Skip to content
This repository was archived by the owner on Jul 6, 2026. It is now read-only.

chore(deps): bump the npm-web-nonbreaking group across 1 directory with 12 updates #271

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump the npm-web-nonbreaking group across 1 directory with 12 updates #271

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 12 additions & 12 deletions web/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,33 +18,33 @@
"@react-three/drei": "^10.0.0",
"@react-three/fiber": "^9.6.1",
"@react-three/rapier": "^2.1.0",
"framer-motion": "^12.40.0",
"fumadocs-core": "^16.9.3",
"framer-motion": "^12.42.2",

@mogplex mogplex Bot Jul 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical: Lockfile not updated — pnpm --frozen-lockfile will fail CI

web/package.json bumps 12 specifiers, but the PR does not include the matching lockfile update. This repo is a pnpm workspace (pnpm-workspace.yaml includes web; packageManager pnpm@10.12.4) with a single root pnpm-lock.yaml and no lockfile under /web. I verified pnpm-lock.yaml at the PR head ref — its web: importer still records the OLD specifiers/versions, e.g.:

  • framer-motion: specifier ^12.40.0 / version 12.40.0 (manifest now ^12.42.2; 12.40.0 does not even satisfy ^12.42.2)
  • next: ^16.2.7 / 16.2.7 (now ^16.2.10)
  • tailwindcss and @tailwindcss/postcss: 4.3.0 (now ^4.3.2)
  • typescript-eslint: 8.60.1 (now ^8.62.1)
  • globals: 17.6.0 (now 17.7.0)
  • plus @types/node, postcss, fumadocs-core, fumadocs-ui, eslint-config-next, @next/eslint-plugin-next.

listChangedFiles confirms only web/package.json changed, so the lockfile genuinely was not regenerated.

Impact: both CI jobs in .github/workflows/ci.yml (desktop-checks and frontend-checks) run pnpm install --frozen-lockfile, which refuses to install on a manifest/lockfile specifier mismatch (ERR_PNPM_OUTDATED_LOCKFILE). CI fails at the install step, so this cannot merge as-is; force-merging would break frozen installs for all consumers.

Likely cause: .github/dependabot.yml registers /web as its own package-ecosystem: npm directory; in a pnpm workspace the shared root lockfile then is not updated alongside the manifest.

Suggested fix:

  • Regenerate and commit the lockfile on this branch: pnpm install --lockfile-only (or pnpm install --no-frozen-lockfile), then commit pnpm-lock.yaml.
  • Longer term, update the Dependabot config to model the pnpm workspace (typically a single root / directory entry) so future update PRs include the lockfile.

"fumadocs-core": "^16.10.7",
"fumadocs-mdx": "^14.3.2",
"fumadocs-ui": "^16.9.3",
"next": "^16.2.7",
"fumadocs-ui": "^16.10.7",

@mogplex mogplex Bot Jul 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: Heads-up: fumadocs-ui 16.10.x changes the default TOC and translations API

Non-blocking heads-up, verified against the changelog embedded in the PR description. fumadocs-ui moves 16.9.3 → 16.10.7, which crosses two behavioral changes:

  • 16.10.2 changes the default table-of-contents variant: the redesigned TOC becomes the new default, and the "clerk" variant reverts to the original Clerk-like style.
  • 16.10.0 introduces a new translations API powered by fuma-translate; the API surface is the same, but some translation keys are renamed and unused labels are ignored (16.10.1 then stabilizes fuma-translate).

This stays within a semver minor, so no action is strictly required, but if the docs site customizes the TOC variant or provides custom translation strings, it's worth a quick visual check after the bump. fumadocs-core is bumped in lockstep (16.9.3 → 16.10.7), which is the correct pairing.

"next": "^16.2.10",
"react": "^19.2.7",
"react-dom": "^19.2.7",
"three": "^0.182.0",
"zustand": "^5.0.14"
},
"devDependencies": {
"@eslint/js": "^9.39.4",
"@next/eslint-plugin-next": "16.2.7",
"@tailwindcss/postcss": "^4.3.0",
"@types/node": "^22.19.20",
"@next/eslint-plugin-next": "16.2.10",
"@tailwindcss/postcss": "^4.3.2",
"@types/node": "^22.20.0",
"@types/react": "^19.2.17",
"@types/react-dom": "^19.1.0",
"@types/three": "^0.182.0",
"eslint": "^9.39.4",
"eslint-config-next": "^16.2.7",
"eslint-config-next": "^16.2.10",
"eslint-plugin-react": "7.37.5",
"eslint-plugin-react-hooks": "7.1.1",
"globals": "17.6.0",
"postcss": "^8.5.15",
"tailwindcss": "^4.3.0",
"globals": "17.7.0",
"postcss": "^8.5.16",
"tailwindcss": "^4.3.2",
"typescript": "^5.9.0",
"typescript-eslint": "^8.60.1",
"typescript-eslint": "^8.62.1",
"vite": "6.4.3"
}
}
Loading