chore(deps): combined safe/tested dependency updates (8 of 11 open Renovate PRs) by Decipher · Pull Request #155 · Decipher/stuar.tc

Decipher · 2026-08-12T08:13:28Z

Summary

Combines the remaining open Renovate PRs on GitHub into one branch against develop (all target main directly, bypassing GitFlow). Supersedes the earlier safe-only batch — every one of these is individually bumped, empirically tested (test suite, lint, typecheck, nuxt generate build — not just Renovate's own stale CI), and committed as its own commit within this branch.

Included (8)

js-yaml (via override) 4.1.2 → 4.3.1 — security fix (GHSA-flagged)
codecov/codecov-action v5.5.5 → v7.0.0 (pinned SHA)
GitLab CI node:22 images pinned to node:22.23.2
better-sqlite3 12 → 13 (transitive Nitro/db0 dep, no direct app usage — chore(deps): update dependency better-sqlite3 to v13 - autoclosed #131)
cweagans/composer-patches 1.7 → 2.0 (Drupal backend; verified patches still apply correctly and full PHPUnit suite — 29 tests — passes — chore(deps): update dependency cweagans/composer-patches to v2 - autoclosed #110)
@commitlint/cli + @commitlint/config-conventional 19 → 21 (verified against both a valid and an invalid commit message — chore(deps): update commitlint monorepo to v21 - autoclosed #72)
eslint 9 → 10 (also resolves a pre-existing unmet-peer warning from @nuxt/eslint-config, which already wanted eslint 10 — chore(deps): update devdependency eslint to v10 - autoclosed #139)
storybook + @storybook/vue3 9 → 10 (verified storybook:build itself succeeds; @storybook-vue/nuxt has an unmet peer warning on the framework integration but the actual build is unaffected — chore(deps): update storybook monorepo to v10 - autoclosed #138)

Excluded (3) — real, empirically-found blockers, not a rubber-stamp

npm:pnpm v11 (chore(deps): update dependency npm:pnpm to v11 #133): looked like the safest change in the batch (single-line version pin), but pnpm v11 cannot install the project at all — it fails to apply nuxt/patches/druxt.patch (ERR_PNPM_PATCH_FAILED) against the git-sourced druxt dependency. Confirmed with a clean A/B: the exact same lockfile installs cleanly under pnpm v10, and fails consistently under v11 (tested by setting packageManager to a real corepack-resolved pnpm@11.21.0 and doing a fully clean reinstall, twice). Needs its own investigation into pnpm v11's patch-application changes, or regenerating the patch, before it's safe.
nuxt 4.5.1 + @nuxt/test-utils v4 (chore(deps): update dependency nuxt to v4.5.1 [security] #144, chore(deps): update devdependency @nuxt/test-utils to v4 #137): these two are coupled (bumping nuxt alone breaks ESLint with 458 new errors and makes the entire Vitest suite fail to collect), but bumping both together still fails — @nuxt/test-utils v4 itself requires vitest@^4.0.2, which is a third major bump not present in any open Renovate PR. This needs its own dedicated pass (nuxt + test-utils + vitest + re-validating the coverage/reporter config together), not a drive-by dependency bump.
@nuxt/ui v4 (chore(deps): update dependency @nuxt/ui to v4 [security] #143): bumps cleanly, all tests/lint/typecheck pass, but pnpm run generate shows [Icon] failed to load icon for ~7 distinct icons (lucide:rss, lucide:heart, lucide:github, lucide:zoom-in, lucide:external-link, simple-icons:drupal, simple-icons:githubsponsors) across multiple pages. Confirmed real: the generated HTML has an empty <span class="iconify ..."> with no inlined SVG (previously these were inlined at build time), meaning the icon only appears after client-side JS hydration instead of being in the static HTML — a real regression on /writing's repository cards (GitHub Sponsors icon) and elsewhere. Needs its own icon-collection/config investigation before it's safe.

Test plan

Each of the 8 included changes individually verified (test/lint/build) before being combined
Full combined-state verification after all 8: pnpm test (582/582), pnpm lint — both on a fully clean node_modules reinstall
cweagans/composer-patches v2 verified against a live .devtools/ Drupal instance: patches apply, 29/29 PHPUnit tests pass
pnpm v11's install-breaking regression caught by an explicit clean A/B test (same lockfile, pnpm v10 vs v11) — not left in the branch

Mirror of gitlab.local MR !40 (primary repo) — already green there.

…ity patch, CI node pin)

postcss-html's Vue-template style-attribute extraction misparses inline style="..." attributes as malformed CSS declarations against postcss 8.5.26, transitively pulled in by the eslint/storybook major bumps.

coderabbitai · 2026-08-12T08:13:43Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ad68762e-4f6c-4319-bdf9-14ee7d96d2b0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-12T08:15:32Z

Preview site

pr-155: https://pr-155--stuartclark.netlify.app

Updated 2026-08-12T08:46:42Z

codecov · 2026-08-12T08:16:34Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.76%. Comparing base (edd81d2) to head (4466382).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop     #155   +/-   ##
========================================
  Coverage    99.76%   99.76%           
========================================
  Files           75       75           
  Lines         1268     1268           
  Branches       324      324           
========================================
  Hits          1265     1265           
  Misses           3        3

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-08-12T08:19:59Z

✅ Lighthouse Audit · `unknown`

All pages within budget — 12 pages scanned.

