build(deps): bump @lifeomic/alpha from 5.2.0 to 7.1.0#75
build(deps): bump @lifeomic/alpha from 5.2.0 to 7.1.0#75dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [@lifeomic/alpha](https://github.com/lifeomic/alpha) from 5.2.0 to 7.1.0. - [Release notes](https://github.com/lifeomic/alpha/releases) - [Changelog](https://github.com/lifeomic/alpha/blob/master/CHANGELOG.md) - [Commits](lifeomic/alpha@v5.2.0...v7.1.0) --- updated-dependencies: - dependency-name: "@lifeomic/alpha" dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![lifeomic-review-bot[bot]](https://avatars.githubusercontent.com/u/29172293?s=60&v=4){kind=small}
| "dependencies": { | ||
| "@aws-sdk/client-sts": "^3.370.0", | ||
| "@lifeomic/alpha": "^5.1.3", | ||
| "@lifeomic/alpha": "^7.1.0", |
There was a problem hiding this comment.
Blocking: Major bump 5.2.0 → 7.1.0 transitively upgrades axios to 1.x, which sends accept-encoding instead of accept as a default header. Running yarn test fails 8 cases in test/request-headers.test.ts and test/proxy.test.ts that assert exact header key lists. Update those tests (or defer the bump) before merge.
This review was generated by review-bot.
There was a problem hiding this comment.
Upstream: lifeomic/alpha — compare v5.2.0...v7.1.0 (see PR body commits).
Scope
Dependabot bumps the sole production dependency @lifeomic/alpha from ^5.2.0 to ^7.1.0 in package.json with a matching yarn.lock refresh. No application source files are in changedFiles; the CLI continues to use Alpha, AlphaOptions, AlphaResponse, and client.request() unchanged.
CI
CI is still pending in context; locally, yarn test (lint + tsc + jest) exits non-zero with 8 failing tests in test/request-headers.test.ts and test/proxy.test.ts.
Regression risk
[blocking] This is a two-major semver jump (5 → 7). @lifeomic/alpha@7.1.0 pulls axios ^1.6.0, which changes default outbound headers: tests now observe accept-encoding where they expected accept. Custom headers and core request/proxy/lambda flows still pass (29/37 tests green), but header assertions are brittle and CI will fail until tests are updated.
Approval is withheld until the test suite is aligned with alpha 7 / axios 1.x default headers (replace accept with accept-encoding in expected key lists, or assert behavior without pinning exact default header names).
Residual risks / follow-ups
- After test fixes, confirm lambda-handler and signed-request paths under CI (Node 18 per workflow).
- Alpha 7 adds X-Ray subsegments on
lambda://invokes — no CLI code changes required, but worth a quick smoke test if you rely on local lambda emulation.
Note: Review generated using Cursor model
composer-2.5.
This review was generated by review-bot.
Bumps @lifeomic/alpha from 5.2.0 to 7.1.0.
Commits
b28fe22Merge pull request #203 from lifeomic/feat/xray-lambda-tracingff24829fix(xray): pin@aws-sdk/typesfor Node 14+ CI compatibilitye5e7187feat: emit X-Ray subsegment on every lambda:// invoke1eb48ddMerge pull request #199 from lifeomic/dependabot/npm_and_yarn/follow-redirect...d054864build(deps): bump follow-redirects from 1.15.11 to 1.16.00807285Merge pull request #198 from lifeomic/dependabot/npm_and_yarn/axios-1.15.0ff9fc45build(deps): bump axios from 1.13.5 to 1.15.04689531Merge pull request #197 from lifeomic/dependabot/npm_and_yarn/lodash-4.18.17b7e7d9build(deps): bump lodash from 4.17.23 to 4.18.14c6cd1dMerge pull request #194 from lifeomic/chore/fix-axios-upgrade-testsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)