Repository navigation
chore: pin and refresh dependencies - #1
Merged
Merged
Conversation
remcoros
force-pushed
the
chore/pin-and-refresh-dependencies
branch
from
October 8, 2026 16:58
0b9f202 to
dea76f6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pins direct dependencies to exact versions and refreshes the lockfile. Adds npm settings for exact saves, a minimum release age, and lockfile generation. Updates Vite's React compiler diagnostic option and adjusts development transform tests to assert Fast Refresh for JSX modules while retaining React compilation for non-JSX hooks. Regenerates third-party notices for the updated runtime dependency tree.
Adds a one-line
react/puritysuppression beside the scan-start timestamp. The timestamp is created only through the form submit handler, never during render. Oxlint 1.85.0 accepts the same code, while 1.87.0 incorrectly flags the event-only clock read. The adjacent comment documents that execution boundary; the rule stays enabled elsewhere and scan behavior is unchanged.Validation:
npm cipassed; audit reported zero vulnerabilities.npm run checkpassed: formatting, portability, lint, React compiler check, production build, and all 1,756 tests across 170 files.node scripts/release-check.mjspassed.docker buildx bake --check release-platformpassed with no warnings.npm run licensesregenerated notices;git diff --cached --checkpassed.No workspace format, public application interface, source of truth, trust boundary, or analysis assumption changes.