Skip to content

fix(deps): update all non-major dependencies - #84

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

fix(deps): update all non-major dependencies#84
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jun 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@commitlint/cli (source) ^21.0.2 → ^21.2.1 age confidence devDependencies minor
@commitlint/config-conventional (source) ^21.0.2 → ^21.2.0 age confidence devDependencies minor
@prisma/adapter-pg (source) ^7.8.0 → ^7.9.1 age confidence dependencies minor
@prisma/client (source) ^7.8.0 → ^7.9.1 age confidence dependencies minor
@types/node (source) ^24.13.2 → ^24.13.3 age confidence devDependencies patch
@wolfstar/env-utilities (source) ^2.0.2 → ^2.0.5 age confidence dependencies patch
@wolfstar/http-framework (source) ^3.0.0 → ^3.1.2 age confidence dependencies minor
@wolfstar/http-framework-i18n (source) ^1.2.2 → ^1.2.5 age confidence dependencies patch
@wolfstar/http-framework-i18n>@wolfstar/i18next-backend (source) ^2.0.8 → ^2.0.10 age confidence pnpm-workspace.overrides patch
@wolfstar/logger (source) ^2.0.5 → ^2.1.3 age confidence dependencies minor
@wolfstar/shared-http-pieces (source) ^1.2.6 → ^1.2.8 age confidence dependencies patch
@wolfstar/start-banner (source) ^2.0.3 → ^2.0.6 age confidence dependencies patch
actions/checkout v7.0.0 → v7.0.1 age confidence action patch
docker/dockerfile 1.25 → 1.26 age confidence syntax minor
eslint (source) ^10.5.0 → ^10.8.1 age confidence devDependencies minor
eslint-plugin-regexp ^3.1.0 → ^3.1.1 age confidence devDependencies patch
oxfmt (source) ^0.55.0 → ^0.62.0 age confidence devDependencies minor
oxlint (source) ^1.70.0 → ^1.77.0 age confidence devDependencies minor
pnpm (source) 11.8.0 → 11.20.0 age confidence packageManager minor
pnpm/action-setup v6.0.9 → v6.0.10 age confidence action patch
prisma (source) ^7.8.0 → ^7.9.1 age confidence devDependencies minor
taze ^19.14.1 → ^19.17.2 age confidence devDependencies minor
tsdown (source) ^0.22.3 → ^0.22.14 age confidence devDependencies patch
untun ^0.1.3 → ^0.2.2 age confidence dependencies minor

Release Notes

conventional-changelog/commitlint (@​commitlint/cli)

v21.2.1

Compare Source

Note: Version bump only for package @​commitlint/cli

v21.2.0

Compare Source

Features
  • resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#​4859) (fdb566f)

v21.1.0

Compare Source

Features

21.0.2 (2026-05-29)

Bug Fixes

21.0.1 (2026-05-12)

Note: Version bump only for package @​commitlint/cli

conventional-changelog/commitlint (@​commitlint/config-conventional)

v21.2.0

Compare Source

Features
  • resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#​4859) (fdb566f)

v21.1.0

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

21.0.2 (2026-05-29)

Note: Version bump only for package @​commitlint/config-conventional

21.0.1 (2026-05-12)

Note: Version bump only for package @​commitlint/config-conventional

prisma/prisma (@​prisma/adapter-pg)

v7.9.1

Compare Source

Today, we're issuing a patch release to resolve a security advisory in a transitive dependency of Prisma CLI (via @prisma/dev).

This fixes #​29780.

It does not actually affect @prisma/dev or Prisma CLI so no urgent action is required, but it is recommended to upgrade nevertheless to avoid false positives from security scanners.

v7.9.0

Compare Source

Today, we are excited to share the 7.9.0 stable release 🎉

🌟 Star this repo for notifications about new releases, bug fixes & features — or follow us on X!

Highlights

ORM

Tab completions for the Prisma CLI

Typing out CLI commands from memory is now optional. Prisma ships shell tab completions for bash, zsh, fish, and PowerShell, covering commands, subcommands, options, flags, and even option values.

