chore(deps): group react updates and pin jscpd - #162
Merged
Conversation
Two dependabot rules that failed loudly this week. react: #156 bumped `react` to ^19.2.8 and left `react-dom` at ^19.1.0. That range already admits 19.2.8, so dependabot saw nothing to do, but the lockfile still pinned react-dom@19.2.5 and react-dom asserts at import time that both packages resolve to the same version. Every desktop test died on "Incompatible React versions" before its first assertion, and `@dependabot recreate` reproduced the same split. Grouping them makes it one PR. jscpd: #155 bumped it 5.0.14 -> 5.0.16, and the newer release measured 0.87% duplicated tokens against the fixed `--threshold 0.81` in quality:duplication. The gate failed without a line of source changing. The exact pin was deliberate for that reason, so ignore it here and upgrade it deliberately alongside whatever threshold move it implies. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 22, 2026
sarthakagrawal927
added a commit
that referenced
this pull request
Aug 23, 2026
Two dependabot rules that failed loudly this week. react: #156 bumped `react` to ^19.2.8 and left `react-dom` at ^19.1.0. That range already admits 19.2.8, so dependabot saw nothing to do, but the lockfile still pinned react-dom@19.2.5 and react-dom asserts at import time that both packages resolve to the same version. Every desktop test died on "Incompatible React versions" before its first assertion, and `@dependabot recreate` reproduced the same split. Grouping them makes it one PR. jscpd: #155 bumped it 5.0.14 -> 5.0.16, and the newer release measured 0.87% duplicated tokens against the fixed `--threshold 0.81` in quality:duplication. The gate failed without a line of source changing. The exact pin was deliberate for that reason, so ignore it here and upgrade it deliberately alongside whatever threshold move it implies. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two dependabot rules, both prompted by PRs that could not merge this week.
react — group it
#156 bumped
reactto^19.2.8and@types/reactto^19.2.18, but leftreact-domat^19.1.0. That range already admits 19.2.8, so dependabot saw nothing to update — while the lockfile still pinnedreact-dom@19.2.5.react-domasserts at import time that both packages resolve to the exact same version, so the whole desktop suite died before its first assertion:@dependabot recreatereproduced the identical split, so this is structural rather than a one-off. Areact-runtimegroup putsreact,react-dom, and both@typespackages in one PR that either upgrades coherently or fails honestly.jscpd — ignore it
#155 bumped jscpd 5.0.14 → 5.0.16. The newer release measured 0.87% duplicated tokens against the fixed
--threshold 0.81inquality:duplication, so the gate failed (74 clones reported) without a single line of source changing.jscpdwas already exact-pinned ("jscpd": "5.0.14", no caret) precisely because its output feeds a numeric gate — a measurement tool that drifts under you turns a quality gate into noise. This makes that intent explicit. Upgrading it stays a deliberate act, done alongside whatever threshold move or de-duplication it implies.Closing
#155 and #156 are being closed in favor of these rules.