Skip to content

개선(deps): Bump the landing-npm group across 1 directory with 12 updates - #115

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/landing-npm-2f228e8997
Closed

개선(deps): Bump the landing-npm group across 1 directory with 12 updates#115
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/landing-npm-2f228e8997

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the landing-npm group with 10 updates in the / directory:

Package From To
@codemirror/commands 6.10.3 6.11.0
@codemirror/view 6.43.1 6.43.9
hyparquet 1.26.0 1.28.2
@tailwindcss/vite 4.3.1 4.3.3
@types/node 25.9.3 25.9.5
mdsvex 0.12.7 0.12.8
shiki 4.2.0 4.4.3
svelte 5.56.3 5.56.9
svelte-check 4.6.0 4.7.6
vitest 3.2.6 3.2.7

Updates @codemirror/commands from 6.10.3 to 6.11.0

Commits

Updates @codemirror/state from 6.6.0 to 6.7.1

Commits

Updates @codemirror/view from 6.43.1 to 6.43.9

Commits

Updates hyparquet from 1.26.0 to 1.28.2

Changelog

Sourced from hyparquet's changelog.

[1.28.2]

  • Never match null values against range filters

[1.28.1]

  • Fix $nin filters when comparing Date values

[1.28.0]

  • Support $in filters on array values (#171)

[1.27.1]

  • Coalesce page index fetches into fewer byte range requests

[1.27.0]

  • Add usePageIndex option for page-level filter pushdown (#169)
  • Fix filtering on null and NaN row-group matches
  • Fix nested child column alignment by absolute row offsets
  • Compare date statistics by timestamp
  • Fix metadata decode of unsigned and decimal bounds
  • Fix node file slices (should be end-exclusive)

[1.26.2]

  • Custom jsonFromBytes parser option

[1.26.1]

  • Fix UUID statistics decode (#166)
Commits

Updates @tailwindcss/vite from 4.3.1 to 4.3.3

Release notes

Sourced from @​tailwindcss/vite's releases.

v4.3.3

Fixed

  • Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#20297)
  • Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#20298)
  • Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#20292)
  • Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#20299)
  • Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#20302)
  • Parse selectors like [data-foo]div as two selectors instead of one (#20303)
  • Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#20310)
  • Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#20124)
  • Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#20314)
  • Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#20319)
  • Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#20325)
  • Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#20318)
  • Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#20329)
  • Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#20335)
  • Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#20336)

v4.3.2

Fixed

  • Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
  • Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
  • Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
  • Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
  • Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
  • Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
  • Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
  • Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
  • Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
  • Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
  • Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
  • Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
  • Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)
Changelog

Sourced from @​tailwindcss/vite's changelog.

[4.3.3] - 2026-07-16

Fixed

  • Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#20297)
  • Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#20298)
  • Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#20292)
  • Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#20299)
  • Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#20302)
  • Parse selectors like [data-foo]div as two selectors instead of one (#20303)
  • Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#20310)
  • Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#20124)
  • Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#20314)
  • Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#20319)
  • Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#20325)
  • Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#20318)
  • Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#20329)
  • Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#20335)
  • Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#20336)

[4.3.2] - 2026-06-26

Fixed

  • Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
  • Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
  • Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
  • Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
  • Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
  • Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
  • Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
  • Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
  • Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
  • Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
  • Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
  • Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
  • Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)
Commits

Updates @types/node from 25.9.3 to 25.9.5

Commits

Updates mdsvex from 0.12.7 to 0.12.8

Release notes

Sourced from mdsvex's releases.

mdsvex@0.12.8

Patch Changes

  • #810 60d6939 Thanks @​jfbloom22! - Add a layoutPropForwarding option that can generate Svelte 5 runes-compatible layout prop forwarding.
Commits

Updates shiki from 4.2.0 to 4.4.3

Release notes

Sourced from shiki's releases.

v4.4.3

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

v4.4.2

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub

v4.4.1

   🚀 Features

    View changes on GitHub

v4.4.0

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

v4.3.1

   🚀 Features

    View changes on GitHub

v4.3.0

   🚀 Features

... (truncated)

