Repository navigation
Update npm/registry dependencies - #805
Merged
Merged
Conversation
thomashoneyman
added this pull request to stack #806
October 11, 2026 13:04
thomashoneyman
commented
Oct 11, 2026
f-f
force-pushed
the
dependency-upgrades-2026-10
branch
from
October 11, 2026 13:14
1dec09d to
d90dc1f
Compare
f-f
approved these changes
Oct 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is pt. 2 of getting the registry back up to date with dependencies -- this time, PureScript/JavaScript.
PureScript
On the PureScript side, we just update to the latest package set. We can drop the language-cst-parser and dodo-printer git overrides since they're in the set at versions we need now.
JavaScript
On the JS side, updated 11 dependencies to their latest, and did a fairly exhaustive agent-driven validation of the changes in each dependency to verify everything works as it should. That revealed a few issues, some of which are pre-existing, and all are fixed as part of this change. Here's what's worth noting:
fuse7.1 -> 7.5: In the new version, an empty search will return all items. This is a problem for us, because we intend that to mean "no license suggestions". So as part of this change, I manually guard the search so we don't use fuse when given an empty string, we immediately fall back to an empty array.yaml2.8 -> 2.9: The upstream no longer guarantees parsing won’t throw, so this is now guarded in atryblock. Also, there were changes to unbounded alias expansion, and I realize that we actually parse aliases right now even though spago.yaml shouldn't allow them. We don't use the spago parser, we have our own, so I've now guarded against them.spdx-parser4 -> 5: This adds exceptions on custom license references. Our bindings handle the new AST fields just fine, and registry validation still rejects custom references, so this doesn't require any changes from us.For the AWS sdk and Octokit changes, there's nothing that would affect our code, but I did a thorough manual test to verify them anyway and it looks clean.