build(deps): adopt frontend & backend minor-and-patch groups (excl. anthropic-sdk) - #1100
Conversation
Adopts #1077 without @anthropic-ai/sdk: pi-ai 0.80.3 hard-pins @anthropic-ai/sdk@0.91.1 and types its client option against it, so bumping our copy to 0.110 breaks the client we hand to pi-ai. Hold the SDK until pi-ai's pin moves. pi-ai 0.80.3 also added a required `context` arg to buildBaseOptions; thread it through toFullAnthropicOptions.
Adopts #1045: @electric-sql/pglite 0.4.6->0.5.4, @electric-sql/pglite-socket 0.1.6->0.2.7, @opentelemetry/exporter-trace-otlp-proto 0.218.0->0.220.0, @react-email/ui 6.1.5->6.6.8. No code changes required.
Semgrep Security ScanNo security issues found. |
GitHub Actions
Inactive
raivieiraadriano92
added
the
dependencies
|
Preview environment destroyed 🧹 Stack |
PR Metrics
Updated Wed, 22 Jul 2026 10:19:42 GMT · run #2360 |
…u-667-dependabot-breaking-minors # Conflicts: # bun.lock # package.json
GitHub Actions
Inactive
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🔭 thunder-deep-review (advisory)
Complements the other bots — surfaces only what they did not flag. Never approves, never requests changes, never gates merge.
head: 5942c2782bf9 · mode: single · deferred 0 item(s) already reported by other bots (best-effort dedup)
Bumping @powersync/common to 1.57.x left @powersync/web@1.38.1 pinning a nested 1.53.1, so two copies coexisted across the custom-SharedWorker boundary. web 1.39.0 pins common 1.57.2 and tanstack 0.2.15 matches, so common now resolves to a single 1.57.2. The powersync-web-internal alias still resolves and ThunderboltSharedSyncImplementation compiles.
GitHub Actions
Inactive
There was a problem hiding this comment.
🔭 thunder-deep-review (advisory)
Complements the other bots — surfaces only what they did not flag. Never approves, never requests changes, never gates merge.
head: 998dba21bd4e · mode: single · deferred 0 item(s) already reported by other bots (best-effort dedup)
Root katex is used only for the stylesheet import; the renderer is rehype-katex's pinned katex 0.16.47. Bumping root to 0.17 split the CSS from the engine for no benefit, so keep ^0.16 — both resolve to a single 0.16.47.
GitHub Actions
Inactive
There was a problem hiding this comment.
🔭 thunder-deep-review (advisory)
Complements the other bots — surfaces only what they did not flag. Never approves, never requests changes, never gates merge.
head: 38672af96c15 · mode: single · deferred 0 item(s) already reported by other bots (best-effort dedup)
1 participant
Adopts the two Dependabot minor-and-patch groups that Dependabot couldn't land on their own (both had failing CI / breaking pre-1.0 bumps). Each item is its own commit. Verified beyond CI: typecheck (fe+be), backend 873/873 tests, and a per-package adversarial changelog-vs-usage audit — all clear.
#1077 — frontend (adopted without
@anthropic-ai/sdk)contextarg tobuildBaseOptions; threaded throughtoFullAnthropicOptions.@anthropic-ai/sdk0.91.1 held back: pi-ai hard-pins@anthropic-ai/sdk@0.91.1and types itsclientoption against it, so bumping our copy to 0.110 breaks the client we hand to pi-ai. Adopt once pi-ai's pin moves.#1045 — backend (adopted fully, no code changes)
Notes
.pglite/datais a gitignored dev artifact, so no impact — but delete a stale local.pglite/databeforedb:devon 0.5.x.@powersync/webwas not touched, so the internal-path SharedWorker alias is unaffected.Supersedes #1077 and #1045 (close them once this merges).
@anthropic-ai/sdkremains for a follow-up when pi-ai updates its pin.