Repository navigation
build(deps): bump stream-json from 1.5.0 to 3.6.0 - #269
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [stream-json](https://github.com/uhop/stream-json) from 1.5.0 to 3.6.0. - [Commits](uhop/stream-json@1.5.0...3.6.0) --- updated-dependencies: - dependency-name: stream-json dependency-version: 3.6.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![lifeomic-review-bot[bot]](https://avatars.githubusercontent.com/u/29172293?s=60&v=4){kind=small}
There was a problem hiding this comment.
Upstream: uhop/stream-json (1.5.0→3.6.0; compare link in PR body)
Scope
Dependabot updates the direct stream-json dependency in package.json and yarn.lock only. The CLI uses it in lib/cmds/fhir_cmds/ingest.js and lib/cmds/ontologies_cmds/import.js (withParser / streamValues); this PR does not change those call sites. Worth merging to pick up upstream parser hardening (e.g. __proto__ handling and JSONC fixes noted in the dependency changelog) while keeping the declared range current.
CI
Required checks were still pending when this review ran; merge remains gated by branch protection.
Regression risk
This is a major semver jump (1.x→3.x) on the code path that streams FHIR and ontology JSON from stdin, so behavior regressions are possible even though the imported APIs look unchanged.
Residual risks / follow-ups
- Yarn still resolves
stream-json@1.5.0forstream-csv-as-jsonwhile the CLI direct dependency resolves3.6.0; that split is expected but worth remembering if CSV/FHIR ingest issues appear after merge. None — becausethe diff is dependency-only, usage is limited to documentedStreamValueshelpers, andtest/unit/commands/fhir-test.js/ontologies.test.jsexercise the ingest/import commands—confirm CI finishes green before merge.
Note: Review generated using Cursor model
composer-2.5.
This review was generated by review-bot.
Bumps stream-json from 1.5.0 to 3.6.0.
Commits
77a4946New version: 3.6.0.0291333Added simplified replacement + fast check tests.0c816aeBump@types/nodefrom 26.2.0 to 26.3.0 in the npm-deps group (#219)c0299dcReworked how comments are handled in JSONC.2f2d35bAdded checks for__proto__.1a66390Fixed #216.5d41ab3Dropped Bun-related test gates.964e3f6Addedbigint.c604962Clarified.63ad851Bump the npm-deps group across 1 directory with 2 updates (#218)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.