build: update all non-major dependencies#3545
Conversation
angular-robot
added
action: merge
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates several non-major dependencies. The update to undici is particularly important as it includes security fixes. I've added a few comments regarding inconsistent dependency versioning practices (mixing pinned versions with ranges) which could be improved for better build predictability and maintainability. Otherwise, the dependency updates themselves look good and are ready to be merged.
| "firebase-admin": "13.7.0", | ||
| "firebase-functions": "7.1.1", | ||
| "firebase-tools": "15.9.1" | ||
| "firebase-tools": "15.10.0" |
There was a problem hiding this comment.
While updating firebase-tools to a pinned version, I noticed that @apollo/server and @as-integrations/express4 use version ranges. For consistency and more predictable builds, consider pinning all dependencies to specific versions.
| "memfs": "^4.14.0", | ||
| "rollup": "^4.59.0", | ||
| "rollup-plugin-dts": "6.3.0", | ||
| "rollup-plugin-dts": "6.4.0", |
There was a problem hiding this comment.
For consistency with this newly pinned version and other dependencies in this file, consider also pinning the rollup dependency on the line above. Using a mix of pinned versions and version ranges (^) can make dependency management less predictable.
| "micromatch": "^4.0.8", | ||
| "typed-graphqlify": "3.1.6", | ||
| "undici": "7.22.0", | ||
| "undici": "7.24.3", |
There was a problem hiding this comment.
I notice that most dependencies in this file are pinned to specific versions, but @google/genai uses a version range (^1.43.0). For consistency, you might want to pin it to a specific version as well. This would make dependency resolution more predictable.
| "@actions/core": "3.0.0", | ||
| "@google-cloud/spanner": "8.0.0", | ||
| "@google/genai": "1.44.0", | ||
| "@google/genai": "1.45.0", |
There was a problem hiding this comment.
This file has a mix of pinned dependencies and dependencies with version ranges (e.g., zod: ^4.3.6). For more predictable dependency resolution, it would be beneficial to consistently pin all dependencies to specific versions.
| "@bazel/bazelisk": "1.28.1", | ||
| "@bazel/buildifier": "8.2.1", | ||
| "firebase-tools": "15.9.1", | ||
| "firebase-tools": "15.10.0", |
There was a problem hiding this comment.
This file contains a mix of pinned versions and version ranges (e.g., tslib: ^2.5.2). To ensure more predictable builds, it's a good practice to pin all dependencies to specific versions.
See associated pull request for more information.
angular-robot
force-pushed
the
ng-renovate/all-non-major-dependencies
branch
from
0640013 to
e620716
Compare
|
This PR was merged into the repository. The changes were merged into the following branches:
|
2 participants
This PR contains the following updates:
1.44.0→1.45.015.9.1→15.10.024.39.0→24.39.124.39.0→24.39.143.62.0→43.76.06.3.0→6.4.07.22.0→7.24.3Release Notes
googleapis/js-genai (@google/genai)
v1.45.0Compare Source
Features
firebase/firebase-tools (firebase-tools)
v15.10.0Compare Source
--onlyflag foremulators:export(#4033)firebase init hostingflow, offer to switch to App Hosting (#9887)firebase init hosting(#9843)studio:exportcommand to export Firebase Studio projects to Antigravity.puppeteer/puppeteer (puppeteer)
v24.39.1Compare Source
♻️ Chores
Dependencies
🛠️ Fixes
renovatebot/renovate (renovate)
v43.76.0Compare Source
Features
v43.75.0Compare Source
Features
v43.74.0Compare Source
Features
Miscellaneous Chores
v43.73.2Compare Source
Bug Fixes
v43.73.1Compare Source
Bug Fixes
Miscellaneous Chores
v43.73.0Compare Source
Features
renovate.json(#38646) (e8a5c70)v43.72.0Compare Source
Features
Miscellaneous Chores
v43.71.0Compare Source
Features
v43.70.0Compare Source
Features
Bug Fixes
vprefix withPackage.resolved(#41782) (25c77c6), closes #41780Miscellaneous Chores
v43.69.0Compare Source
Features
v43.66.5Compare Source
Bug Fixes
Miscellaneous Chores
v43.66.4Compare Source
Bug Fixes
Miscellaneous Chores
v43.66.3Compare Source
Bug Fixes
v43.66.2Compare Source
Miscellaneous Chores
Build System
v43.66.1Compare Source
Bug Fixes
Miscellaneous Chores
v43.66.0Compare Source
Features
v43.65.0Compare Source
Features
Miscellaneous Chores
v43.64.6Compare Source
Bug Fixes
Miscellaneous Chores
$idto schemas (#41846) (c0764fa)v43.64.5Compare Source
Bug Fixes
renovate-config-validator(#41844) (31562cb)Documentation
Miscellaneous Chores
tools/(#41842) (6432d21)v43.64.4Compare Source
Bug Fixes
Documentation
customizeDashboard(#41827) (0514898)v43.64.3Compare Source
Bug Fixes
Miscellaneous Chores
v43.64.2Compare Source
Build System
v43.64.1Compare Source
Bug Fixes
www-authenticateparser (#41813) (a065a3d)Miscellaneous Chores
v43.64.0Compare Source
Features
home-operationsreplacement rule (#41777) (4deb2dd)Miscellaneous Chores
v43.63.0Compare Source
Features
@base-ui-components/react=>@base-ui/reactrename (#41787) (9df72b1)Documentation
Miscellaneous Chores
Swatinem/rollup-plugin-dts (rollup-plugin-dts)
v6.4.0Compare Source
Features:
Fixes:
declare modulepathsThank you:
Features, fixes and improvements in this release have been contributed by:
nodejs/undici (undici)
v7.24.3Compare Source
What's Changed
Full Changelog: nodejs/undici@v7.24.2...v7.24.3
v7.24.2Compare Source
What's Changed
Full Changelog: nodejs/undici@v7.24.1...v7.24.2
v7.24.1Compare Source
What's Changed
Full Changelog: nodejs/undici@v7.24.0...v7.24.1
v7.24.0Compare Source
Undici v7.24.0 Security Release Notes
This release addresses multiple security vulnerabilities in Undici.
Upgrade guidance
All users on v7 should upgrade to v7.24.0 or later.
Fixed advisories
GHSA-2mjp-6q6p-2qxm / CVE-2026-1525 (Medium)
Inconsistent interpretation of HTTP requests (request/response smuggling class issue).
GHSA-f269-vfmq-vjvj / CVE-2026-1528 (High)
Malicious WebSocket 64-bit frame length handling could crash the client.
GHSA-phc3-fgpg-7m6h / CVE-2026-2581 (Medium)
Unbounded memory consumption in deduplication interceptor response buffering (DoS risk).
GHSA-4992-7rv2-5pvq / CVE-2026-1527 (Medium)
CRLF injection via the
upgradeoption.GHSA-v9p9-hfj2-hcw8 / CVE-2026-2229 (High)
Unhandled exception from invalid
server_max_window_bitsin WebSocket permessage-deflate negotiation.GHSA-vrm6-8vpv-qv8q / CVE-2026-1526 (High)
Unbounded memory consumption in WebSocket permessage-deflate decompression.
Affected and patched ranges
7.0.0 < 7.24.0, patched7.24.07.0.0 < 7.24.0, patched7.24.0>= 7.17.0 < 7.24.0, patched7.24.07.0.0 < 7.24.0, patched7.24.07.0.0 < 7.24.0, patched7.24.07.0.0 < 7.24.0, patched7.24.0References
v7.23.0Compare Source
What's Changed
New Contributors
Full Changelog: nodejs/undici@v7.22.0...v7.23.0