build(deps-dev): bump @vitejs/plugin-react from 6.0.2 to 6.0.5 - #756
build(deps-dev): bump @vitejs/plugin-react from 6.0.2 to 6.0.5#756dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) from 6.0.2 to 6.0.5. - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.5/packages/plugin-react) --- updated-dependencies: - dependency-name: "@vitejs/plugin-react" dependency-version: 6.0.5 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
Important Review skippedNo new commits to review since the last review. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthrough데스크톱 앱의 Changes데스크톱 의존성 업데이트
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Comment |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head1562ac4e6aa59f7415efb060e4a161bbcfcb44a1. -
Head SHA:
1562ac4e6aa59f7415efb060e4a161bbcfcb44a1 -
Workflow run: 31043800201
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (2 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (2 files)"]
R1 --> V1["required checks"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage evidence job did not run or did not publish coverage evidence. Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (2 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (2 files)"]
R1 --> V1["required checks"]
|
|
@coderabbitai review Review the exact live head only. Verify the @vitejs/plugin-react 6.0.5 update is lockfile-consistent, compatible with the repository Node/Vite/React toolchain, preserves React Compiler behavior, and passes lint, strict typecheck, complete tests/coverage, production build, audit, and security gates. Review only; do not update the branch, merge, release, or alter protections. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '=== Exact checked-out head ==='
git rev-parse HEAD
git status --short
git diff --name-status HEAD^ HEAD
git diff -- apps/desktop/package.json
echo '=== Repository package-manager and Node metadata ==='
fd -HI '^(package\.json|pnpm-lock\.yaml|package-lock\.json|yarn\.lock|\.npmrc|\.node-version|\.nvmrc|mise\.toml|volta)$' . \
-E node_modules -E dist -E build -E .git \
| sort
echo '=== Relevant package.json declarations ==='
fd -HI '^package\.json$' . -E node_modules -E dist -E build -E .git \
-x sh -c '
echo "--- $1"
jq "{name, packageManager, engines, volta, dependencies: (.dependencies // {} | with_entries(select(.key | test(\"^(react|react-dom|vite|`@vitejs/plugin-react`|babel-plugin-react-compiler|react-compiler)$\")))), devDependencies: (.devDependencies // {} | with_entries(select(.key | test(\"^(react|react-dom|vite|`@vitejs/plugin-react`|babel-plugin-react-compiler|react-compiler)$\"))))}" "$1"
' sh {}
echo '=== Lockfile entries for updated package and toolchain ==='
for f in $(fd -HI '^(pnpm-lock\.yaml|package-lock\.json|yarn\.lock)$' . -E node_modules -E dist -E build -E .git); do
echo "--- $f"
rg -n -C 4 '`@vitejs/plugin-react`|react-compiler|babel-plugin-react-compiler|(^|[^@[:alnum:]_-])vite@|react-dom@|(^|[^@[:alnum:]_-])react@' "$f" || true
done
echo '=== React Compiler and Vite configuration candidates ==='
fd -HI '\.(ts|tsx|js|jsx|mjs|cjs|json|yaml|yml)$' . -E node_modules -E dist -E build -E .git \
-x sh -c '
if rg -n -i -C 3 "reactCompiler|babel-plugin-react-compiler|react-compiler|`@vitejs/plugin-react`|defineConfig|plugins:" "$1" >/dev/null; then
echo "--- $1"
rg -n -i -C 3 "reactCompiler|babel-plugin-react-compiler|react-compiler|`@vitejs/plugin-react`|defineConfig|plugins:" "$1"
fi
' sh {}
echo '=== CI workflow commands and security gates ==='
fd -HI '\.(yaml|yml)$' .github -E .git 2>/dev/null \
-x sh -c '
echo "--- $1"
