Conversation
dependabot
bot
added
dependencies
|
👋 Thanks for contributing! We will assign a reviewer within the next two weeks. In the meantime, please ensure that:
We'll be in touch! 😊 |
|
Season’s greetings! 👋 We’d like to thank everyone for another year of fruitful collaborations, engaging discussions, and for the continued support of our work. Learning Equality will be on holidays from December 22 to January 5. We look forward to much more in the new year and wish you a very happy holiday season! Are you preparing for Google Summer of Code? See our GSoC guidelines. |
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
Dependency Update Review
Package: workbox-webpack-plugin 7.3.0 → 7.4.0
Semver risk: Minor
Dependency type: devDependency
CI status: Passing (frontend tests, build, linting all green)
Changelog Analysis
Sources consulted:
- Release notes v7.4.0
- Commit comparison v7.3.0...v7.4.0 (101 commits)
Breaking changes: None found.
Deprecations: None found.
Security fixes: The release includes npm audit fix runs across workbox packages and updates to transitive dependencies (js-yaml 3.14.1 → 3.14.2, glob, pbkdf2, etc.) — this is the "critical dependency updates" referenced in the release notes.
Other notable changes:
- Fix for potential unhandled rejections in
StrategyHandler.doneWaiting(PR #3320) - Node.js engine requirement bumped from
>=16.0.0to>=20.0.0inworkbox-buildandworkbox-webpack-plugin— compatible with this project'snode: 20.xengine requirement - Internal CI and tooling updates (GitHub Actions, rollup version)
New maintainer: This version was published to npm by swissspidy (Pascal Birchler), a new releaser for workbox-webpack-plugin. This is a known Workbox/Google Chrome team contributor.
Compatibility Assessment
- Project uses Node 20.x: compatible with the new
>=20.0.0engine requirement ✓ - No breaking API changes: no code migration needed ✓
- Peer dependency requirements unchanged (
webpack ^4.4.0 || ^5.91.0): satisfied ✓ - Lockfile changes contain only expected transitive dependency updates ✓
- No prior reverts or issues with this upgrade found ✓
Recommendation
APPROVE — Low-risk minor bump of a dev dependency. The release is primarily internal dependency maintenance and security fixes. CI confirms full compatibility.
|
@dependabot rebase |
Bumps [workbox-webpack-plugin](https://github.com/googlechrome/workbox) from 7.3.0 to 7.4.0. - [Release notes](https://github.com/googlechrome/workbox/releases) - [Commits](GoogleChrome/workbox@v7.3.0...v7.4.0) --- updated-dependencies: - dependency-name: workbox-webpack-plugin dependency-version: 7.4.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
force-pushed
the
dependabot/npm_and_yarn/workbox-webpack-plugin-7.4.0
branch
from
89c9f36 to
4a394de
Compare
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
Dependency Update Review
Package: workbox-webpack-plugin 7.3.0 → 7.4.0
Semver risk: Minor
Dependency type: devDependency
CI status: Passing (frontend build, frontend tests, linting, message files all green)
Changelog Analysis
Sources consulted:
Breaking changes: None found.
Deprecations: None found.
Security fixes: The release notes describe this as "critical dependency updates" — workbox's own transitive dependencies were updated via npm audit fix to address vulnerabilities in workbox's build/test toolchain. No API changes.
Other notable changes: GitHub Actions workflow updates in the workbox repo itself. No user-facing or API-level changes.
Compatibility Assessment
- Project uses affected APIs: no (no API changes in this release)
- Peer dependency changes: no (
webpack ^4.4.0 || ^5.91.0— unchanged) - Node engine requirement:
>=20.0.0— compatible with project'snode: 20.x - Code changes required: no
- New maintainer published this version (
swissspidy) — noted but this is a known Workbox/Chrome team member - Lockfile changes: only expected transitive dependency updates
Recommendation
APPROVE — Low-risk minor bump of a dev dependency. No API changes, no breaking changes, CI passing. The release is purely internal dependency maintenance.
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
Dependency Update Review
Package: workbox-webpack-plugin 7.3.0 → 7.4.0
Semver risk: Minor
Dependency type: devDependency
CI status: Passing — frontend build, frontend tests, linting, and message build all green.
Changelog Analysis
Sources consulted:
This is a housekeeping release with no API changes. The v7.4.0 release notes state "Critical dependency updates" and the underlying changes are:
npm audit fixto update transitive dependencies (#3441)- GitHub Actions version updates to fix deprecated CI workflows (#3440)
- Bump
js-yamlfrom 3.14.1 to 3.14.2 (#3439)
Breaking changes: None.
Deprecations: None.
Security fixes: Transitive dependency audit fixes (no specific CVEs listed).
Compatibility Assessment
- Project uses affected APIs: No — no workbox-webpack-plugin API changes in this release.
- Peer dependency changes: None.
- Code changes required: None — only
package.jsonandpnpm-lock.yamlchanged, as expected. - Prior failed attempts: None.
Note: This version was published to npm by swissspidy (Pascal Birchler), a new releaser for this package. He is a known Workbox/Google Chrome contributor who authored and merged the upstream PRs.
Recommendation
APPROVE — Low-risk minor bump of a devDependency containing only internal dependency maintenance. CI passing.
rtibbles
left a comment
rtibbles
left a comment
There was a problem hiding this comment.
No concerns from changelog. Good to merge.
dependabot
bot
deleted the
dependabot/npm_and_yarn/workbox-webpack-plugin-7.4.0
branch
2 participants
Bumps workbox-webpack-plugin from 7.3.0 to 7.4.0.
Release notes
Sourced from workbox-webpack-plugin's releases.
Commits
fa702fev7.4.0c34bf28Merge pull request #3441 from GoogleChrome/chore/npm-auditcf21cb6Merge pull request #3440 from GoogleChrome/chore/update-actions5083f3fUpdate dependenciescf91300Merge pull request #3439 from GoogleChrome/dependabot/npm_and_yarn/js-yaml-3....b6825a9Update upload-sarif actiond971ff7Update GitHub Actions to latest versions076adc0Bump js-yaml from 3.14.1 to 3.14.269478fdMerge pull request #3433 from GoogleChrome/dependabot/npm_and_yarn/packages/w...0d9b8b3Merge pull request #3434 from GoogleChrome/dependabot/npm_and_yarn/glob-11.1.0Maintainer changes
This version was pushed to npm by swissspidy, a new releaser for workbox-webpack-plugin since your current version.
You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)