Commits

Updates svelte from 5.56.3 to 5.56.9

Release notes

Sourced from svelte's releases.

svelte@5.56.9

Patch Changes

  • fix: skip controlled each fast path while another batch is pending (#18625)

  • fix: better whitespace handling inside printer (#18638)

  • fix: don't duplicate comments in attributes (#18636)

  • fix: preserve CSS comments in the AST printer (#18637)

svelte@5.56.8

Patch Changes

  • fix: call onerror and provide a working reset when hydrating a failed boundary (#18556)

  • fix: preserve select selection when spread attributes omit value (#18561)

svelte@5.56.7

Patch Changes

  • chore: provide indent option for print (#18474)

svelte@5.56.6

Patch Changes

  • perf: skip unnecessary blocker analysis when compiling components without top-level await (#18548)

  • fix: rerun derived that had an abort controller on reconnection (#18551)

svelte@5.56.5

Patch Changes

  • chore: drop dead code that make TSGO fail (#18496)

  • fix: don't (re)connect deriveds when read inside branch/root effects (#18527)

  • fix: skip unnecessary derived effect in earlier batch (#18525)

  • fix: avoid declaration tag warning in event handlers (#18500)

  • fix: abort deriveds own AbortSignal when it disconnects (#18400)

  • fix: ensure $state.eager() is correctly transormed for SSR output (#18530)

  • fix: correctly transform declaration tags during SSR (#18492)

  • fix: transform computed keys in keyed {#each} destructuring patterns (#18521)

  • fix: chain preprocessor sourcemaps with an empty sources[0] instead of dropping them (#18518)

... (truncated)

Changelog

Sourced from svelte's changelog.

5.56.9

Patch Changes

  • fix: skip controlled each fast path while another batch is pending (#18625)

  • fix: better whitespace handling inside printer (#18638)

  • fix: don't duplicate comments in attributes (#18636)

  • fix: preserve CSS comments in the AST printer (#18637)

5.56.8

Patch Changes

  • fix: call onerror and provide a working reset when hydrating a failed boundary (#18556)

  • fix: preserve select selection when spread attributes omit value (#18561)

5.56.7

Patch Changes

  • chore: provide indent option for print (#18474)

5.56.6

Patch Changes

  • perf: skip unnecessary blocker analysis when compiling components without top-level await (#18548)

  • fix: rerun derived that had an abort controller on reconnection (#18551)

5.56.5

Patch Changes

  • chore: drop dead code that make TSGO fail (#18496)

  • fix: don't (re)connect deriveds when read inside branch/root effects (#18527)

  • fix: skip unnecessary derived effect in earlier batch (#18525)

  • fix: avoid declaration tag warning in event handlers (#18500)

  • fix: abort deriveds own AbortSignal when it disconnects (#18400)

  • fix: ensure $state.eager() is correctly transormed for SSR output (#18530)

... (truncated)

Commits

Updates svelte-check from 4.6.0 to 4.7.6

Release notes

Sourced from svelte-check's releases.

svelte-check@4.7.6

Patch Changes

  • fix: don't log an error for vite configs without a Svelte plugin (#3091)

  • fix: handle SvelteKit 3 having its config merged at the top level (#3104)

svelte-check@4.7.5

Patch Changes

  • fix: prevent silent error during start-up caused by unhandled promise (#3096)

  • Updated dependencies [1df53d8]:

    • @​sveltejs/load-config@​0.2.2

svelte-check@4.7.4

Patch Changes

  • fix: support TypeScript 7 Stable under npm alias (#3073)

svelte-check@4.7.3

Patch Changes

  • feat: zero-config +error.svelte props (#3076)

svelte-check@4.7.2

Patch Changes

  • fix: resolve tsgo bin path with package.json (#3074)

  • fix: report tsconfig errors in --tsgo-experimental-api (#3070)

svelte-check@4.7.1

Patch Changes

  • fix: correctly parse --tsgo-experimental-api flag (#3067)

svelte-check@4.7.0

Minor Changes

  • feat: add --config option (#3066)

