chore(deps-dev): bump the website-dependencies group in /website with 2 updates - #28
Open
dependabot[bot] wants to merge 1 commit into
Open
Conversation
Bumps the website-dependencies group in /website with 2 updates: [@lucide/svelte](https://github.com/lucide-icons/lucide/tree/HEAD/packages/svelte) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `@lucide/svelte` from 1.27.0 to 1.28.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.28.0/packages/svelte) Updates `vite` from 8.1.5 to 8.2.0 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/create-vite@8.2.0/packages/vite) --- updated-dependencies: - dependency-name: "@lucide/svelte" dependency-version: 1.28.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: website-dependencies - dependency-name: vite dependency-version: 8.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: website-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Deploying mfuse with
|
| Latest commit: |
68a9d7f
|
| Status: | 🚫 Build failed. |
![winnowl[bot]](https://avatars.githubusercontent.com/in/4312382?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
✅ No blocking issues found — approving.
🛠️ To have the bot fix these findings, comment @winnowl fix.
⛔ Files ignored due to path filters (1)
website/bun.lockis excluded by!**/*.lock
📋 Additional findings from this change (not shown inline) (3)
- 🟠 High The configured shadcn/Tailwind component pipeline produces unstyled generated components because the application's only CSS entry never loads Tailwind (and also never loads
tw-animate-css). For example, after generating a Button or Dialog, classes such asinline-flex,bg-primary, responsive variants, and animation utilities remain in the Svelte markup but no corresponding rules are emitted in the production CSS. - 🟡 Medium The newly coordinated Figtree font package is never imported or selected, so it contributes no font asset to the website and cannot provide the expected production font. The page instead continues to request Cabinet Grotesk from
https://api.fontshare.com; under a CSP/offline deployment that disallows that host, all text falls back to system fonts even though a local font package is installed. - 🟡 Medium The dependency update is not guarded by the required regeneration-diff check or locale runtime smoke tests: the only validation-like script regenerates files and immediately builds them, without failing when checked-in generated output changes, and there is no test script covering initial locale selection or switching.
🗑️ Suppressed and duplicate diagnostics (2)
- The major build-toolchain update has no repository-visible validation for the required clean install, localization generation, production build, or preview smoke path, so a broken generated-code/build/serve chain can merge without being detected.
- The website does not pin Bun as its package manager or pin a Bun version, so a clean checkout can use a different installer and silently bypass the only committed lockfile. For example, a deployment that infers the installer from package.json will find no
packageManager/engines.bunfield, may runnpm install, ignorebun.lock, and resolve every caret range afresh; it also has no package-lock.json to make that graph reproducible. Even when Bun is chosen manually, different Bun releases are not constrained despite the committed lockfile declaring a particular Bun lock format (lockfileVersion: 1,configVersion: 0). This would be disproven if repository/deployment configuration outside the searched source always installs a pinned Bun release and invokesbun install --frozen-lockfile, but searches found no install workflow or package-manager declaration, while the build script itself explicitly assumes Bun.
🤖 Prompt for AI agents — all findings (3)
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
## Additional findings on this change (not posted inline) (3)
In website/package.json around line 16, address this finding:
The configured shadcn/Tailwind component pipeline produces unstyled generated components because the application's only CSS entry never loads Tailwind (and also never loads `tw-animate-css`). For example, after generating a Button or Dialog, classes such as `inline-flex`, `bg-primary`, responsive variants, and animation utilities remain in the Svelte markup but no corresponding rules are emitted in the production CSS.
In website/package.json around line 13, address this finding:
The newly coordinated Figtree font package is never imported or selected, so it contributes no font asset to the website and cannot provide the expected production font. The page instead continues to request Cabinet Grotesk from `https://api.fontshare.com`; under a CSP/offline deployment that disallows that host, all text falls back to system fonts even though a local font package is installed.
In website/package.json around line 9, address this finding:
The dependency update is not guarded by the required regeneration-diff check or locale runtime smoke tests: the only validation-like script regenerates files and immediately builds them, without failing when checked-in generated output changes, and there is no test script covering initial locale selection or switching.
📜 Review details
Model
- gpt-5.6-sol
Coverage
- scopes: 4/4 complete
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the website-dependencies group in /website with 2 updates: @lucide/svelte and vite.
Updates
@lucide/sveltefrom 1.27.0 to 1.28.0Release notes
Sourced from @lucide/svelte's releases.
Commits
Updates
vitefrom 8.1.5 to 8.2.0Release notes
Sourced from vite's releases.
Changelog
Sourced from vite's changelog.
... (truncated)
Commits
24a611frelease: v7.2.42d66b7bfix: revert "perf(deps): replace debug with obug (#21107)"a668014release: v7.2.3acfe939perf(deps): replace debug with obug (#21107)4f8171efix(deps): update all non-major dependencies (#21128)5029720chore(deps): update rolldown-related dependencies (#21127)5909efdfix: allow multiplebindCLIShortcutscalls with shortcut merging (#21103)39a0a15chore(deps): update rolldown-related dependencies (#21095)6a34ac3fix(deps): update all non-major dependencies (#21096)02ceaecchore(deps): update dependency@rollup/plugin-commonjsto v29 (#21099)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsSummary
Changes
dev, localization-codegen,build, andpreviewcommand chain, including the Svelte plugin/Vite/TypeScript compatibility set.typesafe-i18nand GSAP manifest ranges and their placement as production dependencies, with emphasis on the generated localization modules imported by the Svelte application.