rg -n -i -C 3 "lint|typecheck|test|coverage|build|audit|security|codeql|npm ci|pnpm install|yarn install|node-version|setup-node" "$1" || true
' sh {}
echo '=== PR metadata and exact-head checks ==='
gh pr view 756 --repo ContextualWisdomLab/bandscope \
--json number,url,headRefName,headRefOid,baseRefName,mergeStateStatus,statusCheckRollup \
--jq '{number,url,headRefName,headRefOid,baseRefName,mergeStateStatus,statusCheckRollup: [.statusCheckRollup[] | {name,conclusion,status,detailsUrl,workflowName}]}'
echo '=== GitHub code scanning alerts for PR ==='
gh api 'repos/ContextualWisdomLab/bandscope/code-scanning/alerts?state=open&pr=756&per_page=100' \
--jq '.[] | {number,rule:.rule.id,severity:.rule.security_severity_level,state,html_url}' || true
echo '=== Dependabot alerts for repository ==='
gh api 'repos/ContextualWisdomLab/bandscope/dependabot/alerts?state=open&per_page=100' \
--jq '.[] | {number,dependency:.dependency.package.name,ecosystem:.dependency.package.ecosystem,severity:.security_advisory.severity,html_url}' || trueLength of output: 14957 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/bandscope"
pr="756"
echo '=== Checked-out commit and PR diff ==='
git rev-parse HEAD
git diff --name-status HEAD^ HEAD
git diff --no-ext-diff --unified=80 HEAD^ HEAD -- apps/desktop/package.json package-lock.json
echo '=== Package manifests: declared toolchain ==='
while IFS= read -r manifest; do
echo "--- ${manifest}"
jq '
{
name,
packageManager,
engines,
volta,
scripts,
dependencies: ((.dependencies // {}) | with_entries(
select(.key | test("^(react|react-dom|vite|`@vitejs/plugin-react`|babel-plugin-react-compiler|react-compiler)$"))
)),
devDependencies: ((.devDependencies // {}) | with_entries(
select(.key | test("^(react|react-dom|vite|`@vitejs/plugin-react`|babel-plugin-react-compiler|react-compiler)$"))
))
}
' "$manifest"
done < <(fd -HI '^package\.json$' . -E node_modules -E dist -E build -E .git | sort)
echo '=== package-lock.json: root and resolved relevant packages ==='
jq '
{
lockfileVersion,
root: .packages[""] | {
name,
engines,
dependencies: ((.dependencies // {}) | with_entries(
select(.key | test("^(react|react-dom|vite|`@vitejs/plugin-react`|babel-plugin-react-compiler|react-compiler)$"))
)),
devDependencies: ((.devDependencies // {}) | with_entries(
select(.key | test("^(react|react-dom|vite|`@vitejs/plugin-react`|babel-plugin-react-compiler|react-compiler)$"))
))
},
desktop: .packages["apps/desktop"] | {
dependencies: ((.dependencies // {}) | with_entries(
select(.key | test("^(react|react-dom|vite|`@vitejs/plugin-react`|babel-plugin-react-compiler|react-compiler)$"))
)),
devDependencies: ((.devDependencies // {}) | with_entries(
select(.key | test("^(react|react-dom|vite|`@vitejs/plugin-react`|babel-plugin-react-compiler|react-compiler)$"))
))
},
resolved: [
.packages
| to_entries[]
| select(
.key == "node_modules/@vitejs/plugin-react" or
.key == "node_modules/vite" or
.key == "node_modules/react" or
.key == "node_modules/react-dom" or
(.key | test("node_modules/(babel-plugin-react-compiler|react-compiler)$"))
)
| {path: .key, version: .value.version, resolved: .value.resolved, integrity: .value.integrity, peerDependencies: .value.peerDependencies, engines: .value.engines}
]
}
' package-lock.json
echo '=== Vite and React Compiler configuration ==='
while IFS= read -r candidate; do
if rg -n -i -C 4 'reactCompiler|babel-plugin-react-compiler|react-compiler|`@vitejs/plugin-react`|defineConfig' "$candidate" >/dev/null; then
echo "--- ${candidate}"
rg -n -i -C 4 'reactCompiler|babel-plugin-react-compiler|react-compiler|`@vitejs/plugin-react`|defineConfig' "$candidate"
fi