  • feat: svelte-check tsgo support with experimental api (#3036)

Patch Changes

  • fix: load esm version of Vite (#3065)

  • fix: stop excluding workspaces under dot-prefixed ancestors (#3037)

... (truncated)

Commits

Updates tailwindcss from 4.3.1 to 4.3.3

Release notes

Sourced from tailwindcss's releases.

v4.3.3

Fixed

  • Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#20297)
  • Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#20298)
  • Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#20292)
  • Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#20299)
  • Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#20302)
  • Parse selectors like [data-foo]div as two selectors instead of one (#20303)
  • Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#20310)
  • Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#20124)
  • Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#20314)
  • Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#20319)
  • Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#20325)
  • Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#20318)
  • Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#20329)
  • Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#20335)
  • Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#20336)

v4.3.2

Fixed

  • Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
  • Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
  • Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
  • Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
  • Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
  • Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
  • Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
  • Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
  • Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
  • Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
  • Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
  • Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
  • Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)
Changelog

Sourced from tailwindcss's changelog.

[4.3.3] - 2026-07-16

Fixed

  • Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#20297)
  • Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#20298)
  • Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#20292)
  • Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#20299)
  • Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#20302)
  • Parse selectors like [data-foo]div as two selectors instead of one (#20303)
  • Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#20310)
  • Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#20124)
  • Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#20314)
  • Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#20319)
  • Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#20325)
  • Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#20318)
  • Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#20329)
  • Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#20335)
  • Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#20336)

[4.3.2] - 2026-06-26

Fixed

  • Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
  • Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
  • Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
  • Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
  • Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
  • Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
  • Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
  • Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
  • Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
  • Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
  • Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
  • Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
  • Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)
Commits

Updates vitest from 3.2.6 to 3.2.7

Release notes

Sourced from vitest's releases.

v3.2.7

   🐞 Bug Fixes

    View changes on GitHub
Commits

@dependabot @github

dependabot Bot commented on behalf of github Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: landing. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 19, 2026
@dependabot
dependabot Bot requested a review from eddmpython as a code owner August 19, 2026 09:51
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 19, 2026
@eddmpython

eddmpython commented Aug 19, 2026

Copy link
Copy Markdown
Owner

@dependabot recreate

lockfile 이 package.json 과 어긋나 pyproc 호환성 게이트 4 개가 npm ci 단계에서 실패했다.

npm error `npm ci` can only install packages when your package.json and package-lock.json are in sync.
npm error Missing: svelte@5.56.9 from lock file

그룹 PR 이 workspace lockfile 을 완전히 갱신하지 못한 것으로 보인다. 재생성 후에도 같은
불일치가 남으면 이 PR 은 닫고 개별 갱신으로 다시 받는다.

@dependabot
개선(deps): Bump the landing-npm group across 1 directory with 12 updates
331b7a5 
Bumps the landing-npm group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@codemirror/commands](https://github.com/codemirror/commands) | `6.10.3` | `6.11.0` |
| [@codemirror/view](https://github.com/codemirror/view) | `6.43.1` | `6.43.9` |
| [hyparquet](https://github.com/hyparam/hyparquet) | `1.26.0` | `1.28.2` |
| [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.1` | `4.3.3` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.3` | `25.9.5` |
| [mdsvex](https://github.com/pngwn/MDsveX) | `0.12.7` | `0.12.8` |
| [shiki](https://github.com/shikijs/shiki/tree/HEAD/packages/shiki) | `4.2.0` | `4.4.3` |
| [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.56.3` | `5.56.9` |
| [svelte-check](https://github.com/sveltejs/language-tools) | `4.6.0` | `4.7.6` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `3.2.6` | `3.2.7` |



Updates `@codemirror/commands` from 6.10.3 to 6.11.0
- [Changelog](https://github.com/codemirror/commands/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/commands/commits)

Updates `@codemirror/state` from 6.6.0 to 6.7.1
- [Changelog](https://github.com/codemirror/state/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/state/commits)

Updates `@codemirror/view` from 6.43.1 to 6.43.9
- [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/view/commits)

Updates `hyparquet` from 1.26.0 to 1.28.2
- [Changelog](https://github.com/hyparam/hyparquet/blob/master/CHANGELOG.md)
- [Commits](hyparam/hyparquet@v1.26.0...v1.28.2)

Updates `@tailwindcss/vite` from 4.3.1 to 4.3.3
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/@tailwindcss-vite)

Updates `@types/node` from 25.9.3 to 25.9.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `mdsvex` from 0.12.7 to 0.12.8
- [Release notes](https://github.com/pngwn/MDsveX/releases)
- [Commits](https://github.com/pngwn/MDsveX/compare/mdsvex@0.12.7...mdsvex@0.12.8)

Updates `shiki` from 4.2.0 to 4.4.3
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.4.3/packages/shiki)

Updates `svelte` from 5.56.3 to 5.56.9
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.56.9/packages/svelte)

Updates `svelte-check` from 4.6.0 to 4.7.6
- [Release notes](https://github.com/sveltejs/language-tools/releases)
- [Commits](https://github.com/sveltejs/language-tools/compare/svelte-check@4.6.0...svelte-check@4.7.6)

Updates `tailwindcss` from 4.3.1 to 4.3.3
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/tailwindcss)

Updates `vitest` from 3.2.6 to 3.2.7
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.7/packages/vitest)

---
updated-dependencies:
- dependency-name: "@codemirror/commands"
  dependency-version: 6.10.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: landing-npm
- dependency-name: "@codemirror/state"
  dependency-version: 6.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: landing-npm
- dependency-name: "@codemirror/view"
  dependency-version: 6.43.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: landing-npm
- dependency-name: "@tailwindcss/vite"
  dependency-version: 4.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: landing-npm
- dependency-name: "@types/node"
  dependency-version: 25.9.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: landing-npm
- dependency-name: hyparquet
  dependency-version: 1.28.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: landing-npm
- dependency-name: mdsvex
  dependency-version: 0.12.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: landing-npm
- dependency-name: shiki
  dependency-version: 4.4.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: landing-npm
- dependency-name: svelte
  dependency-version: 5.56.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: landing-npm
- dependency-name: svelte-check
  dependency-version: 4.7.6
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: landing-npm
- dependency-name: tailwindcss
  dependency-version: 4.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: landing-npm
- dependency-name: vitest
  dependency-version: 3.2.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: landing-npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title 개선(deps): Bump the landing-npm group with 12 updates 개선(deps): Bump the landing-npm group across 1 directory with 12 updates Aug 19, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/landing-npm-2f228e8997 branch from fce63ee to 331b7a5 Compare August 19, 2026 13:30
@eddmpython

eddmpython commented Aug 19, 2026

Copy link
Copy Markdown
Owner

머지하지 않고 닫는다. lockfile 파손이 재생성으로도 고쳐지지 않았다.

최초 PR 과 @dependabot recreate 후 모두 같은 지점에서 죽었다.

npm error `npm ci` can only install packages when your package.json and package-lock.json are in sync.
npm error Missing: svelte@5.56.9 from lock file

호환성 게이트 4 개가 설치 단계(15~18 초)에서 중단됐다. 빌드나 타입 문제가 아니라 lockfile 문제다.
같은 시점에 열린 개별 PR(pyproc)은 lockfile 이 유효했으므로, 이 저장소의 npm workspace 구성에서
묶음 PR 이 workspace lockfile 을 완전히 갱신하지 못하는 것으로 판단한다.

설정에서 npm group 을 제거했다. 소음은 group 이 아니라 동시 PR 수 상한으로 제한한다. 이 상한은
정기 범프에만 걸리고 보안 업데이트는 별도로 흐른다. 여기 묶여 있던 12 개는 개별 PR 로 다시 올라온다.

allow 목록은 복원하지 않는다. allow 는 보안 업데이트까지 막는다(nanoid 경보에서 실측).