Route	FCP	LCP	CLS	TBT	Perf
`/`	✅ `2.9s`	✅ `3.0s`	✅ `0.000`	✅ `20.500`	✅ `0.89`
`/about`	✅ `2.7s`	✅ `3.1s`	✅ `0.000`	✅ `62.000`	✅ `0.89`
`/community`	✅ `2.6s`	✅ `2.7s`	✅ `0.016`	✅ `10.500`	✅ `0.92`
`/open-source`	✅ `2.7s`	✅ `4.8s`	✅ `0.000`	✅ `0.000`	✅ `0.78`
`/writing`	✅ `2.8s`	✅ `2.9s`	✅ `0.000`	✅ `30.500`	✅ `0.90`
`/writing/custom-formatters-410-20260731`	✅ `2.9s`	✅ `3.4s`	✅ `0.063`	✅ `0.000`	✅ `0.86`
`/writing/decoupling-configuration-config-pages-20220412`	✅ `2.6s`	✅ `3.0s`	✅ `0.015`	✅ `0.000`	✅ `0.90`
`/writing/field-tokens-200-20260722`	✅ `2.6s`	✅ `2.7s`	✅ `0.019`	✅ `0.000`	✅ `0.92`
`/writing/hello-world-20211126`	✅ `2.9s`	✅ `3.0s`	✅ `0.142`	✅ `0.000`	✅ `0.84`
`/writing/jsonapi-views-120-20260812`	✅ `2.7s`	✅ `2.8s`	✅ `0.005`	✅ `0.000`	✅ `0.91`
`/writing/layout-paragraphs-module-20220301`	✅ `2.6s`	✅ `2.7s`	✅ `0.055`	✅ `0.000`	✅ `0.92`
`/writing/what-no-images-20220315`	✅ `2.6s`	✅ `2.8s`	✅ `0.039`	✅ `0.000`	✅ `0.92`

Thresholds: FCP ≤ 3.5s, LCP ≤ 5.0s, CLS ≤ 0.25, TBT ≤ 600.000, Perf ≥ 0.75

…izer core patch composer-patches v2 defaults drupal/core patches to depth 2 (matching Drupal.org's conventional a/core/... diff header), but this custom patch uses a/modules/... (already relative to web/core/) and needs depth 1. Without an explicit override, v2 silently fails to apply it (ERR: 'No available patcher was able to apply patch'), which was masked locally by a stale vendor/ directory retaining the already-patched file from before the v1->v2 bump — only surfaced on a genuinely clean install. Also commits patches.lock.json, the new per-patch lockfile v2 introduces for reproducibility (analogous to composer.lock).

Decipher added 7 commits August 12, 2026 07:01

chore(deps): safe automated updates (codecov-action v7, js-yaml secur…

70a01cb

…ity patch, CI node pin)

chore(deps): update dependency better-sqlite3 to v13

06f2d4a

chore(deps): update dependency cweagans/composer-patches to v2

4fc6599

chore(deps): update commitlint monorepo to v21

e19df1a

chore(deps): update devdependency eslint to v10

3d6d77b

chore(deps): update storybook monorepo to v10

2178025

fix(nuxt): pin postcss to 8.5.16 to fix a stylelint false positive

790c273

postcss-html's Vue-template style-attribute extraction misparses inline style="..." attributes as malformed CSS declarations against postcss 8.5.26, transitively pulled in by the eslint/storybook major bumps.

Decipher merged commit 3f608d9 into develop Aug 12, 2026
10 of 11 checks passed

Decipher deleted the chore/deps-major-updates branch August 12, 2026 08:49

Navigation Menu

chore(deps): combined safe/tested dependency updates (8 of 11 open Renovate PRs) - #155

chore(deps): combined safe/tested dependency updates (8 of 11 open Renovate PRs)#155
Decipher merged 8 commits into
developfrom
chore/deps-major-updates

Decipher commented Aug 12, 2026

Uh oh!

coderabbitai Bot commented Aug 12, 2026 •

edited

Loading

Review skipped

Uh oh!

github-actions Bot commented Aug 12, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Aug 12, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 12, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Decipher commented Aug 12, 2026

Summary

Included (8)

Excluded (3) — real, empirically-found blockers, not a rubber-stamp

Test plan

Uh oh!

coderabbitai Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Preview site

Uh oh!

codecov Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Lighthouse Audit · unknown

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Aug 12, 2026 •

edited

Loading

github-actions Bot commented Aug 12, 2026 •

edited

Loading

codecov Bot commented Aug 12, 2026 •

edited

Loading

github-actions Bot commented Aug 12, 2026 •

edited

Loading

✅ Lighthouse Audit · `unknown`