done < <(fd -HI '\.(ts|tsx|js|jsx|mjs|cjs|json|yaml|yml)$' . -E node_modules -E dist -E build -E .git | sort)
echo '=== CI workflow gate definitions ==='
if [ -d .github ]; then
while IFS= read -r workflow; do
echo "--- ${workflow}"
rg -n -i -C 3 'lint|typecheck|test|coverage|build|audit|security|codeql|npm (ci|install)|node-version|setup-node' "$workflow" || true
done < <(fd -HI '\.(yaml|yml)$' .github | sort)
fi
echo '=== PR metadata and checks for exact PR head ==='
gh pr view "$pr" --repo "$repo" \
--json number,url,headRefName,headRefOid,baseRefName,mergeStateStatus,statusCheckRollup \
--jq '{
number,
url,
headRefName,
headRefOid,
baseRefName,
mergeStateStatus,
statusCheckRollup: [
.statusCheckRollup[]
| {name,conclusion,status,workflowName,detailsUrl}
]
}'
echo '=== Code scanning alerts associated with this PR ==='
gh api "repos/${repo}/code-scanning/alerts?state=open&pr=${pr}&per_page=100" \
--jq '[.[] | {number,rule: .rule.id,severity: .rule.security_severity_level,state,html_url}]' || true
echo '=== Open Dependabot alerts for updated dependency ==='
gh api "repos/${repo}/dependabot/alerts?state=open&per_page=100" \
--jq '[.[] | select(.dependency.package.name == "`@vitejs/plugin-react`") | {number,dependency: .dependency.package.name,ecosystem: .dependency.package.ecosystem,severity: .security_advisory.severity,html_url}]' || trueLength of output: 38488 🏁 Script executed: #!/bin/bash
set -u
repo="ContextualWisdomLab/bandscope"
pr="756"
echo '=== Root manifest ==='
jq '{name,packageManager,engines,workspaces,scripts,devDependencies,dependencies}' package.json
echo '=== Desktop manifest ==='
jq '{name,engines,scripts,devDependencies,dependencies}' apps/desktop/package.json
echo '=== Relevant current lockfile entries ==='
jq '
{
root: .packages[""],
desktop: .packages["apps/desktop"],
pluginAtRoot: .packages["node_modules/@vitejs/plugin-react"],
pluginAtDesktop: .packages["apps/desktop/node_modules/@vitejs/plugin-react"],
viteAtRoot: .packages["node_modules/vite"],
viteAtDesktop: .packages["apps/desktop/node_modules/vite"],
reactAtRoot: .packages["node_modules/react"],
reactAtDesktop: .packages["apps/desktop/node_modules/react"],
reactDomAtRoot: .packages["node_modules/react-dom"],
reactDomAtDesktop: .packages["apps/desktop/node_modules/react-dom"],
reactCompiler: [
.packages | to_entries[]
| select(.key | test("node_modules/(babel-plugin-react-compiler|react-compiler)$"))
| {path: .key, value: .value}
]
}
' package-lock.json
echo '=== Relevant lockfile delta only ==='
git diff --no-ext-diff --unified=12 HEAD^ HEAD -- package-lock.json \
| rg -n -C 5 '`@vitejs/plugin-react`|`@rolldown/pluginutils`|babel-plugin-react-compiler|react-compiler|"peer": true' \
|| true
echo '=== Configuration candidates ==='
fd -HI '^(vite\.config\..*|.*vite.*\.config\..*|tsconfig.*\.json|package\.json)$' . \
-E node_modules -E dist -E build -E .git | sort
echo '=== React Compiler and plugin references ==='
rg -n -i -C 5 'reactCompiler|babel-plugin-react-compiler|react-compiler|`@vitejs/plugin-react`|plugin-react' \
-g '!node_modules/**' -g '!dist/**' -g '!build/**' -g '!package-lock.json' . \
|| true
echo '=== CI workflow files ==='
fd -HI '\.(yaml|yml)$' .github 2>/dev/null | sort
echo '=== CI gates ==='
rg -n -i -C 4 'lint|typecheck|test|coverage|build|audit|security|codeql|npm (ci|install)|setup-node|node-version' \
.github 2>/dev/null || true
echo '=== Pull request metadata and check runs ==='
gh pr view "$pr" --repo "$repo" \
--json number,url,headRefOid,headRefName,mergeStateStatus,statusCheckRollup \
--jq '{number,url,headRefOid,headRefName,mergeStateStatus,checks:[.statusCheckRollup[] | {name,status,conclusion,workflowName,detailsUrl}]}' \
