Repository navigation
Update dependencies from open Dependabot PRs - #233
Merged
Merged
Conversation
Applies every open Dependabot bump in one change: vite 8.3.5,
@vitejs/plugin-react 6.1, @tailwindcss/vite 4.3.3, react-router-dom 7.18.4,
lucide-react 1.48, react-hot-toast 2.6.1, tsx 4.23.15, vitest and
@vitest/coverage-v8 5, @types/express-serve-static-core 5.1.3, and the
lockfile-only source-map-js and ip-address updates.
@types/express-serve-static-core 5.1 types untyped req.params values as
string | string[], so route handlers that read path params now declare
them with Request<{ ... }>, and asyncHandler is generic over the params
type so those handlers keep their types through the wrapper.
tsx is now a root devDependency because root scripts (check:file-sizes,
migrate, coverage reports) run it, and the newer server range no longer
hoists it to the root. The client Vite config imports the access boundary
module with its .ts extension, which clears Vite's native config loader
warning.
The spec starts one mock server on a fixed port and some tests change its login state. With fullyParallel and more than one local worker, a test could reach another worker's server and ignore the state it had just set, so the login redirect test failed locally while passing in CI's single worker.
This was referenced Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidates the open Dependabot PRs into one change: #189, #216, #217, #218, #219, #220, #222, #223, #224, #225, #228, #229 and #230. The proxy-addr bump (#228) already landed through #232, so this branch carries the rest.
Code changes needed by the bumps:
req.paramsvalues asstring | string[]. Route handlers that read path params now declare them withRequest<{ ... }>matching the route path, andasyncHandleris generic over the params type..tsextension to clear the native config loader warning Vite 8.3 prints.Also fixes a local-only scraper test failure: the FamilySearch spec shares one mock server on a fixed port and mutates its login state, so under fullyParallel with several local workers a test could hit another worker's server. The spec now runs in a single worker.
Validated locally: production audit (no vulnerabilities), file size budgets, full build, unit tests (248), integration tests, vitest coverage and scraper tests (15).