chore(deps): consolidate Dependabot updates - #2964
Conversation
GitHub Actions
Inactive
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📜 Recent review details⏰ Context from checks skipped due to timeout. (14)
🧰 Additional context used📓 Path-based instructions (4)**/*.{ts,tsx,js,jsx,mjs,cjs}📄 CodeRabbit inference engine (AGENTS.md)
Files:
**/*.{ts,tsx,js,jsx,mjs,cjs,json,md,yml,yaml}📄 CodeRabbit inference engine (AGENTS.md)
Files:
**/*.test.{ts,tsx,mjs}⚙️ CodeRabbit configuration file
Files:
scripts/**⚙️ CodeRabbit configuration file
Files:
🧠 Learnings (1)📚 Learning: 2026-07-27T18:21:19.134ZApplied to files:
🔇 Additional comments (5)
📝 WalkthroughWalkthroughThe pull request updates Playwright, Fallow, PostCSS, Next.js, eslint-config-next, jest-axe, and smol-toml versions. It also makes TypeScript project references explicit and strengthens package-graph validation. ChangesRepository maintenance
Estimated code review effort: 3 (Moderate) | ~25 minutes Assessment against linked issues
Out-of-scope changes
Possibly related issues
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 3 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (3 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
![keiko-for-quality[bot]](https://avatars.githubusercontent.com/in/4290143?s=60&v=4){kind=small}
|
Keiko for Quality — run summary ✅ complete · head
Budget: 1883180 tokens allotted |
GitHub Actions
Inactive
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8a20d40ea9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1e4e817a61
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
GitHub Actions
Inactive
GitHub Actions
Inactive
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docker/gates/run-gates.sh`:
- Around line 104-106: Update the chromium_revision value in the cache path
configuration to 1233 so chromium_cache and headless_shell_cache match
Playwright’s stored browser revision.
In `@scripts/check-package-graph.mjs`:
- Around line 218-219: Update the workspaceRefs path-resolution logic around
reference and package-name derivation to resolve each project reference relative
to its owning configuration, then validate both the resolved configuration and
package directory against known workspace packages before deriving an identity.
Reject missing, malformed, empty, escaped, and boundary paths so
packageGraphFailures cannot accept an outside reference; add failure-first tests
covering each case.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 929e8bed-67e2-4ad7-b2db-6d33dcb72f5a
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (39)
.github/workflows/ci.yml.github/workflows/keiko-for-quality.ymldocker/gates/run-gates.shdocs/adr/ADR-0167-zero-cost-autonomous-quality-gates.mddocs/next16-eslint10-ui-migration.mddocs/qa/review-cost-model.mddocs/troubleshooting/README.mddocs/troubleshooting/model-review-spend.mdpackage.jsonpackages/keiko-cli/tsconfig.jsonpackages/keiko-connectors/tsconfig.jsonpackages/keiko-editor/tsconfig.jsonpackages/keiko-evaluations/tsconfig.jsonpackages/keiko-evidence/tsconfig.jsonpackages/keiko-harness/tsconfig.jsonpackages/keiko-local-knowledge/tsconfig.jsonpackages/keiko-memory-capture/tsconfig.jsonpackages/keiko-memory-consolidation/tsconfig.jsonpackages/keiko-memory-governance/tsconfig.jsonpackages/keiko-memory-retrieval/tsconfig.jsonpackages/keiko-memory-vault/tsconfig.jsonpackages/keiko-model-gateway/tsconfig.jsonpackages/keiko-quality-intelligence/tsconfig.jsonpackages/keiko-sandbox/tsconfig.jsonpackages/keiko-sdk/tsconfig.jsonpackages/keiko-security/tsconfig.jsonpackages/keiko-server/package.jsonpackages/keiko-server/tsconfig.jsonpackages/keiko-tools/tsconfig.jsonpackages/keiko-ui/package.jsonpackages/keiko-verification/tsconfig.jsonpackages/keiko-workflows/tsconfig.jsonpackages/keiko-workspace/tsconfig.jsonscripts/__tests__/check-external-quality-config.test.mjsscripts/__tests__/check-package-graph.test.mjsscripts/check-external-quality-config.mjsscripts/check-package-graph.mjsscripts/regenerate-d12-evidence.mjstsconfig.packages.json
📜 Review details
⏰ Context from checks skipped due to timeout. (14)
- GitHub Check: Cross-platform smoke (macos-latest)
- GitHub Check: Cross-platform smoke (ubuntu-latest)
- GitHub Check: Cross-platform smoke (windows-latest)
- GitHub Check: Socket Security: Pull Request Alerts
- GitHub Check: ui
- GitHub Check: Coverage shard (packages 2/3)
- GitHub Check: Coverage suite (scripts)
- GitHub Check: Core quality
- GitHub Check: Coverage shard (packages 1/3)
- GitHub Check: Coverage shard (packages 3/3)
- GitHub Check: Build, scan, SBOM, smoke
- GitHub Check: Coverage suite (keiko-ui)
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: Analyze (javascript-typescript)
🧰 Additional context used
📓 Path-based instructions (9)
**/*.{ts,tsx,js,jsx,mjs,cjs,json,md,yml,yaml}
📄 CodeRabbit inference engine (AGENTS.md)
Use English only in code, comments, identifiers, documentation, commit messages, issues, and pull requests.
