Skip to content

chore(deps): bump the npm-all group across 1 directory with 12 updates - #57

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/evalboard/npm-all-19b0ad673a
Open

chore(deps): bump the npm-all group across 1 directory with 12 updates#57
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/evalboard/npm-all-19b0ad673a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-all group with 11 updates in the /evalboard directory:

Package From To
next 15.5.22 16.2.12
recharts 2.15.4 3.10.1
@testing-library/jest-dom 6.9.1 7.0.0
@types/node 22.20.1 26.1.2
@vitejs/plugin-react 4.7.0 6.0.4
@vitest/coverage-v8 3.2.7 4.1.10
jsdom 25.0.1 30.0.0
tailwindcss 3.4.19 4.3.3
typescript 5.9.3 7.0.2
vitest 3.2.7 4.1.10
@azure/storage-blob 12.32.0 12.33.0

Updates next from 15.5.22 to 16.2.12

Release notes

Sourced from next's releases.

v16.2.12

What's Changed

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

v16.2.11

This release contains security fixes for the following advisories:

High:

Moderate:

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

v16.2.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Backport documentation fixes for v16.2 (#93804)
  • [backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)
  • [backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)
  • [backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)
  • [backport] Encode non-ASCII characters in cache tags at construction (#93918)
  • [backport] Fix server action forwarding loop with middleware rewrites (#93919)
  • [backport] Turbopack: switch from base40 to base38 hash encoding (#93932)
  • [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)

... (truncated)

Commits
  • 2234717 v16.2.12
  • 957f5ed [Backport] Fixes to support TypeScript 7 (#95831)
  • b56eb16 Backport/docs fixes 16.2 - July round (#96031)
  • 9beca08 v16.2.11
  • 3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
  • ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
  • 9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
  • b512063 [16.x] Set correct origin for internal redirects in custom server
  • d303326 [16.x] Ensure exotic rewrite param values are properly encoded
  • 73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
  • Additional commits viewable in compare view

Updates recharts from 2.15.4 to 3.10.1

Release notes

Sourced from recharts's releases.

v3.10.1

What's Changed

New Contributors

Full Changelog: recharts/recharts@v3.10.0...v3.10.1

v3.10.0

What's Changed

Legend position

Legend now supports position and offset props, same as Label and LabeList. This replaces the previous align and verticalAlign for a more convenient positioning, and fixes couple visual bugs too. See https://recharts.github.io/en-US/examples/LegendPosition/

XAxis auto height

XAxis now supports height="auto" prop, similar to YAxis width="auto".

Other features

Bugfixes

New Contributors

... (truncated)

Commits
  • ffb9187 3.10.1
  • 411b6f2 fix(bar): keep barGap correct when maxBarSize clamps the bar width (#2774) (#...
  • 58c321b chore(deps-dev): bump postcss from 8.5.10 to 8.5.22 (#7581)
  • f08972b chore(deps-dev): bump the storybook group with 8 updates (#7578)
  • 89599d0 chore(deps-dev): bump chromatic from 11.29.0 to 18.1.0 (#7579)
  • 3da7d87 chore(deps-dev): bump typescript-eslint from 8.64.0 to 8.65.0 in the typescri...
  • 9764273 chore(deps-dev): bump marked from 18.0.5 to 18.0.7 (#7577)
  • a5d7737 fix(tooltip): fall back to index-based search when label-based search returns...
  • 497e8df chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 (#7576)
  • 0776eb0 chore(deps): bump immer from 11.1.9 to 11.1.15 (#7575)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for recharts since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates @testing-library/jest-dom from 6.9.1 to 7.0.0

Release notes

Sourced from @​testing-library/jest-dom's releases.

v7.0.0

7.0.0 (2026-07-20)

Features

  • add toContainAnyBy* and toContainOneBy* query matchers (1e39089)

BREAKING CHANGES

  • @​testing-library/dom is now a required peer dependency. The minimum supported Node.js version is now 22.

Repaired release for testing-library/jest-dom#731

v6.10.0

6.10.0 (2026-07-20)

Features

  • add toContainAnyBy* and toContainOneBy* query matchers (#731) (cae44df)
Commits
  • 1e39089 feat: add toContainAnyBy* and toContainOneBy* query matchers
  • cae44df feat: add toContainAnyBy* and toContainOneBy* query matchers (#731)
  • 55c07ce ci: switch release to npm trusted publishing (#726)
  • 213256f docs: move toHaveSelection from the deprecated section (#717)
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​testing-library/jest-dom since your current version.


