chore(deps): pin dependencies - #1833
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
|
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.
Updates Node/pnpm runtime requirements across packages/apps and tightens dependency constraints, plus refreshes a GitHub Action pin for releases.
Changes:
- Pin
enginesfor Node and pnpm to specific versions across multiplepackage.jsonfiles - Pin some
peerDependencies(React/ReactDOM/Sonner) to exact versions in UI-related packages - Update
actions/create-github-app-tokento a newer pinned commit in the release workflow
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/url-state-provider/package.json | Pins Node/pnpm engine versions |
| packages/ui-components/package.json | Pins Node/pnpm engines and tightens peer dependency versions |
| packages/template/package.json | Pins Node/pnpm engine versions |
| packages/oauth/package.json | Pins Node/pnpm engine versions |
| packages/messages-provider/package.json | Pins Node/pnpm engine versions |
| packages/greenhouse-auth-provider/package.json | Pins Node/pnpm engines and tightens React peer dependency |
| packages/communicator/package.json | Pins Node/pnpm engine versions |
| apps/template/package.json | Pins Node/pnpm engine versions |
| apps/heureka/package.json | Pins Node/pnpm engine versions |
| apps/example/package.json | Pins Node/pnpm engine versions |
| apps/carbon/package.json | Pins Node/pnpm engine versions |
| .github/workflows/release.yaml | Updates pinned create-github-app-token action digest |
Comment on lines
+26
to
+27
| "node": "v26.5.0", | ||
| "pnpm": "11.17.0" |
Comment on lines
+14
to
+15
| "node": "v26.5.0", | ||
| "pnpm": "11.17.0" |
Comment on lines
+59
to
+61
| "react": "19.2.8", | ||
| "react-dom": "19.2.8", | ||
| "sonner": "2.0.7" |
| }, | ||
| "peerDependencies": { | ||
| "react": ">=19.0.0" | ||
| "react": "19.2.8" |
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
July 28, 2026 08:02
47c4464 to
dc3e387
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (3)
packages/url-state-provider/package.json:27
- In
package.json#engines, values are expected to be SemVer ranges (and typically without a leadingv). Using\"v26.5.0\"may not be parsed as a valid range by npm’s semver range logic and can cause the engine check to be ignored or behave unexpectedly. Recommend switching to a valid range (e.g.,\">=26.5.0\"or a compatible range) and applying the same fix across the other updatedpackage.jsonfiles in this PR whereengines.nodewas changed similarly.
"node": "v26.5.0",
"pnpm": "11.17.0"
packages/ui-components/package.json:61
- These are
peerDependencies, so pinning to exact versions can create avoidable install conflicts for consumers (peer resolution will warn/error if they have19.2.xor newer patch versions). Prefer expressing the supported compatibility range (e.g., allowing compatible minor/patch versions) unless this package truly only works with those exact versions.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- Changing
reactinpeerDependenciesfrom a range to an exact version can unnecessarily restrict consumers and increase dependency resolution conflicts. Unless there’s a concrete incompatibility, prefer a compatibility range that reflects what versions are supported (e.g.,>=19.2.8 <20or similar).
"react": "19.2.8"
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
July 28, 2026 09:09
dc3e387 to
b9fee49
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (3)
packages/url-state-provider/package.json:27
enginesis typically expressed as a semver range (e.g.>=26.5.0) rather than an exact patch version, otherwise installs will fail for users/CI on newer patch releases. Also consider omitting thevprefix for consistency with semver ranges, and (if the goal is to pin pnpm exactly) prefer using thepackageManagerfield (usually at the repo root) to reliably enforce the pnpm version across tooling.
"node": "v26.5.0",
"pnpm": "11.17.0"
packages/ui-components/package.json:61
- Pinning
peerDependenciesto exact versions is likely to cause unnecessary peer resolution conflicts for consumers (e.g., when they have newer compatible patch/minor versions installed). Peer deps are generally expected to be semver ranges (e.g.,^19.2.0or>=19 <20) so package consumers can satisfy the contract without matching one exact version.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- This changes the React peer requirement from a compatible range (
>=19.0.0) to an exact version. Exact peer versions commonly create avoidable install warnings/conflicts for consumers who have a different (but compatible) 19.x installed; using a semver range would better reflect a peer contract.
"react": "19.2.8"
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
July 28, 2026 10:48
b9fee49 to
d482422
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (3)
packages/url-state-provider/package.json:27
- "engines.node"
is set to"v26.5.0". Theenginesfield is expected to contain a valid semver range/version, and thevprefix can cause semver parsing/tooling differences. Prefer"26.5.0"or a range like">=26.5.0"(and apply the same adjustment across the other package/apppackage.json` files touched in this PR).
