": "5.9.3", | ||
| "vite": "8.0.16" | ||
| "vite": "8.1.0" |
There was a problem hiding this comment.
Blocking — lockfile not updated. Renovate bumped vite here to 8.1.0, but e2e/integration/apps/forge-vite/yarn.lock still resolves vite@npm:8.0.16. The same mismatch exists for:
electron-builder-vite(8.1.0vs lock8.0.16)electron-vite-esm(7.3.6vs lock7.3.5)forge-webpack(5.108.1vs lock5.107.2)
Renovate's PR comment reports artifact update failures for all four apps (missing integration-sdk.tgz in its sandbox). Locally, run yarn install in each app (or trigger a Renovate rebase) so lockfiles match before merge.
| }, | ||
| "dependencies": { | ||
| "dd-trace": "5.109.0" | ||
| "dd-trace": "5.110.0" |
There was a problem hiding this comment.
Only runtime dependency change in this PR. Root yarn.lock is updated and pulls in @datadog/pprof@5.15.1 and import-in-the-middle@3.2.0 (was 3.0.1). No SDK source changes, but worth a quick sanity check that trace initialization and bundler plugin scenarios still pass once CI completes — import-in-the-middle hooks module loading used by dd-trace instrumentation.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b6831ff0ab
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| "electron-builder": "26.15.3", | ||
| "typescript": "5.9.3", | ||
| "vite": "8.0.16" | ||
| "vite": "8.1.0" |
There was a problem hiding this comment.
This manifest update, along with the matching Vite/Webpack bumps in electron-vite-esm, forge-vite, and forge-webpack, leaves the standalone app lockfiles pinned to the previous top-level specs (vite 8.0.16/7.3.5 and webpack 5.107.2). When scripts/install-integration-apps.ts installs these apps it updates and then restores each yarn.lock, so the committed locks no longer capture the dependency graph actually tested and immutable/local installs from the repo are out of sync. Please update the four app yarn.lock files with the manifest changes.
Useful? React with 👍 / 👎.
81b3929 to
39c652a
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 39c652a046
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| }, | ||
| "dependencies": { | ||
| "dd-trace": "5.109.0" | ||
| "dd-trace": "5.111.0" |
There was a problem hiding this comment.
With this root dependency bumped to 5.111.0, the integration app locks are now stale: every e2e/integration/apps/*/yarn.lock still resolves the packed SDK tarball to dd-trace 5.109.0 (for example e2e/integration/apps/electron-builder-vite/yarn.lock:47), and scripts/install-integration-apps.ts updates then restores those lockfiles after packaging. Separate from the existing Vite/Webpack lock drift, the fresh evidence is that all app locks still contain the old SDK tarball dependency, so the committed dependency graph no longer matches what test:integration:init installs for this tracer update.
Useful? React with 👍 / 👎.
| }, | ||
| "dependencies": { | ||
| "dd-trace": "5.109.0" | ||
| "dd-trace": "5.111.0" |
There was a problem hiding this comment.
The minimal E2E app also consumes the root package through portal:../.., but e2e/app/yarn.lock still records that portal dependency as requiring dd-trace 5.109.0. The e2e GitLab job runs yarn test:e2e:init, whose cd e2e/app && yarn install has no --no-immutable; Yarn documents that --immutable defaults to true on CI and aborts if the lockfile would change (https://yarnpkg.com/cli/install). In CI this lockfile mismatch blocks setup before the e2e tests can run, so please update e2e/app/yarn.lock with the tracer bump.
Useful? React with 👍 / 👎.
19e47d0 to
096d103
Compare
902c646 to
dc9f6bf
Compare
ac19f55 to
972b80e
Compare
de4e32c to
f0aada8
Compare
09cc6ad to
43ba69a
Compare
154340e to
897c706
Compare
f36fc20 to
5aa3ba6
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b2862a7a9d
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| "@vitest/coverage-v8": "4.1.11", | ||
| "@vitest/ui": "4.1.11", |
There was a problem hiding this comment.
When yarn test:unit runs vitest run --coverage, Vitest 4.1.10 loads this 4.1.11 coverage provider. The packages require exact matching versions—the generated lockfile records @vitest/coverage-v8 4.1.11 requiring Vitest 4.1.11, while the manifest still installs Vitest 4.1.10—and Vitest rejects mixed core/provider versions, preventing the unit suite from starting with coverage. Update vitest to 4.1.11 alongside the coverage and UI packages.