Updates @types/node from 22.20.1 to 26.1.2

Commits

Updates @vitejs/plugin-react from 4.7.0 to 6.0.4

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.0.4

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined. This error is now fixed.

plugin-react@6.0.3

No release notes provided.

plugin-react@6.0.2

Allow all options in reactCompilerPreset (#1189)

This is a type only change. Only compilationMode and target options were available for reactCompilerPreset.

plugin-react@6.0.1

Expand @rolldown/plugin-babel peer dep range (#1146)

Expanded @rolldown/plugin-babel peer dep range to include ^0.2.0.

plugin-react@6.0.0

Remove Babel Related Features (#1123)

Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it. With that, there are no transform applied that requires Babel. To reduce the installation size of this plugin, babel is no longer a dependency of this plugin and the related features are removed.

If you are using Babel, you can use @rolldown/plugin-babel together with this plugin:

 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [


react({



  babel: {



    plugins: ['@babel/plugin-proposal-throw-expressions'],



  },



}),





react(),



babel({



  plugins: ['@babel/plugin-proposal-throw-expressions'],



}),

]
})

For React compiler users, you can use reactCompilerPreset for easier setup with preconfigured filter to improve build performance:

 import { defineConfig } from 'vite'
</tr></table>

... (truncated)

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.0.4 (2026-07-22)

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined. This error is now fixed.

6.0.3 (2026-06-23)

6.0.2 (2026-05-14)

Allow all options in reactCompilerPreset (#1189)

This is a type only change. Only compilationMode and target options were available for reactCompilerPreset.

6.0.1 (2026-03-13)

Expand @rolldown/plugin-babel peer dep range (#1146)

Expanded @rolldown/plugin-babel peer dep range to include ^0.2.0.

6.0.0 (2026-03-12)

6.0.0-beta.0 (2026-03-03)

Remove Babel Related Features (#1123)

Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it. With that, there are no transform applied that requires Babel. To reduce the installation size of this plugin, babel is no longer a dependency of this plugin and the related features are removed.

If you are using Babel, you can use @rolldown/plugin-babel together with this plugin:

 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [


react({



  babel: {



    plugins: ['@babel/plugin-proposal-throw-expressions'],



  },



}),





react(),



babel({



  plugins: ['@babel/plugin-proposal-throw-expressions'],



}),

]
})

... (truncated)

Commits
  • f4b5498 release: plugin-react@6.0.4
  • 7a40659 fix(react): $RefreshSig$ is not defined with NODE_ENV=production vite dev ...
  • 98b32d4 fix(deps): update react 19.2.8 (#1298)
  • 8ae5449 fix: babel-plugin-react-compiler cannot be imported when used in a framework ...
  • f09ea01 fix(deps): update all non-major dependencies (#1282)
  • 640fd35 release: plugin-react@6.0.3
  • 889efb0 fix(deps): update all non-major dependencies (#1249)
  • 6c57dd4 fix(plugin-react): use '/' base in bundledDev preamble to fix non-root base p...
  • 3cc33a7 fix(deps): update react-related dependencies (#1245)
  • c0f7c7f docs: mention the Biome rule in the "Consistent components exports" section (...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​vitejs/plugin-react since your current version.


Updates @vitest/coverage-v8 from 3.2.7 to 4.1.10

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.10

   🐞 Bug Fixes

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub

... (truncated)

Commits

Updates jsdom from 25.0.1 to 30.0.0

Release notes

Sourced from jsdom's releases.

v30.0.0

Breaking changes:

  • Node.js minimum version raised to ^22.22.2 || ^24.15.0 || >=26.0.0.

Other changes:

  • Added CSS.escape() and CSS.supports() functions. (@​asamuzaK)
  • Added 'background-position-x' and 'background-position-y' CSS properties. (@​olagokemills)
  • Fixed getComputedStyle() to convert length values into pixels. (@​asamuzaK)
  • Fixed CSS function serialization, e.g., in the return value of getPropertyValue(). (@​asamuzaK)
  • Fixed the type of error thrown by document.evaluate() (@​dokson)

v29.1.1

  • Fixed 'border-radius' computed style serialization. (@​asamuzaK)
  • Fixed computed style computation when using 'background-origin' and 'background-clip' CSS properties. (@​asamuzaK)
  • Significantly optimized initial calls to getComputedStyle(), before the cache warms up. (@​asamuzaK)