"node": "v26.5.0",
"pnpm": "11.17.0"
packages/ui-components/package.json:61
- These
peerDependenciesare pinned to exact versions. Exact peer pins are typically too restrictive for consumers (they prevent using compatible patch/minor versions and can force unnecessary dependency conflicts). Prefer semver ranges (e.g.,^19.2.0/^2.0.7, or whatever compatibility policy you intend) unless there’s a concrete incompatibility that requires exact matching.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- Changing the React peer dependency from a range (
>=19.0.0) to an exact version (19.2.8) makes the package significantly harder to consume alongside other React 19.x installations. Unless you rely on behavior specific to exactly 19.2.8, consider switching back to a compatible range (e.g.,^19.2.0or>=19.0.0 <20).
"react": "19.2.8"
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
July 28, 2026 11:48
d482422 to
9dd2f4b
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (2)
packages/ui-components/package.json:61
- Pinning peerDependencies to exact versions is likely to cause unnecessary installation/compatibility failures for consumers (peer deps are typically declared as compatible ranges). Consider switching these to ranges (e.g. "^19.2.0" for React/ReactDOM and "^2.0.7" for Sonner, or another intended compatibility policy) so downstream projects can satisfy the peer deps without matching an exact patch version.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- Changing the React peer dependency from a range (previously ">=19.0.0") to an exact version ("19.2.8") is a breaking constraint for consumers and can lead to peer resolution conflicts. Prefer a compatible range (for example "^19.0.0" or ">=19.0.0 <20") unless you have a strong reason to require exactly 19.2.8.
"react": "19.2.8"
Comment on lines
+26
to
+27
| "node": "v26.5.0", | ||
| "pnpm": "11.17.0" |
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
July 29, 2026 07:13
9dd2f4b to
0303c5e
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (2)
packages/ui-components/package.json:61
- Pinning
peerDependenciesto exact versions significantly reduces compatibility and can cause avoidable dependency resolution conflicts for downstream apps (they must match exactly). For libraries, peer deps are typically specified as a compatible range (e.g.,^19.x/>=19 <20) to allow patch/minor updates while still protecting against breaking majors. If the intent is to require minimum versions, consider using a lower-bounded range instead of an exact pin.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- This tightens a previously broad peer dependency (
>=19.0.0) to an exact version, which can be a breaking change for consumers already on a different compatible React 19 version. Prefer a supported range that reflects actual compatibility (e.g.,>=19 <20or^19.2.0) unless there is a concrete technical requirement for an exact match.
"react": "19.2.8"
Comment on lines
+26
to
+27
| "node": "v26.5.0", | ||
| "pnpm": "11.17.0" |
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
July 29, 2026 08:44
0303c5e to
b8af907
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 13 changed files in this pull request and generated no new comments.
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
Comments suppressed due to low confidence (3)
packages/url-state-provider/package.json:27
- Pinning
enginesto exact versions is likely to cause unnecessary install/CI failures (e.g., Node 26.5.1 or pnpm 11.17.1 will be rejected even if compatible). Prefer a semver range (e.g.,>=26.5.0 <27for Node and>=11.17.0 <12for pnpm, or whatever ranges you support). This same pattern appears across multiple package/apppackage.jsonfiles in this PR.
"node": "v26.5.0",
"pnpm": "11.17.0"
packages/ui-components/package.json:61
- Tightening
peerDependenciesto exact versions makes the package harder to consume because it can force version conflicts in downstream apps that have compatible patch/minor versions installed. Prefer semver ranges for peers (e.g.,^19.2.0or>=19.1.0 <20for React/ReactDOM, and a similar compatible range forsonner) unless there is a concrete incompatibility that requires exact pinning.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- Same concern as in
ui-components: exactpeerDependenciesare unnecessarily restrictive for consumers and often lead to dependency resolution conflicts. Prefer a compatible range (e.g.,^19.2.0or>=19.0.0 <20) unless this provider is known to break with other 19.x releases.
"react": "19.2.8"
Contributor
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v3→v3.2.0>=20.19.0→v26.5.0>=20.12.0→v26.5.0>=8.0.0→11.17.0^19.1.0→19.2.8>=19.0.0→19.2.8^19.1.0→19.2.8^2.0.7→2.0.7Add the preset
:preserveSemverRangesto your config if you don't want to pin your dependencies.Configuration
📅 Schedule: (in timezone Europe/Berlin)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.