Useful? React with 👍 / 👎.
This PR contains the following updates:
7.5.0→7.12.07.5.0→7.12.07.5.0→7.12.00.0.5→0.0.131.61.1→1.62.11.63.01.10.0→1.11.04.1.10→4.1.114.1.10→4.1.11v7.0.0→v7.0.110.0.3→10.0.57.1.4→7.1.56.10.0→6.13.06.15.0(+1)0.28.1→0.28.210.7.0→10.9.110.10.017.1.0→17.4.117.5.1(+1)1.61.1→1.62.11.63.03.9.5→3.9.64.62.2→4.63.16.4.1→6.5.18.64.0→8.69.08.70.08.1.5→8.2.28.3.05.108.4→5.110.34.17.1→4.18.04.17.1→4.18.0Release Notes
DataDog/browser-sdk (@datadog/browser-core)
v7.12.0Compare Source
Public Changes:
v7.11.0Compare Source
Public Changes:
Internal Changes:
v7.10.0Compare Source
Public Changes:
Internal Changes:
v7.9.0Compare Source
Public Changes:
Internal Changes:
v7.8.0Compare Source
Public Changes:
Internal Changes:
v7.7.0Compare Source
Public Changes:
Internal Changes:
v7.6.1Compare Source
Public Changes:
Internal Changes:
v7.6.0Compare Source
Public Changes:
Internal Changes:
DataDog/browser-sdk (@datadog/js-core)
v0.0.13Compare Source
v0.0.12Compare Source
v0.0.11Compare Source
v0.0.10Compare Source
v0.0.9Compare Source
v0.0.8Compare Source
v0.0.7Compare Source
v0.0.6Compare Source
microsoft/playwright (@playwright/test)
v1.62.1Compare Source
v1.62.0Compare Source
🧱 New component testing model
Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a
gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates
to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:
Pass a story type as a template argument to type-check its props, and use
update(props)/unmount()on the returned locator to re-render or tear down within a test.🛑 Cancel operations with AbortSignal
Most operations and web-first assertions now accept a
signaloption that takes anAbortSignal, letting youcancel long-running actions, navigations, waits, and assertions:
Providing a signal does not disable the default timeout; pass
timeout: 0to disable it.🖼️ WebP screenshots
expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot()
can now store snapshots in the WebP format — just give the snapshot a
.webpname:page.screenshot() and locator.screenshot() also accept
webpas atype,where quality
100(the default) is lossless and lower values use lossy compression.🧩 Custom test filtering with Reporter.preprocess()
New reporter.preprocess() hook runs after the configuration is resolved and before
reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded,
fixed, or failing through a TestRun object:
🔁 Isolated retries
New testConfig.retryStrategy controls when failed tests are retried. The default
'immediate'retries as soon as a worker is free;'isolated'runs all retries at the end,one by one in a single worker, to minimize interference with the rest of the suite:
New APIs
Browser and Context
credentialsincludes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.Actions
scrolloption ("auto"|"none") on actions to opt out of Playwright's automatic scroll-into-view.Network
Evaluation
Command line & MCP
playwright-cli, runnable vianpx playwright mcpandnpx playwright cli.Reporters
mergeFilesreporter option:Announcements
Browser Versions
This version was also tested against the following stable channels:
vercel/webpack-asset-relocator-loader (@vercel/webpack-asset-relocator-loader)
v1.11.0Compare Source
Features
v1.10.3Compare Source
Bug Fixes
v1.10.2Compare Source
Bug Fixes
vitest-dev/vitest (@vitest/coverage-v8)
v4.1.11Compare Source
🐞 Bug Fixes
View changes on GitHub
actions/checkout (actions/checkout)
v7.0.1Compare Source
open-cli-tools/concurrently (concurrently)
v10.0.5Compare Source
What's Changed
New Contributors
Full Changelog: open-cli-tools/concurrently@v10.0.4...v10.0.5
v10.0.4Compare Source
What's Changed
New Contributors
Full Changelog: open-cli-tools/concurrently@v10.0.3...v10.0.4
webpack/css-loader (css-loader)
v7.1.5Compare Source
DataDog/dd-trace-js (dd-trace)
v6.13.0: 6.13.0Compare Source
Features
Fixes
Performance
Internal (CI, Testing, Benchmarking)
Contributors
v6.12.0: 6.12.0Compare Source
Features
Fixes
Performance
Internal (CI, Testing, Benchmarking)
Contributors
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.