v29.1.0

  • Added basic support for the ratio CSS type. (@​asamuzaK)
  • Fixed getComputedStyle() sometimes returning outdated results after CSS was modified. (@​asamuzaK)

v29.0.2

  • Significantly improved and sped up getComputedStyle(). Computed value rules are now applied across a broader set of properties, and include fixes related to inheritance, defaulting keywords, custom properties, and color-related values such as currentcolor and system colors. (@​asamuzaK)
  • Fixed CSS 'background' and 'border' shorthand parsing. (@​asamuzaK)

v29.0.1

  • Fixed CSS parsing of 'border', 'background', and their sub-shorthands containing keywords or var(). (@​asamuzaK)
  • Fixed getComputedStyle() to return a more functional CSSStyleDeclaration object, including indexed access support, which regressed in v29.0.0.

v29.0.0

Breaking changes:

  • Node.js v22.13.0+ is now the minimum supported v22 version (was v22.12.0+).

Other changes:

  • Overhauled the CSSOM implementation, replacing the @acemir/cssom and cssstyle dependencies with fresh internal implementations built on webidl2js wrappers and the css-tree parser. Serialization, parsing, and API behavior is improved in various ways, especially around edge cases.
  • Added CSSCounterStyleRule and CSSNamespaceRule to jsdom Windows.
  • Added cssMediaRule.matches and cssSupportsRule.matches getters.
  • Added proper media query parsing in MediaList, using css-tree instead of naive comma-splitting. Invalid queries become "not all" per spec.
  • Added cssKeyframeRule.keyText getter/setter validation.
  • Added cssStyleRule.selectorText setter validation: invalid selectors are now rejected.
  • Added styleSheet.ownerNode, styleSheet.href, and styleSheet.title.
  • Added bad port blocking per the fetch specification, preventing fetches to commonly-abused ports.
  • Improved Document initialization performance by lazily initializing the CSS selector engine, avoiding ~0.5 ms of overhead per Document. (@​thypon)
  • Fixed a memory leak when stylesheets were removed from the document.
  • Fixed CSSStyleDeclaration modifications to properly trigger custom element reactions.
  • Fixed nested @media rule parsing.
  • Fixed CSSStyleSheet's "disallow modification" flag not being checked in all mutation methods.

... (truncated)

Commits
  • 20a01fc 30.0.0
  • 8c8e583 Precompute WPT expectation matches
  • f32245c Bump Node.js floor and dependencies
  • 03ef23b Add background-position longhands
  • ded056f Test CSS.escape() with numeric IDs
  • d312832 Convert CSS values to pixels for computed styles
  • 4e0ee41 Implement CSS.escape() and CSS.supports()
  • 05eb709 Fix benchmark:compare script on Windows
  • 97c1b90 Fix CSS function value serialization
  • 15642ba Add benchmark comparison script
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for jsdom since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates postcss from 8.5.18 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).
Changelog

Sourced from postcss's changelog.

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).
Commits

Updates tailwindcss from 3.4.19 to 4.3.3

Release notes

Sourced from tailwindcss's releases.

v4.3.3

Fixed

  • Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#20297)
  • Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#20298)
  • Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#20292)
  • Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#20299)
  • Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#20302)
  • Parse selectors like [data-foo]div as two selectors instead of one (#20303)
  • Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#20310)
  • Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#20124)
  • Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#20314)
  • Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#20319)
  • Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#20325)
  • Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#20318)
  • Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#20329)
  • Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#20335)
  • Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#20336)

v4.3.2

Fixed

  • Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
  • Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
  • Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
  • Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
  • Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
  • Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
  • Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
  • Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
  • Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
  • Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
  • Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
  • Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
  • Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)

v4.3.1

Added

  • Add --silent option to suppress output in @tailwindcss/cli (#20100)

Fixed

  • Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#20028)
  • Canonicalization: don't crash when plugin utilities throw for unsupported values (#20052)
  • Allow @apply to be used with CSS mixins (#19427)
  • Ensure not-* correctly negates @container queries, including style(…) queries (#20059)
  • Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (#20080)
  • Fix 'Sourcemap is likely to be incorrect' warnings when using @tailwindcss/vite (#20103)
  • Ensure @tailwindcss/webpack can be installed in Rspack projects without requiring webpack as a peer dependency (#20027)

... (truncated)

Changelog

Sourced from tailwindcss's changelog.

