build(deps-dev): bump js-yaml from 4.3.1 to 4.3.2 in /ui-web - #385
Merged
Merged
Conversation
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.1 to 4.3.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
12 tasks
0xKT
added a commit
that referenced
this pull request
Sep 16, 2026
…441) ## Summary Two dependency-bump PRs (#385, #387) cannot pass commit lint, and the four open dependabot PRs do not agree with the twelve already on main about what a dependency bump is called. This fixes both, on the two sides that own them. **The scope enum lost a scope it was already using.** `scope-enum` became enforced on 2026-09-05 (8f6ef4c) with a literal `deps` entry. But `chore(deps-dev)` had merged to main on 2026-06-30 (b3959c9, #24), two months earlier. The enum swept in the sibling and missed this one, so every dependabot dev-dependency PR fails a gate for using a scope the repo had already accepted. `deps-dev` is restored to the enum; it is not a new scope. **Dependabot guesses its own prefix, and it has drifted.** Nothing pinned it, so it infers one from recent history. The 12 bumps merged so far are `chore(deps*)`; the 4 open ones are `build(deps*)`. That split means `git log --grep` needs two prefixes to find dependency work, and it will move again. Every ecosystem now pins `prefix: "build"` with `include: "scope"`, which is the documented way to get `build(deps)` / `build(deps-dev)`. `build` is what AGENTS.md section 3.1 defines for external dependencies. **Two npm trees had no entry at all.** The repo has five npm lockfiles; dependabot.yml configured three. `/ui-web` and `/ui-tui/packages/hermes-ink` were missing, and both have produced real dependabot PRs (#385 is a `/ui-web` PR right now, #57 was a hermes-ink one). Security updates reach them through the dependency graph regardless of this file, so they were inheriting none of the labels, grouping or commit-message settings the other trees get. Adding them is what makes the prefix fix actually cover every tree rather than three of five. **Neither fix had a gate behind it, so there is one now.** Both files are edited by hand, neither imports the other, and the drift they just had stayed invisible until a person read a CI log. `tests/test_dependabot_scope_canon.py` pins six things: every ecosystem pins its prefix rather than letting dependabot infer one, the pinned prefixes agree with each other, every scope the config will emit is in the enum, scopes nobody declared are still rejected, every lockfile tracked in the tree has an entry, and a repo that has workflows has an ecosystem for them. It reads the enum by evaluating `commitlint.config.cjs` with node instead of matching its text, anchored on a scope that cannot move so a broken extraction fails loudly rather than satisfying every membership assertion. What this does not fix: dependabot PR bodies quote upstream release notes verbatim, which carry emoji and em-dashes, so they still fail the ASCII gate in `scripts/check_pr_body.py`. That gate is correct - the PR body becomes the squash commit body - and the body is rewritten by hand per PR. Only the scope half is automated here. ## Type - [ ] Fix - [ ] Feature - [ ] Docs - [x] CI / tooling - [ ] Refactor - [ ] Other ## Verification Ran in a clean worktree cut from `origin/main`: ``` $ uv run pytest tests/test_dependabot_scope_canon.py \ tests/test_commit_lint.py tests/test_readme_scope_canon.py -q 19 passed in 2.65s $ uv run pre-commit run --files .github/dependabot.yml commitlint.config.cjs check yaml ... Passed (all hooks Passed or Skipped, none Failed) $ npx commitlint --from origin/main --to HEAD --config commitlint.config.cjs (no output, exit 0) $ PYTHONPATH=. uv run python scripts/check_commit_messages.py origin/main..HEAD (no output, exit 0) ``` Each of the four open dependabot subjects, and its prospective squash header, piped through the real commitlint with this config. Before the change: ``` FAIL build(deps-dev): bump the npm-root-security group across 1 directory with 2 updates PASS build(deps): bump the tui-security group across 1 directory with 6 updates ``` After: ``` PASS build(deps-dev): bump the npm-root-security group across 1 directory with 2 updates PASS build(deps-dev): bump js-yaml from 4.3.1 to 4.3.2 in /ui-web PASS build(deps): bump the bridge-security group across 1 directory with 2 updates PASS build(deps): bump the tui-security group across 1 directory with 6 updates PASS build(deps-dev): bump the npm-root-security group across 1 directory with 2 updates (#387) PASS build(deps-dev): bump js-yaml from 4.3.1 to 4.3.2 in /ui-web (#385) FAIL build(nonsense-scope): bump something FAIL build(deps-devv): bump something FAIL build(deps-dev): Bump something with a capital ``` The last three are the point: the enum still rejects scopes it should reject, so this widens it by exactly one entry rather than loosening it. Each assertion in the new test was then checked against a mutant that must fail it, because a config test that only reads the config it was written against proves nothing: ``` KILLED drop deps-dev from the enum -> 1 failed, 5 passed KILLED let the enum accept a typo scope -> 1 failed, 5 passed KILLED empty the enum entirely -> 2 failed, 4 passed KILLED drop the /ui-web entry -> 1 failed, 5 passed KILLED split the ecosystems across two types -> 1 failed, 5 passed KILLED drop the github-actions ecosystem -> 1 failed, 5 passed KILLED let one ecosystem guess its prefix again -> 1 failed, 5 passed ``` The dependabot.yml edit was checked structurally, not by eye: both versions parsed, and every pre-existing entry is identical apart from the added `commit-message` block, no entry was dropped, group names stay unique, and the npm directories now equal the set of npm lockfiles tracked in the repo. - [x] Relevant tests pass locally - [x] Relevant lint / type checks pass locally - [ ] User-facing docs or screenshots are updated when needed ## Risk Behaviour changes, all in tooling: - One more scope is legal. `feat(deps-dev): ...` also becomes legal, because commitlint cannot tie a scope to a type. `deps` already had that property; this does not introduce it. - Future dependabot commits and PR titles are pinned to `build(deps)` / `build(deps-dev)` instead of whatever it infers. Existing open PRs already use those, so nothing needs rewriting. - `/ui-web` and `/ui-tui/packages/hermes-ink` security updates will now be grouped and labelled like the other trees rather than arriving unconfigured. `open-pull-requests-limit: 0` matches the other entries, so no version-update PRs are enabled by this. - The prefix pin cannot be verified until the next advisory; dependabot's behaviour here is documented but not observable from a local run. If it turns out wrong, the enum change alone still unblocks the open PRs. Rollback: revert the commits. Nothing depends on either file at runtime. - [x] Security impact considered - [x] Backward compatibility considered - [x] Rollback path is clear for risky changes ## Related Issues N/A. Unblocks #385 and #387, which fail `scope-enum` today. --------- Co-authored-by: Claude (claude-opus-5) <noreply@anthropic.com>
Member
|
@dependabot rebase |
Contributor
Author
|
The dependabot.yml entry that created this PR has been deleted so this PR can't be rebased. Please close the PR so Dependabot can create a new one with the current dependabot.yml. |
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/ui-web/js-yaml-4.3.2
branch
September 16, 2026 13:30
0xKT
approved these changes
Sep 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps js-yaml from 4.3.1 to 4.3.2.
Changelog
Sourced from js-yaml's changelog.
Commits
79ca68d4.3.2 releasedd90b661Backport merge limits from v5.4.1Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.