Setting it up. Most projects run Prisma through a package manager, so completions are enabled through @bomb.sh/tab's package-manager integration — install it once, then source the completion for your package manager and shell:

# 1. Install @bomb.sh/tab globally
npm install -g @bomb.sh/tab

# 2. Wire up your package manager + shell (pnpm shown; swap in npm / yarn / bun):
echo 'source <(tab pnpm zsh)'  >> ~/.zshrc            # zsh
echo 'source <(tab pnpm bash)' >> ~/.bashrc           # bash
tab pnpm fish > ~/.config/fish/completions/pnpm.fish  # fish
tab pnpm powershell > ~/.tab-pnpm.ps1                 # PowerShell (then dot-source it from $PROFILE)

@bomb.sh/tab delegates to any locally-installed CLI that ships completions, so pnpm prisma <TAB>, pnpm exec prisma <TAB>, yarn prisma <TAB>, and bun x prisma <TAB> all complete Prisma's commands, options, and values — no per-project setup. (npx and bunx don't support completion themselves; use npm exec and bun x.)

If instead you have Prisma installed globally on your PATH, source its own completion directly: source <(prisma complete zsh) (or the bash / fish / powershell variant).

This is built on @bomb.sh/tab, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from @​AmirSa12 (#​28351) — thank you!

prisma.mp4
Prisma ORM, ready for AI agents

Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.

Agent skills installed with prisma init (#​29689)

prisma init now installs the prisma/skills catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with --no-skills.

npx prisma@latest init

prisma init scaffolds a project and installs the Prisma agent skills catalog

A safer default around destructive commands (#​29684, #​29691, #​29713)

Prisma's AI safety checkpoint refuses to run destructive commands when it detects that an AI agent is at the keyboard, unless the user has given explicit consent. In this release we:

  • Broadened agent detection to cover today's landscape — Codex CLI (now on Linux as well as macOS), Qwen Code, GitHub Copilot CLI, OpenCode, Cline, Goose, Amp, Crush, Augment Code, Antigravity, Replit Agent, and Devin — plus generic AI_AGENT / AGENT conventions so future agents are caught without a code change.
  • Extended the guard to db push --accept-data-loss, which previously bypassed the checkpoint even though it can drop data.
  • Removed the migrate-reset tool from the prisma mcp server entirely — resetting a database drops it, and that is not an operation an agent should be handed as a first-class tool. An agent that needs a reset must run the CLI, where the checkpoint applies.
Bug Fixes

Many of the fixes below are community contributions — thank you to everyone who reported and fixed these!

Prisma Client

  • Fixed a severe TypeScript performance regression introduced in Prisma 7: restoring the OmitOpts generic default lets tsc reuse cached type instantiations again, bringing type-checking on large schemas back from minutes to seconds (#​29592, from @​nfl1ryxditimo12).
  • The XOR type helper now rejects primitive values such as data: 5, which were previously accepted at compile time even though the runtime rejected them (#​29735, from @​kyungseopk1m).
  • $queryRaw and $executeRaw now fail fast with a clear validation error when passed an invalid Date, instead of silently serializing it as null and corrupting the value sent to the database (#​29697, from @​jibin7jose).
  • The generated client is no longer corrupted by a /// documentation comment that contains a */ sequence; the comment terminator is now escaped when doc comments are emitted, in both the TypeScript and JavaScript generators (#​29736, from @​kyungseopk1m).
  • Improved the runtime and TypeScript error messages shown when a driver adapter is missing from the PrismaClient constructor; both now include a copy-pasteable example and a link to the driver adapters docs (#​29624).
  • Unmapped database errors from driver adapters now surface as a user-facing P2039 (PrismaClientKnownRequestError) carrying the original code and message, instead of an opaque failure, which keeps schema-drift-style problems debuggable (#​29512).
  • The prisma-client-js generator no longer emits a stray undefined statement when generating from a schema that declares only enums or types and no models (#​29738, from @​kyungseopk1m).
  • Fixed a connection leak when an interactive transaction times out (maxWait) while it is still starting: the discarded transaction now sends an explicit ROLLBACK before the connection is returned to the pool, instead of releasing it mid-transaction. Previously, on adapters like @prisma/adapter-pg and @prisma/adapter-neon, the next query to reuse that connection could fail with there is already a transaction in progress — or silently commit the leaked transaction's work (#​29727, from @​lazerg).

CLI

  • prisma validate (and other schema-loading commands) no longer hangs forever on a multi-file schema whose directories contain a symlink cycle, and no longer reports the same file twice when a directory is reachable under two spellings (e.g. /tmp → /private/tmp on macOS) (#​29740, from @​kyungseopk1m).
  • On Windows, engine binaries are now cached in a stable, user-level directory (%APPDATA%\Prisma) instead of a cwd-relative node_modules\.cache, which eliminated duplicate cache directories and the bloated Serverless/Docker bundles they caused (#​29730, from @​santichausis; closes #​22574, #​6670, #​11577).

Driver Adapters

Schema Engine

  • prisma migrate status now reports a rolled-back migration that still exists on disk as unapplied, instead of incorrectly treating the schema as up to date (prisma/prisma-engines#5817, from @​goutamadwant).
  • Primary-key constraint renames are now rendered as separate ALTER TABLE statements on PostgreSQL, avoiding a database error when a single table has multiple changes in one migration (prisma/prisma-engines#4906, from @​eruditmorina).
Security
  • Resolved the hono security advisories at their source: @prisma/dev was updated to a version that no longer depends on hono at all, so the CLI is no longer exposed to those advisories through that path. We also patched moderate-severity advisories in ajv and uuid across production dependencies (#​29514).
  • Hardened the Prisma Platform credentials file (~/.config/prisma-platform/auth.json) and its directory to 0o600 / 0o700 so OAuth tokens are no longer world-readable, bringing Prisma in line with the GitHub, AWS, and Google Cloud CLIs (#​29568, from Jaeyoung Yun).
  • Bumped the openssl crate in the schema engine binaries from 0.10.74 to 0.10.81 (prisma/prisma-engines#5815).

Prisma Studio

The bundled Prisma Studio moves from 0.27.3 to 0.33.0 (#​29720), gathering up everything shipped in the Studio releases in between.

Migrations view

Studio can now visualise your migration history. This view is powered by Prisma Next — the next major version of Prisma ORM, a full TypeScript rewrite (available now in Early Access) that keeps the schema-first workflow and model-first queries you know, but treats your schema as a versioned, inspectable contract instead of compiling it into a heavy generated client. Prisma Next records every migration and its contract snapshots in the database, and Studio reads them to draw the timeline and diff below. Databases managed with classic Prisma Migrate don't carry this ledger, so the view simply stays hidden there.

When the connected database has a Prisma Next migration ledger, a Migrations entry appears in the sidebar: a newest-first timeline of every applied migration with its name, apply time, operation count, and compact chips summarizing what changed (+2 models, ~2 models +3 fields, +1 model, …). Selecting a migration opens a visual, FigJam-style diff canvas — added, removed, and changed models as colour-coded cards (NEW / UPDATED / UNCHANGED) with per-field before → after details, enum cards, and relation edges — next to a SQL panel of the executed statements and a Prisma-schema line diff. Switching migrations morphs the canvas rather than rebuilding it.

The Studio Migrations view: walking a Prisma Next migration history, the diff canvas morphing between migrations

Prisma Streams browser

Studio gains first-class support for Prisma Streams: a dedicated stream browser, live stream aggregations, stream diagnostics, routing-key browsing, and a WAL-history handoff straight from your tables, plus richer stream request observability with concise event-log and OpenTelemetry span summaries.

Working with SQL
  • SQL execution, linting, and navigation are now schema-aware: unqualified identifiers resolve against the schema you've selected instead of always falling back to the adapter's default schema.
  • SQL result visualizations are rendered with Studio-owned chart configuration, and there's an optional Queries view backed by query-insights snapshots.
  • Added copy actions to the Query Details view.
Fixes
  • Fixed editing PostgreSQL text-array cells when queries are compiled with inline values.
  • Avoided cancelling and repeating introspection requests when Studio first mounts, removing duplicate startup work.

Thanks to our contributors

A heartfelt thank you to the community members whose contributions shaped this release:

@​AmirSa12, @​kyungseopk1m, @​nfl1ryxditimo12, @​jibin7jose, @​santichausis, @​kolia-zamnius, @​goutamadwant, @​eruditmorina, @​lazerg, @​AnupamKumar-1, @​Swapanrishi, @​anupamme, and @​oyi77.

Prisma Compute is now in public beta

"Push code, it runs." Prisma Compute — managed hosting for TypeScript apps that run right next to your database — is now available in public beta, and free to use while the beta lasts.

Compute deploys your app as a long-lived process on Bun, colocated with your Prisma Postgres database, so there are no cold starts, no request timeouts, and no separate hosting vendor to wire up. It's a fit for REST and GraphQL APIs, full-stack apps, streaming and gRPC, and the long-running, stateful AI agents that keep connections open and hold in-process caches — "self-hosting, without the painful parts".

  • Push-to-deploy from the CLI or via GitHub integration. Every deployment is an immutable, versioned release with its own preview URL, and rolling back is simply promoting a previous version.
  • Branch-based environments — each branch gets its own app and database, so you can preview a change before promoting it to production.
  • Auto-wires with Prisma Postgres (or bring any database), with automatic health checks and self-recovery.
  • Custom domains — point a single CNAME at Prisma and Compute provisions and renews the TLS certificate for you, with no manual certificate uploads or private-key handling.

With Prisma ORM for type-safe data access, Prisma Postgres for the managed database, and now Prisma Compute for hosting, the whole stack lives in one place. Read the full story in the Prisma Compute blog series.

Enterprise support

Thousands of teams use Prisma and many of them already tap into our Enterprise & Agency Support Program for hands-on help with everything from schema integrations and performance tuning to security and compliance.

With this program you also get priority issue triage and bug fixes, expert scalability advice, and custom training so that your Prisma-powered apps stay rock-solid at any scale. Learn more or join: https://prisma.io/enterprise.

wolfstar-project/stars-components (@​wolfstar/env-utilities)

v2.0.5

Compare Source

Patch Changes

v2.0.4

Compare Source

Patch Changes

v2.0.3

Patch Changes
  • #​59 b9be51e - Add provenance attestation to publishConfig for all packages
wolfstar-project/stars-components (@​wolfstar/http-framework)

v3.1.2

Compare Source

Patch Changes

v3.1.1

Compare Source

Patch Changes

v3.1.0

Compare Source

Minor Changes
  • #​85 69dd6c8 - Add an optional Command#registerApplicationCommands(registry) instance method, mirroring @sapphire/framework's ApplicationCommandRegistry API, so chat input, subcommand, subcommand group, and context menu commands can be registered imperatively instead of via TypeScript decorators. This also makes the framework usable from plain JavaScript, where TS decorators aren't available. Thanks @​RedStar071!
wolfstar-project/stars-components (@​wolfstar/http-framework-i18n)

v1.2.5

Compare Source

Patch Changes

v1.2.4

Compare Source

Patch Changes

v1.2.3

Patch Changes
wolfstar-project/stars-components (@​wolfstar/http-framework-i18n>@​wolfstar/i18next-backend)

v2.0.10

Compare Source

Patch Changes

v2.0.9

Compare Source

Patch Changes
wolfstar-project/stars-components (@​wolfstar/logger)

v2.1.3

Compare Source

Patch Changes

v2.1.2

Compare Source

Patch Changes

v2.1.1

Patch Changes
  • #​59 b9be51e - Add provenance attestation to publishConfig for all packages
wolfstar-project/stars-components (@​wolfstar/shared-http-pieces)

v1.2.8

Compare Source

Patch Changes

v1.2.7

Compare Source

Patch Changes
wolfstar-project/stars-components (@​wolfstar/start-banner)

v2.0.6

Compare Source

Patch Changes

v2.0.5

Compare Source

Patch Changes

v2.0.4

Patch Changes
  • #​59 b9be51e - Add provenance attestation to publishConfig for all packages
actions/checkout (actions/checkout)

v7.0.1

Compare Source

eslint/eslint (eslint)

v10.8.1

Compare Source

Bug Fixes

  • 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#​21173) (dongkyu lee)
  • 151ba3f fix: false positives in getter-return and accessor-pairs (#​21163) (Grit)
  • 6898df9 fix: ignore meta-property names in id-denylist (#​21166) (Pixel)
  • 4d7db66 fix: ignore meta-property names in id-match (#​21167) (Pixel)
  • 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#​20935) (kuldeep kumar)

Documentation

  • 7d0cbf8 docs: Update README (GitHub Actions Bot)
  • 0a05812 docs: add missing backticks to no-duplicate-imports.js (#​21183) (Lee Daeun)
  • 678c90b docs: Update README (GitHub Actions Bot)
  • 8a10424 docs: Update README (GitHub Actions Bot)
  • 69bb948 docs: Update README (GitHub Actions Bot)

Chores

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 12pm on Sunday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 612ce7b to 9ab60b6 Compare June 28, 2026 09:38
@renovate renovate Bot changed the title chore(deps): update all non-major dependencies fix(deps): update all non-major dependencies Jun 28, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 01b64f6 to e4a662b Compare July 2, 2026 18:45
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 195cdea to 642ba6a Compare July 8, 2026 11:09
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 11 times, most recently from 0565bf3 to 46abfe8 Compare July 16, 2026 20:54
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 7afb255 to 75d61f4 Compare July 19, 2026 16:34
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from a4679dc to 3301258 Compare July 24, 2026 23:04
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 10 times, most recently from 8f4b8fc to a89111e Compare August 2, 2026 02:01
@renovate

renovate Bot commented Aug 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml
? Verifying lockfile against supply-chain policies (613 entries)...
[WARN] Request took 11122ms: https://registry.npmjs.org/@prisma%2Fclient
✓ Lockfile passes supply-chain policies (613 entries in 12.6s)
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 31, reused 0, downloaded 0, added 0
Progress: resolved 34, reused 0, downloaded 0, added 0
Progress: resolved 37, reused 0, downloaded 0, added 0
Progress: resolved 161, reused 0, downloaded 0, added 0
Progress: resolved 186, reused 0, downloaded 0, added 0
Progress: resolved 322, reused 0, downloaded 0, added 0
Progress: resolved 358, reused 0, downloaded 0, added 0
Progress: resolved 373, reused 0, downloaded 0, added 0
Progress: resolved 513, reused 0, downloaded 0, added 0
Progress: resolved 630, reused 0, downloaded 0, added 0
Progress: resolved 650, reused 0, downloaded 0, added 0
[ERR_PNPM_NO_MATURE_MATCHING_VERSION] 1 version does not meet the minimumReleaseAge constraint:
  eslint@10.8.1 was published at 2026-08-07T20:21:24.770Z, within the minimumReleaseAge cutoff (2026-08-05T21:11:43.843Z)

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 72a3a50 to d917bc4 Compare August 5, 2026 10:45
gitar-bot[bot]
gitar-bot Bot reviewed Aug 5, 2026
View reviewed changes
Comment thread package.json
Comment on lines +33 to 47
"@prisma/adapter-pg": "^7.9.1",
"@prisma/client": "^7.9.1",
"@sapphire/result": "^2.8.0",
"@sapphire/utilities": "^3.18.2",
"@wolfstar/env-utilities": "^2.0.2",
"@wolfstar/http-framework": "^3.0.0",
"@wolfstar/http-framework-i18n": "^1.2.2",
"@wolfstar/logger": "^2.0.5",
"@wolfstar/env-utilities": "^2.0.5",
"@wolfstar/http-framework": "^3.1.2",
"@wolfstar/http-framework-i18n": "^1.2.5",
"@wolfstar/logger": "^2.1.3",
"@wolfstar/plugin-api": "^1.0.0",
"@wolfstar/shared-http-pieces": "^1.2.6",
"@wolfstar/start-banner": "^2.0.3",
"@wolfstar/shared-http-pieces": "^1.2.8",
"@wolfstar/start-banner": "^2.0.6",
"discord-api-types": "^0.38.47",
"gradient-string": "^3.0.0",
"husky": "^9.1.7",
"ioredis": "^5.11.1",

@gitar-bot gitar-bot Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚨 Bug: package.json bumped but pnpm-lock.yaml not updated

package.json (and pnpm-workspace.yaml override) were bumped to new versions, but pnpm-lock.yaml was not updated in this PR — it still pins the old specifiers/versions (e.g. untun specifier ^0.1.3, @prisma/adapter-pg/@prisma/client/prisma 7.8.0, @wolfstar/env-utilities 2.0.2, etc.). The CI step pnpm install --filter . --ignore-scripts runs with pnpm's CI default of --frozen-lockfile, so this mismatch will fail with ERR_PNPM_OUTDATED_LOCKFILE. Regenerate and commit pnpm-lock.yaml (pnpm install --lockfile-only) so the lockfile matches the updated manifests.

Was this helpful? React with 👍 / 👎

gitar-bot[bot]
gitar-bot Bot reviewed Aug 5, 2026
View reviewed changes
Comment thread package.json
"nano-staged": "^1.0.2",
"tslib": "^2.8.1",
"untun": "^0.1.3"
"untun": "^0.2.2"

@gitar-bot gitar-bot Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Edge Case: untun 0.1.x→0.2.x is a pre-1.0 minor that may break tunnel

untun moves from ^0.1.3 to ^0.2.2; for 0.x packages a minor bump can contain breaking API changes. tsdown.config.ts relies on startTunnel({ port, acceptCloudflareNotice }) and tunnel.getURL(). If that surface changed, the --tunnel dev flow breaks. This is dev-only tooling, so impact is limited, but verify the tunnel still starts after the bump.

Was this helpful? React with 👍 / 👎

@gitar-bot

gitar-bot Bot commented Aug 5, 2026

Copy link
Copy Markdown
Code Review 🚫 Blocked 0 resolved / 2 findings

Updates non-major project dependencies and actions across the workspace. Blocked due to a missing lockfile update for package.json and a pre-1.0 minor version change in untun.

🚨 Bug: package.json bumped but pnpm-lock.yaml not updated

📄 package.json:33-47 📄 package.json:92 📄 pnpm-workspace.yaml:4

package.json (and pnpm-workspace.yaml override) were bumped to new versions, but pnpm-lock.yaml was not updated in this PR — it still pins the old specifiers/versions (e.g. untun specifier ^0.1.3, @prisma/adapter-pg/@prisma/client/prisma 7.8.0, @wolfstar/env-utilities 2.0.2, etc.). The CI step pnpm install --filter . --ignore-scripts runs with pnpm's CI default of --frozen-lockfile, so this mismatch will fail with ERR_PNPM_OUTDATED_LOCKFILE. Regenerate and commit pnpm-lock.yaml (pnpm install --lockfile-only) so the lockfile matches the updated manifests.

💡 Edge Case: untun 0.1.x→0.2.x is a pre-1.0 minor that may break tunnel

📄 package.json:50

untun moves from ^0.1.3 to ^0.2.2; for 0.x packages a minor bump can contain breaking API changes. tsdown.config.ts relies on startTunnel({ port, acceptCloudflareNotice }) and tunnel.getURL(). If that surface changed, the --tunnel dev flow breaks. This is dev-only tooling, so impact is limited, but verify the tunnel still starts after the bump.

🤖 Prompt for agents 
Code Review: Updates non-major project dependencies and actions across the workspace. Blocked due to a missing lockfile update for package.json and a pre-1.0 minor version change in untun.

1. 🚨 Bug: package.json bumped but pnpm-lock.yaml not updated
   Files: package.json:33-47, package.json:92, pnpm-workspace.yaml:4

   package.json (and pnpm-workspace.yaml override) were bumped to new versions, but pnpm-lock.yaml was not updated in this PR — it still pins the old specifiers/versions (e.g. `untun` specifier ^0.1.3, `@prisma/adapter-pg`/`@prisma/client`/`prisma` 7.8.0, `@wolfstar/env-utilities` 2.0.2, etc.). The CI step `pnpm install --filter . --ignore-scripts` runs with pnpm's CI default of `--frozen-lockfile`, so this mismatch will fail with `ERR_PNPM_OUTDATED_LOCKFILE`. Regenerate and commit pnpm-lock.yaml (`pnpm install --lockfile-only`) so the lockfile matches the updated manifests.

2. 💡 Edge Case: untun 0.1.x→0.2.x is a pre-1.0 minor that may break tunnel
   Files: package.json:50

   `untun` moves from ^0.1.3 to ^0.2.2; for 0.x packages a minor bump can contain breaking API changes. tsdown.config.ts relies on `startTunnel({ port, acceptCloudflareNotice })` and `tunnel.getURL()`. If that surface changed, the `--tunnel` dev flow breaks. This is dev-only tooling, so impact is limited, but verify the tunnel still starts after the bump.
Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply Compact 
gitar auto-apply:on         

gitar display:verbose

Was this helpful? React with 👍 / 👎 | Gitar

gitar-bot[bot]
gitar-bot Bot requested changes Aug 5, 2026
View reviewed changes

@gitar-bot gitar-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ This PR is blocked due to unresolved code review findings.

Configure merge blocking · Maintainers can dismiss this review.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from d917bc4 to 442ad95 Compare August 7, 2026 21:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gitar-bot gitar-bot[bot] gitar-bot[bot] requested changes

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants