Repository navigation
⬆️ Refresh dependencies and pin GitHub Actions - #902
Merged
Merged
Conversation
Upgrade the compatible build, lint, type, and browser-test toolchain and refresh transitive dependencies. Preserve Babel 7 and TypeScript 6 where newer majors break plugin compatibility or generated public types. Pin all workflow actions to verified release commits, share Node 24 across CI and releases, and replace stale node_modules caching with lockfile-based npm caching and clean installs. Restore browser coverage collection and adapt tests to the newer tooling.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The build and test dependencies were behind current releases, and workflows still used Node 18/20 with mutable Action tags. CI also cached
node_modulesusing a nonexistentyarn.lock, so dependency changes did not reliably invalidate the cache.Approach
Refresh direct dependencies to their newest compatible releases and update the transitive lockfile. Move CI and publishing to Node 24 through
.nvmrc, usenpm ciwith npm's lockfile-based download cache, and remove the redundant install job. Upgrade all seven Actions and pin all 15 references to verified upstream commit SHAs with version comments. Point release drafting atmainand use its current token input and required permissions.Keep Babel on the newest 7.x releases because the latest Rollup Babel plugin still declares a Babel 7 peer. Use TypeScript 6.0.3 because TypeScript 7's declaration output drops this library's augmented methods. Explicitly preserve the previous non-strict compiler behavior and annotate the test's custom context. Initialize the host coverage map so the newer test runner collects browser coverage, and remove an unused Rollup plugin dependency.
Evidence
A clean install passes lint, bundle/declaration builds, type checks, and all 128 Chrome tests. Coverage is 100% for statements, branches, functions, and lines, and the CI LCOV report contains 37 source files. The packed npm artifact includes its bundle and declarations, and a separate consumer successfully type-checks chained clicks, typing, and assertions against that package. All workflows pass actionlint.
Remaining dependency findings
The npm audit count falls from 21 to 13, with high-severity findings falling from 11 to 2. All remaining findings are in development dependencies, including upstream
extract-zip,deepmerge, and glob/minimatch dependency chains; production audit reports zero. Resolving those remaining findings requires upstream fixes or separate tooling migrations.