Files:
packages/keiko-sandbox/tsconfig.jsonpackages/keiko-server/package.jsonpackages/keiko-sdk/tsconfig.jsonpackages/keiko-quality-intelligence/tsconfig.jsonpackages/keiko-tools/tsconfig.jsonscripts/check-external-quality-config.mjstsconfig.packages.jsonpackages/keiko-server/tsconfig.jsondocs/adr/ADR-0167-zero-cost-autonomous-quality-gates.mdpackages/keiko-workflows/tsconfig.jsonpackage.jsonscripts/regenerate-d12-evidence.mjspackages/keiko-ui/package.jsonpackages/keiko-editor/tsconfig.jsondocs/troubleshooting/README.mdpackages/keiko-local-knowledge/tsconfig.jsonpackages/keiko-harness/tsconfig.jsondocs/troubleshooting/model-review-spend.mdpackages/keiko-evidence/tsconfig.jsonpackages/keiko-model-gateway/tsconfig.jsonpackages/keiko-memory-retrieval/tsconfig.jsonpackages/keiko-verification/tsconfig.jsonpackages/keiko-security/tsconfig.jsonpackages/keiko-cli/tsconfig.jsonscripts/check-package-graph.mjspackages/keiko-memory-capture/tsconfig.jsonpackages/keiko-memory-vault/tsconfig.jsonscripts/__tests__/check-external-quality-config.test.mjspackages/keiko-evaluations/tsconfig.jsondocs/next16-eslint10-ui-migration.mdpackages/keiko-connectors/tsconfig.jsondocs/qa/review-cost-model.mdpackages/keiko-workspace/tsconfig.jsonpackages/keiko-memory-consolidation/tsconfig.jsonpackages/keiko-memory-governance/tsconfig.jsonscripts/__tests__/check-package-graph.test.mjs
.github/workflows/ci.yml
📄 CodeRabbit inference engine (AGENTS.md)
When adding a long-lived integration branch, add it to the
pushtrigger list,pull_requesttrigger list, and protected-branch-gate case allowlist.
Files:
.github/workflows/ci.yml
.github/workflows/**/*.{yml,yaml}
📄 CodeRabbit inference engine (AGENTS.md)
Pin every GitHub Action to a full 40-hex commit SHA and retain a version comment; tag or branch refs are prohibited.
Files:
.github/workflows/ci.yml.github/workflows/keiko-for-quality.yml
.github/workflows/**
⚙️ CodeRabbit configuration file
.github/workflows/**: Treat workflow changes as supply-chain and merge-authority changes. Require full 40-hex
action pins with version comments, minimum permissions, bounded timeouts, locked installs,
redacted output, and exact-current-head evidence. Never recommend bypassing a gate.
Files:
.github/workflows/ci.yml.github/workflows/keiko-for-quality.yml
**/*.{ts,tsx,js,jsx,mjs,cjs}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ts,tsx,js,jsx,mjs,cjs}: Do not useconsole.*for product output; route real output through the intended logger or diagnostic sink.
Delete dead code and commented-out scaffolding; do not leave TODOs that conceal unfinished branches.
Never weaken trust boundaries, evidence redaction, or governance gates; fail closed on invalid authority, workspace escape, denied sensitive paths, secret exfiltration, unsupported actions, exhausted budgets, and platform restrictions.
Keep secrets out of code, logs, evidence, configuration, and tests; diagnostics and evidence must contain only redacted summaries, counts, hashes, statuses, or scopes.
Inspect and reuse existing helpers, contracts, and subsystems; do not introduce parallel workspace, graph, policy, evidence, memory, connector, workflow, or UI subsystems without a documented capability gap.
