chore(deps): update dependency brace-expansion@2 to v5 - #1917
chore(deps): update dependency brace-expansion@2 to v5#1917renovate[bot] wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
9eb24d1 to
a449ead
Compare
a449ead to
5cc8140
Compare
|
Closing — this bumps a scoped override band, not a dependency.
brace-expansion v5 dropped the callable CJS default that The 5.x line is already covered separately by Root cause fixed in #1928. |
Renovate Ignore NotificationBecause you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR. |
…downgrade (#1928) Renovate opened seven dependency PRs that must never merge. Six of them (#1917 #1918 #1919 #1920 #1923 #1924) bump pnpm override entries across a major boundary. Those keys are selectors, not package names: "yaml@1" means "consumers resolving to yaml v1 get this patched v1", so raising the value to 2.9.0 forces a v2 API onto v1 consumers. Two are already red in CI ("TypeError: expand is not a function" for brace-expansion@2 -> ^5.0.0, and gray-matter's yaml.safeLoad.bind() for js-yaml ^3.15.0 -> ^5.0.0); the rest are green only because CI never exercises the affected transitive consumers -- the same blind spot that let #1904 ship the minimatch v10 break that #1913 had to revert, and which #1920 now proposes again. Renovate also rewrites floor+cap ranges into bare caps (immutable ">=4.3.9 <5" -> "<6", undici ">=7.28.0 <8" -> "<9"), discarding the security floor that justified the override. Suppress majors on override depTypes. Minor/patch still flow so floors can be raised, and CVE remediation is unaffected because vulnerabilityAlerts already bypasses packageRules. Separately, #1915 proposed a tj-actions/changed-files digest "update" that is really a 7-month downgrade: upstream never moved the floating v47 tag past v47.0.0, so Renovate resolved our newer v47.0.6 pin backwards. Retagging the pin comment to the exact patch restores semver comparison. Audited all nine pinned actions; this was the only one affected. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
1 participant
This PR contains the following updates:
^2.1.2→^5.0.0Release Notes
juliangruber/brace-expansion (brace-expansion@2)
v5.0.9Compare Source
v5.0.8Compare Source
v5.0.7Compare Source
v5.0.6Compare Source
v5.0.5Compare Source
v5.0.4Compare Source
v5.0.3Compare Source
v5.0.2Compare Source
v4.0.1Compare Source
5a5cc170b6a978v4.0.0Compare Source
278132bdd72a59tea.yaml70e4c1bAs a precaution to not risk breaking anything with
278132b, this is a new semver major releasev3.0.6Compare Source
v3.0.5Compare Source
v3.0.4Compare Source
v3.0.3Compare Source
v3.0.2Compare Source
v3.0.1Compare Source
3059c078229e6f15f9b3cv3.0.0Compare Source
c0360e868c0e379e781e93494c4ddd5a4cb6dad209teste3dd8aed23ede91eb3fa41e7c9cd252053761a94f1dc741cf8ee56265c8756a05978a7Configuration
📅 Schedule: (UTC)
* 0-4,22-23 * * 1-5)* * * * 0,6)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.