[4.3.3] - 2026-07-16

Fixed

  • Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#20297)
  • Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#20298)
  • Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#20292)
  • Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#20299)
  • Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#20302)
  • Parse selectors like [data-foo]div as two selectors instead of one (#20303)
  • Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#20310)
  • Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#20124)
  • Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#20314)
  • Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#20319)
  • Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#20325)
  • Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#20318)
  • Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#20329)
  • Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#20335)
  • Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#20336)

[4.3.2] - 2026-06-26

Fixed

  • Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
  • Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
  • Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
  • Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
  • Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
  • Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
  • Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
  • Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
  • Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
  • Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
  • Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
  • Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
  • Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)

[4.3.1] - 2026-06-12

Added

  • Add --silent option to suppress output in @tailwindcss/cli (

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 27, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 27, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/evalboard/npm-all-19b0ad673a branch from 120486d to 7bc5168 Compare July 27, 2026 19:42
@dependabot
chore(deps): bump the npm-all group across 1 directory with 12 updates
e428115 
Bumps the npm-all group with 11 updates in the /evalboard directory:

| Package | From | To |
| --- | --- | --- |
| [next](https://github.com/vercel/next.js) | `15.5.22` | `16.2.12` |
| [recharts](https://github.com/recharts/recharts) | `2.15.4` | `3.10.1` |
| [@testing-library/jest-dom](https://github.com/testing-library/jest-dom) | `6.9.1` | `7.0.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.20.1` | `26.1.2` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `4.7.0` | `6.0.4` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `3.2.7` | `4.1.10` |
| [jsdom](https://github.com/jsdom/jsdom) | `25.0.1` | `30.0.0` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `3.4.19` | `4.3.3` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `3.2.7` | `4.1.10` |
| [@azure/storage-blob](https://github.com/Azure/azure-sdk-for-js/tree/HEAD/sdk/storage/storage-blob) | `12.32.0` | `12.33.0` |



Updates `next` from 15.5.22 to 16.2.12
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v15.5.22...v16.2.12)

Updates `recharts` from 2.15.4 to 3.10.1
- [Release notes](https://github.com/recharts/recharts/releases)
- [Changelog](https://github.com/recharts/recharts/blob/main/CHANGELOG.md)
- [Commits](recharts/recharts@v2.15.4...v3.10.1)

Updates `@testing-library/jest-dom` from 6.9.1 to 7.0.0
- [Release notes](https://github.com/testing-library/jest-dom/releases)
- [Changelog](https://github.com/testing-library/jest-dom/blob/main/CHANGELOG.md)
- [Commits](testing-library/jest-dom@v6.9.1...v7.0.0)

Updates `@types/node` from 22.20.1 to 26.1.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitejs/plugin-react` from 4.7.0 to 6.0.4
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.4/packages/plugin-react)

Updates `@vitest/coverage-v8` from 3.2.7 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/coverage-v8)

Updates `jsdom` from 25.0.1 to 30.0.0
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v25.0.1...v30.0.0)

Updates `postcss` from 8.5.18 to 8.5.23
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.18...8.5.23)

Updates `tailwindcss` from 3.4.19 to 4.3.3
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/tailwindcss)

Updates `typescript` from 5.9.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

Updates `vitest` from 3.2.7 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest)

Updates `@azure/storage-blob` from 12.32.0 to 12.33.0
- [Release notes](https://github.com/Azure/azure-sdk-for-js/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/storage/storage-blob/CHANGELOG.md)
- [Commits](https://github.com/Azure/azure-sdk-for-js/commits/@azure/storage-blob_12.33.0/sdk/storage/storage-blob)

---
updated-dependencies:
- dependency-name: "@azure/storage-blob"
  dependency-version: 12.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-all
- dependency-name: "@testing-library/jest-dom"
  dependency-version: 7.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-all
- dependency-name: "@types/node"
  dependency-version: 26.1.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-all
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.0.4
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-all
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-all
- dependency-name: jsdom
  dependency-version: 30.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-all
- dependency-name: next
  dependency-version: 16.2.12
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-all
- dependency-name: postcss
  dependency-version: 8.5.23
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-all
- dependency-name: recharts
  dependency-version: 3.10.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-all
- dependency-name: tailwindcss
  dependency-version: 4.3.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-all
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-all
- dependency-name: vitest
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/evalboard/npm-all-19b0ad673a branch from 7bc5168 to e428115 Compare July 27, 2026 20:23
@uipreliga

uipreliga commented Jul 27, 2026

Copy link
Copy Markdown
Collaborator

Code review: 🚫 Do not merge — this PR breaks the build, the test suite, and the styling

Reviewed with three models (Claude Opus, Gemini 3 Pro, GPT-5.3-Codex) plus local reproduction against this exact lockfile (pnpm install --frozen-lockfile, pnpm 10.9.0). All findings below marked ✅ were reproduced, not inferred.

This is a grouped Dependabot bump crossing eight major versions at once (next 15→16, recharts 2→3, tailwindcss 3→4, typescript 5→7, vitest 3→4, jsdom 25→30, jest-dom 6→7, plugin-react 4→6) with zero accompanying migration. evalboard/package.json and evalboard/pnpm-lock.yaml are the only files changed — but at least four of these majors require code/config changes.

🔴 Critical 1 — pnpm build fails: Tailwind v4 PostCSS plugin moved ✅ verified

Error: It looks like you're trying to use `tailwindcss` directly as a PostCSS plugin.
The PostCSS plugin has moved to a separate package, so to continue using Tailwind CSS
with PostCSS you'll need to install `@tailwindcss/postcss` and update your PostCSS configuration.

tailwindcss is bumped to ^4.3.3, but evalboard/postcss.config.mjs:3 still registers tailwindcss: {}, and @tailwindcss/postcss is not in the lockfile at all.

🔴 Critical 2 — pnpm test fails at startup: 0 of 28 test files execute ✅ verified

Error [ERR_PACKAGE_PATH_NOT_EXPORTED]: Package subpath './module-runner' is not defined
by "exports" in .../vite/package.json imported from .../vitest/dist/chunks/nativeModuleRunner...js

The lockfile still resolves vite@5.4.21 (carried over from the vitest 3 era — evalboard/pnpm-lock.yaml:4220), but:

Package Declared vite range Lockfile resolves
vitest@4.1.10 ^6.0.0 || ^7.0.0 || ^8.0.0 (both dependencies and peerDependencies) 5.4.21 ❌
@vitejs/plugin-react@6.0.4 ^8.0.0 (peer) 5.4.21 ❌

Dependabot bumped the direct devDeps but never upgraded the transitive vite, committing a lockfile that violates two declared ranges. The entire test suite is dead — this isn't "some tests fail", nothing runs at all.

🔴 Critical 3 — TypeScript 7 is incompatible with next build ✅ verified

Found only after locally patching Critical 1 — it's masked behind the CSS error:

✓ Compiled successfully in 3.1s
  Running TypeScript ...
TypeScript 7.0.2 does not provide the compiler API required by Next.js.
Enable experimental.useTypeScriptCli in your Next.js config, or install TypeScript 6 instead.
Next.js build worker exited with code: 1

Note the trap: tsc --noEmit passes cleanly under TS 7.0.2 ✅. So the typecheck script is green while build is red. Next 16.2.12 requires either experimental.useTypeScriptCli in next.config.mjs or TypeScript ≤ 6 — neither is in this PR.

🟠 High 4 — Silent styling regression: the dashboard ships essentially unstyled ✅ verified

This is the one I'd most want caught, because it does not fail the build. With Critical 1 patched locally, CSS "compiles successfully" — but Tailwind v4 does not auto-load a v3 tailwind.config.ts (it needs an explicit @config, or the theme migrated to CSS @theme), and app/globals.css:1-3 still uses the removed v3 @tailwind base/components/utilities directives. Inspecting the emitted stylesheet:

Class (used in source) Occurrences in emitted CSS
text-gray-900 0
studio-blue (custom theme colour) 0
uipath-orange (custom theme colour) 0

Total emitted CSS: 12.7 KB, and the only prose hits are the hand-written .analysis-prose rules from globals.css — the @tailwindcss/typography plugin never loads. The utility layer is simply not generated. A green build would ship a visually broken dashboard.

This is where I'd push back on the "minimal fix = just swap the PostCSS plugin" reading: that makes the build exit 0 while leaving the app unstyled. The Tailwind v4 migration (@import "tailwindcss", theme moved to @theme, @plugin for typography) is required, not optional.

🟠 High 5 — No CI job covers evalboard/ at all

Every job in .github/workflows/pr-checks.yml is Python (quality-gate, no-uipath-extra, windows-smoke, live-tests, codex-live-tests, byoa-live-tests, action-dogfood). Nothing runs pnpm install/typecheck/test/build for the dashboard. That's precisely why three build-breaking regressions can sit in a green PR. The comment at pr-checks.yml:~102 also excludes evalboard/pnpm-lock.yaml from the OSV scan, so the npm tree gets no vulnerability scanning either.

A minimal job would have caught all of this:

  evalboard-checks:
    name: Evalboard checks
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@...   # SHA-pin to match this file's convention
      - uses: actions/setup-node@... # node 20
      - run: corepack enable
      - working-directory: evalboard
        run: pnpm install --frozen-lockfile && pnpm verify

(pnpm verify already exists in package.json and chains tsc --noEmit && vitest run && next build.)

🟠 High 6 — Root cause: Dependabot groups majors into one unbisectable PR

.github/dependabot.yml — the npm block groups patterns: ["*"] with no update-types filter, unlike the pip block right above it which deliberately ignores minor+patch. So eight majors land together and a bisect can't attribute anything. Suggested fix, mirroring the existing style:

    groups:
      npm-all:
        patterns: ["*"]
        update-types: ["minor", "patch"]

Majors then arrive as individual PRs, which is what a tailwind-3→4 or typescript-5→7 migration actually needs.

🟡 Medium / 🟢 Low (informational)

  • recharts 2→3 — usage is narrow and low-risk: only app/_overview/daily-chart.tsx and turn-budget-chart.tsx, using LineChart/Line/XAxis/YAxis/CartesianGrid/Tooltip/ResponsiveContainer. No Legend (so the v3 align/verticalAlign → position/offset change doesn't bite), no removed-defaultProps reliance, and the custom tooltip's prop types are hand-written so v3 typing changes don't surface. Typecheck passes. But runtime render behaviour is unverified because the test suite can't start.
  • next 15→16 async params — ✅ not an issue. app/page.tsx:109, app/path-to-ga/page.tsx:38, app/trends/page.tsx:41 already await searchParams.
  • jest-dom 6→7 — ✅ low risk. Only core matchers are used across the 28 test files (toBeInTheDocument ×61, toHaveAttribute ×12, toHaveTextContent ×11, toHaveValue ×9), all retained in v7.
  • autoprefixer — redundant under Tailwind v4 (Lightning CSS handles prefixing). Dead weight once migrated.
  • @types/node 26 — the repo has no .nvmrc, no engines field, and no node pin for evalboard; docker/Dockerfile installs node 22 and CI pins node 20. Typing against Node 26 APIs the runtime may not have is a latent trap worth pinning down.
  • @azure/storage-blob — ceiling widened <12.33.0 → <12.34.0. The bounded range has no comment explaining why it's bounded, so a reviewer can't tell whether widening re-admits whatever it was guarding against. Worth a one-line comment.

Recommendation

Close this PR and let Dependabot regenerate split PRs, after applying the update-types filter above. Fixing in place means doing a Tailwind v4 migration, a TypeScript 7/Next compatibility decision, and a vite realignment inside a commit labelled chore(deps) — and with no CI covering evalboard, none of it would be verified.

Suggested sequencing:

  1. First, land the evalboard-checks CI job and the dependabot.yml update-types filter (small, independently valuable, and makes everything after it verifiable).
  2. Then the safe minor/patch group (@azure/storage-blob, and anything else non-major).
  3. Then one PR per risky major, each with its migration: tailwind 3→4 (postcss plugin + @import "tailwindcss" + @theme + @plugin typography + drop autoprefixer); vitest 3→4 + plugin-react 4→6 (add explicit vite devDep so the peer range is satisfiable — plugin-react 6 wants ^8); typescript 5→7 (hold until Next's TS7 support is non-experimental, or opt into experimental.useTypeScriptCli); next 15→16; recharts 2→3 (land after tests run again, so the chart render tests actually gate it).

Reproduction (node v26.0.0, pnpm 10.9.0):

cd evalboard && pnpm install --frozen-lockfile
pnpm exec tsc --noEmit   # exit 0  ← green, and misleading
pnpm test                # exit 1  ← ERR_PACKAGE_PATH_NOT_EXPORTED, 0/28 files run
pnpm build               # exit 1  ← tailwindcss PostCSS plugin moved

🤖 Generated with Claude Code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@akshaylive akshaylive Awaiting requested review from akshaylive akshaylive is a code owner
@tmatup tmatup Awaiting requested review from tmatup tmatup is a code owner
@uipreliga uipreliga Awaiting requested review from uipreliga uipreliga is a code owner
@bai-uipath bai-uipath Awaiting requested review from bai-uipath bai-uipath is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@uipreliga