Do not silently swallow errors; avoid empty catches, provide diagnostic context, and include a correlation ID for server errors connecting opaque UI 500s to redacted operator diagnostics.
Validate workspace input, model output, and connector data before processing; generated or model-produced code must remain behind the sandbox egress boundary.
Files:
scripts/check-external-quality-config.mjsscripts/regenerate-d12-evidence.mjsscripts/check-package-graph.mjsscripts/__tests__/check-external-quality-config.test.mjsscripts/__tests__/check-package-graph.test.mjs
scripts/**
⚙️ CodeRabbit configuration file
scripts/**: Gate and evidence tooling must fail closed, remain deterministic and redacted, and carry
negative tests proving that weakened configuration or stale evidence is rejected.
Files:
scripts/check-external-quality-config.mjsscripts/regenerate-d12-evidence.mjsscripts/check-package-graph.mjsscripts/__tests__/check-external-quality-config.test.mjsscripts/__tests__/check-package-graph.test.mjs
docs/adr/**/*.md
📄 CodeRabbit inference engine (AGENTS.md)
Update affected ADR sections when corrected implementation behavior makes them outdated, contradictory, or unsafe; do not create a superseding ADR merely to repair text, and register genuinely new ADRs in the index without renumbering existing ones.
Files:
docs/adr/ADR-0167-zero-cost-autonomous-quality-gates.md
docs/troubleshooting/**/*.md
📄 CodeRabbit inference engine (AGENTS.md)
Document operator failure modes using Symptom, Root Cause, Diagnostic Steps, and Resolution; keep the content redacted with no live endpoints or logs.
Files:
docs/troubleshooting/README.mddocs/troubleshooting/model-review-spend.md
**/*.test.{ts,tsx,mjs}
⚙️ CodeRabbit configuration file
**/*.test.{ts,tsx,mjs}: A behavioral fix needs a failure-first regression proof that fails without the fix. Cover
malformed, hostile, empty, and boundary inputs; never relax a regression pin or duplicate a
production formula inside a fixture.
Files:
scripts/__tests__/check-external-quality-config.test.mjsscripts/__tests__/check-package-graph.test.mjs
🧠 Learnings (1)
📚 Learning: 2026-07-27T18:21:19.134Z
Learnt from: oscharko
Repo: oscharko-dev/Keiko PR: 2779
File: scripts/check-local-state.mjs:0-0
Timestamp: 2026-07-27T18:21:19.134Z
Learning: In CLI guard logic inside `scripts/check-*.mjs`, avoid manually building `file://` URLs like `file://${process.argv[1]}` (it can produce incorrect path encoding). Convert the CLI path to a proper file URL using Node’s URL utilities (e.g., `pathToFileURL(process.argv[1]).href`) so paths with spaces/special characters (and platform differences like Windows) are handled correctly. If this fix is unrelated to the current PR, handle it via a separate follow-up change.
Applied to files:
scripts/check-external-quality-config.mjsscripts/check-package-graph.mjs
🪛 LanguageTool
docs/troubleshooting/model-review-spend.md
[uncategorized] ~4-~4: The official name of this software platform is spelled with a capital “H”.
Context: ...des for the Keiko for Quality reviewer (keiko-for-quality.yml). The ...
(GITHUB)
[uncategorized] ~42-~42: The official name of this software platform is spelled with a capital “H”.
Context: ...e store identity changed — the profile (.github/keiko-for-quality.json), the model id,...
(GITHUB)
docs/qa/review-cost-model.md
[uncategorized] ~3-~3: The official name of this software platform is spelled with a capital “H”.
Context: ...t makes it expensive Operator note for keiko-for-quality.yml. Writt...
(GITHUB)
[style] ~65-~65: The word ‘bigger’ tends to be overused in this context. Consider an alternative.
Context: ...000,000 before this input applies, so a bigger number would be inert. Raising it is the cheap...
(A_GREAT_NUMBER)
[grammar] ~87-~87: Ensure spelling is correct
Context: ...ng: it removes the model call entirely, where caching only makes it cost less. **The...
(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)
[style] ~94-~94: Consider using a shorter alternative to avoid wordiness.
Context: ...ds the ceiling again. A lower ceiling makes this worse rather than better, by turning more pul...