@eddmpython eddmpython closed this Aug 19, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/landing-npm-2f228e8997 branch August 19, 2026 13:44
eddmpython added a commit that referenced this pull request Aug 19, 2026
@eddmpython
수정: npm 정기 범프를 개별 PR 로 되돌려 피해를 격리한다
f1a35ef 
증상. dependabot 이 연 npm 그룹 PR(#115, 12 개 묶음)의 호환성 게이트 4 개가 설치 단계에서
죽었다. 빌드나 타입 문제가 아니라 lockfile 문제다.

  npm error `npm ci` can only install packages when your package.json and
  package-lock.json or npm-shrinkwrap.json are in sync.
  npm error Missing: svelte@5.56.9 from lock file

`@dependabot recreate` 로 브랜치를 다시 만들게 했으나 새 SHA 에서도 같은 오류로 멈췄다.
gate-a 15 초, gate-b 16 초, landing 18 초로 전부 `npm ci` 단계다.

원인. 루트 package.json 의 `overrides` 가 11 개 패키지를 정확 버전으로 고정한다. 그중
`"svelte": "5.56.3"` 이 있는데, PR 은 landing/package.json 의 svelte 를 5.56.9 로 올리면서
루트 overrides 는 그대로 두었다. 즉 dependabot 은 direct dependency 는 갱신하지만 루트
overrides 는 갱신하지 않는다. 두 요구가 모순이라 lockfile 이 sync 상태를 만들 수 없고
`npm ci` 가 거부한다. 그룹 기능의 결함이 아니라 override 미갱신이 원인이며, 개별 PR 이라도
override 에 걸린 패키지(svelte·vite·postcss·nanoid·dompurify 등)를 올리면 같은 결과가 된다.

변경. npm 블록에서 group 을 제거했다. 근본 원인을 없애지는 못하지만 피해를 격리한다. 묶음
PR 은 12 개 중 override 와 충돌하는 하나 때문에 전체가 막히는 반면, 개별 PR 이면 충돌하는
패키지만 막히고 나머지는 정상적으로 머지된다. group 을 둔 목적인 정기 범프 소음 감소는 동시
PR 수 상한으로 대신한다. 이 상한은 정기 범프에만 걸리고 보안 업데이트는 별도로 흐른다.
같은 파일의 github-actions 블록이 이미 그 성질을 이용해 limit 0 으로 정기 범프만 끄고 있다.

major 정기 범프 차단(version-update:semver-major)은 그대로 둔다. 이 update-type 은 정기
갱신에만 적용되므로 보안 업데이트는 major 라도 흐른다. allow 목록도 복원하지 않는다.
직전 커밋에서 확인했듯 allow 는 보안 업데이트 job 에도 전달되어 목록 밖 패키지의 보안 패치를
조용히 막는다.

검증. YAML 파싱으로 npm 블록에 groups 와 allow 가 없고 limit 과 ignore 만 남은 것을 확인했다.
pip 블록의 그룹 3 개는 그대로다. pip 에는 overrides 개념이 없어 같은 충돌이 생기지 않고,
같은 시점의 pip 그룹 PR 은 정상 열렸다. dependabot 계약 테스트 15 건 통과.

가드. 계약 테스트가 npm 블록 문자열에 `groups:` 가 없는지 검사한다. `allow:` 금지 가드도 함께
유지된다.

한계. override 미갱신 자체는 남아 있다. override 에 걸린 패키지의 정기 범프 PR 은 앞으로도
lockfile 불일치로 막힌다. 루트 overrides 를 정확 버전 대신 범위로 두면 풀리지만, 각 항목을
정확 버전으로 고정한 사유를 확인하지 않았으므로 이번에 바꾸지 않았다.
eddmpython added a commit that referenced this pull request Aug 19, 2026
@eddmpython
수정: npm 정기 버전 범프를 중단하고 보안 경로만 남긴다
2c72bb1 
증상. 정기 범프 PR 이 매일 열리는데 대부분 머지할 수 없다. #116(pyproc 0.0.22)을 닫자
#118(0.0.23)이 즉시 열렸다. 같은 breaking 이라 닫아도 다음 버전으로 반복된다.

원인. 세 가지가 겹쳐 npm 정기 범프의 실익이 사실상 0 이다.

1. 머지율이 낮다. dependabot PR 66 건을 생태계별로 세면 npm 24 건 중 머지 1 건(4.2%),
   pip 20 건 중 5 건(25.0%), uv 9 건 중 2 건(22.2%)이다. 유일하게 머지된 npm PR #64 는
   28 분 뒤 핫픽스 68697bd("사이트 빌드 복구 ... Deploy Site red")을 불렀다.
2. 루트 package.json 의 overrides 11 개를 dependabot 이 갱신하지 않는다. 그 패키지의 정기
   범프는 lockfile 불일치로 `npm ci` 에서 죽는다(#115 svelte 5.56.3 vs 5.56.9).
3. pyproc 은 0.0.22 부터 landing 이 쓰는 공개 표면이 사라져 머지 자체가 불가능하다.

이 저장소는 이미 같은 결론에 도달한 적이 있다. 2026-07-09 커밋 4fe3a31
"개선: dependabot 정기 버전 범프를 pip 로 한정" 이 같은 근거를 적어 두었다. 다만 그 구현이
`allow: [pyproc]` 이었고, allow 는 정기 범프뿐 아니라 보안 업데이트도 막는다. nanoid high
경보가 닫히지 못한 원인이 그것이었다.

변경. npm 블록을 `open-pull-requests-limit: 0` 으로 바꿨다. github-actions 블록이 이미 쓰는
형태이고, 공식 문서가 이 용도를 명시한다. `open-pull-requests-limit` 제목에는 version 아이콘만
붙고 본문에 "Security update pull requests are not subject to this limit and do not count
toward it" 이라고 적혀 있으며, "If you only require security updates and want to exclude
version updates, you can set open-pull-requests-limit to 0" 이 권장 수단으로 제시된다.

직전 커밋 f1a35ef 에서 넣었던 `ignore` 를 제거한다. 그때 "version-update:semver-* 는 정기
갱신에만 적용되므로 보안 업데이트는 major 라도 흐른다" 고 적었으나, 공식 문서를 원문으로
확인한 결과 그 서술의 근거가 없다. `ignore` 는 version 아이콘과 shield 아이콘을 둘 다 달고
있고 문서는 "will prevent security and version updates for those dependencies" 라고 쓴다.
"update-types only affects version updates, not security updates" 라는 예외 문장은
`allow` 절 안에만 있으며 `ignore` 쪽에는 대응 문장이 없다. 근거 없는 가정으로 보안 경로에
필터를 걸어 두었던 것이라 걷어낸다.

같은 커밋에서 판단한 group 제거는 유지한다. 다만 그때 적은 원인("workspace 묶음 PR 결함")은
이미 그 커밋에서 override 미갱신으로 정정했다.

pip 블록은 그대로 둔다. 머지율이 npm 의 6 배이고 pyproject 상한 완화는 CI 가 `pip install -e .`
신선 해석으로 검증한다. 실제로 openai 상한 완화 PR(#114)은 그 게이트가 회귀를 잡아냈다.

결과. 세 생태계 모두 allow 와 ignore 가 없어 보안 업데이트가 막히지 않는다. 정기 범프는 pip
에서만 열린다. npm 의존성을 올리는 일은 렌더 눈검수를 동반한 별도 작업으로 다룬다.

검증. YAML 파싱으로 세 블록의 limit(pip 2, github-actions 0, npm 0)과 allow·ignore 부재를
확인했다. dependabot 계약 테스트 15 건 통과.

가드. 계약 테스트가 npm 블록에 `open-pull-requests-limit: 0` 이 있고 `groups:` 와 `ignore:` 가
없는지 검사한다. 전체 파일에 `allow:` 가 없는지도 계속 검사한다.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@eddmpython eddmpython Awaiting requested review from eddmpython eddmpython is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@eddmpython