Skip to content

chore(deps): update dependencies#1105

Merged
justinvdm merged 7 commits intomainfrom
kindling/2026-03-31-1056-greenkeep-redwood-sdk-monorepo-3495
Mar 31, 2026
Merged

chore(deps): update dependencies#1105
justinvdm merged 7 commits intomainfrom
kindling/2026-03-31-1056-greenkeep-redwood-sdk-monorepo-3495

Conversation

@justinvdm
Copy link
Copy Markdown
Collaborator

@justinvdm justinvdm commented Mar 31, 2026

Context

Routine dependency update for the Redwood SDK monorepo, covering Tier 1 critical packages and root-level infrastructure (Tier 3).

Details

Updates applied

Package Previous Updated Scope
@types/node ~24.12.0 ~25.5.0 root devDependencies
knip ~5.86.0 ~6.1.1 root devDependencies
pnpm ^10.31.0 ^10.33.0 root devDependencies
wrangler ^4.77.0 ^4.78.0 root devDependencies

The packageManager field was synced to pnpm@10.33.0 to match.

Overrides applied

Override key Previous Updated Notes
serialize-javascript@6.0.2 7.0.4 7.0.5 Updated existing override
serialize-javascript@7.0.3 (new) 7.0.5 Transitive via content-collections
path-to-regexp@8.3.0 (new) 8.4.0 Transitive via fumadocs-core
brace-expansion@>=5.0.0 <5.0.5 (was @isaacs/brace-expansion@5.0.0 → 5.0.1) 5.0.5 Fixed ineffective scoped-package key

Deferred

  • TypeScript remains at ^5.9.3 -- upgrading to v6 requires @typescript-eslint v9, which is outside the scope of this pass

@justinvdm
Copy link
Copy Markdown
Collaborator Author

justinvdm commented Mar 31, 2026

kindlingtask complete

Phases (5/5)

  • 1. Investigation + Implementation
  • 2. Fix Review
  • 3. Quality Gate + Verification
  • 4. Finalization
  • 5. CI Verification

Completion report

Completion report

Status: Dormant

What happened

The session handled two tasks. First, a dependency maintenance cycle updated the SDK monorepo: four transitive security advisories were resolved via package manager overrides, and four development dependency ranges were bumped. Second, a CI regression in the deploy test was traced to a newer wrangler release that broke how static assets are served during deployment -- the fix reverted that single dependency to the last working version.

Decisions made

  • Provisional decision: TypeScript deferred to a future major-version migration due to cascading ESLint upgrade requirements.
  • Wrangler pinned to 4.77.0 after 4.78.0 broke the CSS playground deploy worker.

Worth noting

  • Three security advisory drafts await manual submission to the advisory database.
  • All changes are in open pull requests with passing CI and verified builds.
  • No published SDK code was modified in either task.

Last updated: Tue, 31 Mar 2026 13:48:25 GMT

…sories

- Bump knip ~5.86.0 → ~6.1.1, pnpm ^10.31.0 → ^10.33.0,
  wrangler ^4.77.0 → ^4.78.0, @types/node ~24.12.0 → ~25.5.0
- TypeScript left at ^5.9.3; v6 requires @typescript-eslint v9 which
  is outside scope of this greenkeeping pass
- Override serialize-javascript@6.0.2 → 7.0.5 (was 7.0.4)
- Add serialize-javascript@7.0.3 → 7.0.5 (transitive via content-collections)
- Add path-to-regexp@8.3.0 → 8.4.0 (transitive via fumadocs-core, resolves
  CVE-2026-4926 and CVE-2026-4923)
- Override brace-expansion → 5.0.5 (was ineffective via @isaacs/ scoped key)

[skip ci]
@justinvdm justinvdm changed the title Greenkeep Redwood SDK monorepo chore(deps): update dependencies Mar 31, 2026
@cloudflare-workers-and-pages
Copy link
Copy Markdown

cloudflare-workers-and-pages bot commented Mar 31, 2026

Deploying redwood-sdk-docs with  Cloudflare Pages  Cloudflare Pages

Latest commit: 3a7f164
Status: ✅  Deploy successful!
Preview URL: https://a7616f80.redwood-sdk-docs.pages.dev
Branch Preview URL: https://kindling-2026-03-31-1056-gre.redwood-sdk-docs.pages.dev

View logs

@justinvdm justinvdm marked this pull request as ready for review March 31, 2026 12:26
justinvdm and others added 2 commits March 31, 2026 13:18
The wrangler ^4.78.0 bump introduced a 404 regression in the CSS
playground E2E deploy test. The test 'production HTML includes
stylesheet link to prevent FOUC' fails because the deployed worker
returns a Cloudflare 404 instead of app content. The wrangler 4.78.0
"Dry-Run Asset Validation" change altered the asset handling pipeline,
affecting workers that use the assets binding in wrangler.jsonc.

Pinning the root devDependency back to ^4.77.0 restores the known
working behaviour. The CSS playground already has wrangler 4.77.0
pinned, and the SDK test harness also uses ^4.77.0, so this change
brings the root devDependency into alignment.

[skip ci]
@justinvdm justinvdm merged commit ccfe9db into main Mar 31, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant