build: bump non-breaking dependencies for dependabot PRs - #152
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
The updated dependency tree raises the minimum Node.js version required by some packages beyond the current engines.node declaration, which can break installs/CI on supported Node 20.x versions.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR consolidates a set of non-breaking Dependabot dependency updates into a single branch, primarily updating linting tooling (ESLint + TypeScript ESLint) and refreshing the lockfile to pull in patched transitive dependencies.
Changes:
- Bump
eslintto^9.39.4andtypescript-eslintto^8.60.1inpackage.json. - Regenerate
package-lock.json, updating a large set of transitive dependencies (including multiple security-related patch bumps).
File summaries
| File | Description |
|---|---|
| package.json | Updates devDependency version ranges for ESLint and TypeScript ESLint. |
| package-lock.json | Updates resolved dependency graph to match new ranges, bringing in patched transitive versions. |
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
6f67680 to
7823b4e
Compare
There was a problem hiding this comment.
🟡 Changes recommended
package-lock.json still records the root package engines.node as >=20.0.0, which is inconsistent with the updated package.json requirement and should be regenerated/updated accordingly.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
f8baa18 to
704f209
Compare
There was a problem hiding this comment.
🟡 Changes recommended
The lockfile resolves eslint@9.39.5 as a deprecated version, which should be replaced with a supported ESLint release to avoid warnings/unsupported tooling.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
704f209 to
22161bc
Compare
Consolidates stale dependabot PRs #75, #101, #111, #116, #121, #145 and #151 into one bump: eslint ^9.39.4, typescript-eslint ^8.60.1, engines.node >=20.19.0, plus transitive updates (fast-uri, brace-expansion, qs, follow-redirects, diff, sha.js). Major bumps (hardhat 3, hardhat-toolbox 7) are intentionally excluded as breaking. Rebased on master with axios 1.19.0. Ticket: SCAAS-11228 Signed-off-by: Sachu Abraham <sachuabraham@bitgo.com> Signed-off-by: Sachu Shaji Abraham <sachuabraham@bitgo.com>
22161bc to
e114685
Compare
Consolidates all non-breaking Dependabot PRs into one branch — the individual PRs are stale and mutually conflicting (BLOCKED/DIRTY merge states).
Supersedes (non-breaking, same-major bumps)
Merging this will allow Dependabot to auto-close the superseded PRs.
Skipped as breaking (major bumps — separate effort)
#120, #125, #126, #147 — hardhat ^2.22 → ^3.x, hardhat-toolbox ^5 → ^7, @openzeppelin/hardhat-upgrades ^3 → ^4, hardhat-verify ^2 → ^3, hardhat-solhint ^4 → ^5. A Hardhat 3 migration needs its own ticket and review.
Verification
npm run lint— cleannpm test— 207 passingTicket: SCAAS-11228