(MADE_IT_JJR)
🔇 Additional comments (37)
docs/adr/ADR-0167-zero-cost-autonomous-quality-gates.md (1)
72-72: LGTM!package.json (1)
216-216: LGTM!Also applies to: 241-241
packages/keiko-server/package.json (1)
52-52: LGTM!packages/keiko-ui/package.json (1)
28-28: LGTM!Also applies to: 45-48
docs/next16-eslint10-ui-migration.md (1)
7-13: LGTM!Also applies to: 24-30
scripts/__tests__/check-external-quality-config.test.mjs (1)
74-74: LGTM!scripts/check-external-quality-config.mjs (1)
143-143: LGTM!.github/workflows/ci.yml (1)
1077-1077: 🗄️ Data Integrity & IntegrationNo action needed for the Playwright version pins.
package-lock.jsonresolves both@playwright/testandplaywrightto1.62.0, so the.github/workflows/ci.yml,docker/gates/run-gates.sh, andscripts/regenerate-d12-evidence.mjspins are aligned with the lockfile-installed toolchain.> Likely an incorrect or invalid review comment.tsconfig.packages.json (1)
4-27: LGTM!packages/keiko-cli/tsconfig.json (1)
17-28: LGTM!packages/keiko-connectors/tsconfig.json (1)
13-16: LGTM!packages/keiko-editor/tsconfig.json (1)
13-13: LGTM!packages/keiko-evaluations/tsconfig.json (1)
14-21: LGTM!packages/keiko-evidence/tsconfig.json (1)
14-16: LGTM!packages/keiko-harness/tsconfig.json (1)
14-18: LGTM!packages/keiko-server/tsconfig.json (1)
14-33: LGTM!packages/keiko-local-knowledge/tsconfig.json (1)
13-17: LGTM!packages/keiko-memory-capture/tsconfig.json (1)
13-16: LGTM!packages/keiko-memory-consolidation/tsconfig.json (1)
13-16: LGTM!packages/keiko-memory-governance/tsconfig.json (1)
13-16: LGTM!packages/keiko-memory-retrieval/tsconfig.json (1)
13-16: LGTM!packages/keiko-memory-vault/tsconfig.json (1)
13-16: LGTM!packages/keiko-model-gateway/tsconfig.json (1)
13-16: LGTM!packages/keiko-quality-intelligence/tsconfig.json (1)
13-16: LGTM!packages/keiko-sandbox/tsconfig.json (1)
13-13: LGTM!packages/keiko-sdk/tsconfig.json (1)
14-21: LGTM!packages/keiko-security/tsconfig.json (1)
13-13: LGTM!packages/keiko-tools/tsconfig.json (1)
14-17: LGTM!packages/keiko-verification/tsconfig.json (1)
14-17: LGTM!packages/keiko-workflows/tsconfig.json (1)
14-22: LGTM!packages/keiko-workspace/tsconfig.json (1)
13-16: LGTM!scripts/check-package-graph.mjs (1)
2-2: LGTM!scripts/__tests__/check-package-graph.test.mjs (1)
40-40: LGTM!Also applies to: 58-61
docs/qa/review-cost-model.md (1)
1-156: LGTM!docs/troubleshooting/README.md (1)
756-763: LGTM!docs/troubleshooting/model-review-spend.md (1)
1-198: LGTM!.github/workflows/keiko-for-quality.yml (1)
426-467: 🗄️ Data Integrity & IntegrationNo change needed.
The pinned
oscharko-dev/Keiko-for-Qualityrevision exposestoken_budget, defaults it to2e6, and usesALLOTMENT_CEILING = 6e6with--max-tokens-budget, matching the documented 6,000,000-token behavior.
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
| chromium_revision="$(playwright_browser_revision chromium)" | ||
| headless_shell_revision="$(playwright_browser_revision chromium-headless-shell)" | ||
| chromium_cache="${browsers}/chromium-${chromium_revision}" | ||
| headless_shell_cache="${browsers}/chromium_headless_shell-${headless_shell_revision}" | ||
| if [[ ! -d "$chromium_cache" || ! -d "$headless_shell_cache" ]]; then |
There was a problem hiding this comment.
🐛 Correctness | 🟠 Major
Handle missing browser revisions without aborting the whole gate script.
These command substitutions run before the if and inherit set -e, so if browsers.json does not contain chromium-headless-shell for a given Playwright release, playwright_browser_revision exits 1 and the entire gate fails before it can fall back to npx playwright install. That turns a cache probe into a hard failure on ordinary upgrades or package layout changes; instead, treat an unknown revision as a cache miss and run the install step.
🤖 Prompt for AI agents
Verify this finding against the current code before acting on it.
In docker/gates/run-gates.sh around line 123: Handle missing browser revisions without aborting the whole gate script.
If it no longer applies, reply on the thread with a one-line reason and resolve it — do not
change code to match a stale finding. If it does apply, keep the fix minimal, fix the cause
rather than the symptom, and run this repository's own verification before pushing.
| for (const entry of tsconfig.references ?? []) { | ||
| const reference = workspaceReference(owner, entry, knownWorkspaceConfigs); | ||
| if ("failure" in reference) { | ||
| failures.push(reference.failure); | ||
| continue; | ||
| } | ||
| refs.push(reference.name); | ||
| } | ||
|
|
||
| refs.sort((left, right) => left.localeCompare(right)); |
There was a problem hiding this comment.
🐛 Correctness | 🟡 Minor
Reject duplicate project references explicitly.
This loop now accepts the same workspace package more than once and only reports it later as a generic dependency mismatch. That turns a malformed tsconfig.references array into an imprecise error message, which makes the failing package look like its dependencies are wrong when the real defect is a duplicated reference entry. Track seen package names here and emit a dedicated validation failure when a reference repeats.
- refs.push(reference.name);
+ if (refs.includes(reference.name)) {
+ failures.push(`${owner.name}: tsconfig reference ${JSON.stringify(reference.referencePath)} is duplicated`);
+ continue;
+ }
+ refs.push(reference.name);🤖 Prompt for AI agents
Verify this finding against the current code before acting on it.
In scripts/check-package-graph.mjs around line 262: Reject duplicate project references explicitly.
If it no longer applies, reply on the thread with a one-line reason and resolve it — do not
change code to match a stale finding. If it does apply, keep the fix minimal, fix the cause
rather than the symptom, and run this repository's own verification before pushing.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 63cbf28400
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const configPath = | ||
| basename(resolvedReference) === "tsconfig.json" | ||
| ? resolvedReference | ||
| : join(resolvedReference, "tsconfig.json"); |
There was a problem hiding this comment.
Remove this fallback that appends tsconfig.json to directory references: check:package-graph currently returns clean for ../keiko-contracts and ./packages/keiko-contracts, even though those are the exact forms this commit replaces because Next 16.2.12 requires explicit tsconfig.json targets for the E2E development server. A future partial revert can therefore reintroduce the startup failure while the intended regression gate remains green; require the resolved reference itself to end in tsconfig.json and pin that rejection in the fixture.
AGENTS.md reference: AGENTS.md:L326-L331
Useful? React with 👍 / 👎.
|
1 participant
Summary
Consolidates the verified Dependabot updates for Playwright, Jest-Axe, Next.js, eslint-config-next, Fallow, PostCSS, and smol-toml into one reviewed update.
The integration updates the Fallow governance pin and ADR-0167 to 3.9.1, corrects the root PostCSS override to 8.5.23 for reproducible
npm ciinstalls, and aligns every Playwright browser installer with the lockfile's 1.62.0 runner.Dependabot #2935 (ESLint 10) is intentionally not merged: the current
eslint-plugin-import,eslint-plugin-jsx-a11y, andeslint-plugin-reactpeer ranges end at ESLint 9. ESLint remains at 9.39.5 in the root and UI workspaces;npm ls eslintis peer-valid. The migration record now reflects the verified Next 16.2.12 and PostCSS 8.5.23 baseline.Next.js 16.2.12 requires explicit
tsconfig.jsontargets for the recursive project-reference graph used by the E2E development server. The graph, its package-graph gate, and its regression fixture now use that supported form.Closes #2936, closes #2937, closes #2938, closes #2939, closes #2940, closes #2941, closes #2942.
Verification
npm ci --ignore-scriptsnpm ls eslint --all --workspace @oscharko-dev/keiko-uinpm ls postcss --all --workspace @oscharko-dev/keiko-uinpm run provision:usearchnpm run typechecknpm run lintnpm run format:checknpm testnpm run test:coverage:uinpm run test:e2e:smoke— 68 Chromium tests passednpm run check:package-graphnpm run arch:checknpm run arch:check:negativenpm run check:editor-bundle-sizenpm run gates:sonarcheck:editor-release-evidenceis Linux-authoritative and has the documented macOS fingerprint mismatch; the required Linux UI check is the authoritative verification.Scope
Reuses the existing dependency, lockfile, external-quality configuration, TypeScript project-reference, and CI browser-install paths. No product subsystem or authority boundary is introduced or widened.