fix(deps): update dependency @faker-js/faker to version 10.x 🌟 (major) - #1481
fix(deps): update dependency @faker-js/faker to version 10.x 🌟 (major)#1481renovate[bot] wants to merge 1 commit into
Conversation
|
See the guidelines for reviewing dependency updates for info on how to review dependency update PRs. |
922e1e9 to
4c30740
Compare
4c30740 to
5758dd7
Compare
5758dd7 to
b6b562e
Compare
b6b562e to
14dcff0
Compare
14dcff0 to
c6950f3
Compare
renovate
Bot
changed the title
c6950f3 to
f5e844f
Compare
f5e844f to
795a939
Compare
renovate
Bot
changed the title
795a939 to
a9c86be
Compare
a9c86be to
4da2b39
Compare
4da2b39 to
bba7489
Compare
bba7489 to
7e55d49
Compare
renovate
Bot
changed the title
7e55d49 to
c9369e2
Compare
c9369e2 to
74c232c
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 3 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
| "jwks-rsa": "2.0.5", | ||
| "lowdb": "1.0.0", | ||
| "jwks-rsa": "4.0.1", | ||
| "lowdb": "7.0.1", |
There was a problem hiding this comment.
lowdb v7 completely breaks backend database layer
High Severity
Upgrading lowdb from 1.0.0 to 7.0.1 without updating backend/database.ts will completely break the application. The code imports low from "lowdb" and FileSync from "lowdb/adapters/FileSync", then uses a lodash-chain API (db.get().push().write(), db.setState(), etc.). lowdb v2+ is pure ESM with a completely different API — no low() function, no FileSync adapter, and no chaining. Every database operation in the backend will fail at import time.
| "@cypress/instrument-cra": "1.4.0", | ||
| "@eslint/js": "^10.0.1", | ||
| "@faker-js/faker": "6.1.2", | ||
| "@faker-js/faker": "10.4.0", |
There was a problem hiding this comment.
Faker v10 removes all APIs used in seed generation
High Severity
Upgrading @faker-js/faker from 6.1.2 to 10.4.0 without updating source code breaks seed data generation and tests. The code calls many APIs removed in v8: faker.random.uuid(), faker.name.firstName(), faker.name.lastName(), faker.helpers.randomize(), faker.random.number(), faker.company.companyName(), faker.phone.phoneNumberFormat(), faker.finance.account(), and faker.finance.amount(min, max) with positional args (now requires an options object).
| "json": "11.0.0", | ||
| "jwks-rsa": "2.0.5", | ||
| "lowdb": "1.0.0", | ||
| "jwks-rsa": "4.0.1", |
There was a problem hiding this comment.
jwks-rsa v4 incompatible with express-jwt v6
High Severity
Upgrading jwks-rsa from 2.0.5 to 4.0.1 while keeping express-jwt at 6.1.2 creates an incompatibility. backend/helpers.ts uses jwksRsa.expressJwtSecret() with express-jwt v6's callback-based secret provider pattern. jwks-rsa v3+ changed expressJwtSecret to return a Promise-based function designed for express-jwt v7+, which uses a different (req, token) signature instead of the old (req, header, payload, cb) callback pattern.
74c232c to
bef9483
Compare
1 participant
This PR contains the following updates:
6.1.2→10.4.09.1.2→10.0.116.0.0→17.4.26.5.3→7.4.07.0.4→9.1.72.0.5→4.0.11.0.0→7.0.11.14.0→3.0.50.32.11→1.7.1Release Notes
faker-js/faker (@faker-js/faker)
v10.4.0Compare Source
New Locales
Features
Changed Locales
Bug Fixes
v10.3.0Compare Source
New Locales
Features
sexTypecan return'generic'(#3259) (0e099a1)Changed Locales
Bug Fixes
v10.2.0Compare Source
New Locales
Features
Bug Fixes
v10.1.0Compare Source
New Locales
Bug Fixes
v10.0.0Compare Source
New Locales
Features
Changed Locales
v9.9.0Compare Source
New Locales
Features
v9.8.0Compare Source
New Locales
Changed Locales
Bug Fixes
v9.7.0Compare Source
New Locales
Bug Fixes
v9.6.0Compare Source
Features
v9.5.1Compare Source
Bug Fixes
v9.5.0Compare Source
Features
v9.4.0Compare Source
Features
Changed Locales
Bug Fixes
v9.3.0Compare Source
Features
Changed Locales
Bug Fixes
v9.2.0Compare Source
Features
Changed Locales
v9.1.0Compare Source
New Locales
Features
continentmethod (#3162) (4056ab0)Changed Locales
Bug Fixes
v9.0.3Compare Source
Changed Locales
Bug Fixes
v9.0.2Compare Source
Bug Fixes
v9.0.1Compare Source
Bug Fixes
v9.0.0Compare Source
No noteworthy changes to 9.0.0-rc.1
For those upgrading from earlier versions, please refer to our Migration Guide for detailed instructions.
v8.4.1Compare Source
v8.4.0Compare Source
Features
fractionDigitsin float (#1855) (41d8778)Bug Fixes
8.3.1 (2023-11-14)
Bug Fixes
[@internal](https://redirect.github.com/internal)from module parent classes (#2548) (77f54ad)v8.3.1Compare Source
v8.3.0Compare Source
Features
Bug Fixes
Changed Locales
New Locales
v8.2.0Compare Source
Features
Bug Fixes
New Locales
en_US,en_GBanden(#2371) (491d319)v8.1.0Compare Source
Features
Bug Fixes
jalocale (#2189) (785a38a)Changed Locales
New Locales
8.0.2 (2023-05-27)
Bug Fixes
v8.0.2Compare Source
v8.0.1Compare Source
v8.0.0Compare Source
Bug Fixes
Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.
Note
High Risk
Several majors touch core paths (lowdb persistence, yup/Formik validation, jwks-rsa auth, faker in API tests) with zero code updates in the diff, so breakage may only appear at compile or test time.
Overview
This PR is a dependency-only refresh:
package.jsonpins newer versions andyarn.lockis regenerated accordingly. There are no application source changes in the diff.Runtime / product dependencies:
yupmoves from 0.32.x to 1.7.x (used with Formik across sign-in, sign-up, bank account, comment, and transaction forms). uuid is unchanged in this diff at8.3.2(Renovate’s description mentions a larger uuid bump that is not present here).Backend & tooling: lowdb 1 → 7 still backs the JSON DB via
lowdb/adapters/FileSyncinbackend/database.ts—a large API shift if not already migrated elsewhere. fuse.js 6 → 7 powers user search in the same file. jwks-rsa 2 → 4 supports Auth0 JWT verification inbackend/helpers.ts. dotenv 16 → 17 loads env in helpers.Dev / CI: @faker-js/faker 6 → 10 affects Cypress API tests (
faker.company,faker.finance, etc.). start-server-and-test 1 → 3 swapsps-treefortree-killand bumps wait-on to 9.x with Joi 18 and axios 1.x. concurrently 9 → 10, husky 7 → 9, and related CLI transitive updates (yargs 18, chalk 5, etc.) round out the lockfile churn.Reviewers should treat this as verify build, types, backend startup, auth flows, and Cypress rather than reading feature diffs.
Reviewed by Cursor Bugbot for commit bef9483. Bugbot is set up for automated code reviews on this repo. Configure here.