|| true
echo '=== Check runs bound to the checked-out commit ==='
gh api "repos/${repo}/commits/$(git rev-parse HEAD)/check-runs?per_page=100" \
--jq '{total_count,check_runs:[.check_runs[] | {name,status,conclusion,app:.app.slug,details_url}]}' \
|| true
echo '=== PR code-scanning alerts ==='
gh api "repos/${repo}/code-scanning/alerts?state=open&pr=${pr}&per_page=100" \
--jq '[.[] | {number,rule:.rule.id,severity:.rule.security_severity_level,state,html_url}]' \
|| true
echo '=== Open Dependabot alerts for `@vitejs/plugin-react` ==='
gh api "repos/${repo}/dependabot/alerts?state=open&per_page=100" \
--jq '[.[] | select(.dependency.package.name == "`@vitejs/plugin-react`") | {number,severity:.security_advisory.severity,html_url}]' \
|| trueLength of output: 79430 🏁 Script executed: #!/bin/bash
set -u
repo="ContextualWisdomLab/bandscope"
run_id="30933719437"
job_id="92074464552"
echo '=== Desktop Vite configuration ==='
cat -n apps/desktop/vite.config.ts
echo '=== Failed security-audit job: metadata ==='
gh api "repos/${repo}/actions/jobs/${job_id}" \
--jq '{id,name,status,conclusion,started_at,completed_at,html_url,steps:[.steps[] | {number,name,status,conclusion,started_at,completed_at}]}' \
|| true
echo '=== Failed security-audit job: failed-step log ==='
gh run view "$run_id" --repo "$repo" --job "$job_id" --log-failed \
|| true
echo '=== Failed security-audit workflow: run metadata ==='
gh run view "$run_id" --repo "$repo" \
--json databaseId,headSha,conclusion,status,event,workflowName,url,startedAt,updatedAt \
|| trueLength of output: 37959 🏁 Script executed: #!/bin/bash
set -u
repo="ContextualWisdomLab/bandscope"
ci_run_id="30933718756"
ci_job_id="92074463301"
coverage_run_id="30933719033"
coverage_job_id="92077579340"
release_run_id="30933720670"
echo '=== Successful CI job steps ==='
gh api "repos/${repo}/actions/jobs/${ci_job_id}" \
--jq '{name,conclusion,steps:[.steps[] | {number,name,conclusion}]}' \
|| true
echo '=== Successful CI log: verification commands ==='
gh run view "$ci_run_id" --repo "$repo" --job "$ci_job_id" --log \
| rg -n -i -C 2 'npm run (lint|typecheck|test|build|check)|quickcheck|eslint|tsc --noEmit|vitest run|coverage|vite build|passed|successfully|error' \
|| true
echo '=== Successful coverage-evidence job steps ==='
gh api "repos/${repo}/actions/jobs/${coverage_job_id}" \
--jq '{name,conclusion,steps:[.steps[] | {number,name,conclusion}]}' \
|| true
echo '=== Successful release-preflight job steps ==='
gh run view "$release_run_id" --repo "$repo" \
--json headSha,conclusion,jobs \
--jq '{headSha,conclusion,jobs:[.jobs[] | {name,conclusion,steps:[.steps[] | {name,conclusion}]}]}' \
|| trueLength of output: 23759
No code-level issue found in the
Blocking result: GitHub denied access to the Code Scanning and Dependabot alert APIs with HTTP 403. Those repository-wide alert lists remain unverified. I did not modify the branch, merge state, releases, or protections.
|
1 participant
Bumps @vitejs/plugin-react from 6.0.2 to 6.0.5.
Release notes
Sourced from @vitejs/plugin-react's releases.
Changelog
Sourced from @vitejs/plugin-react's changelog.
Commits
68c0cb8release: plugin-react@6.0.5 (#1362)555cdbcfix(react): make the react compiler preset filter linear (#1353)a00a9f8fix(deps): update all non-major dependencies (#1327)f4b5498release: plugin-react@6.0.47a40659fix(react):$RefreshSig$ is not definedwith NODE_ENV=production vite dev ...98b32d4fix(deps): update react 19.2.8 (#1298)8ae5449fix: babel-plugin-react-compiler cannot be imported when used in a framework ...f09ea01fix(deps): update all non-major dependencies (#1282)640fd35release: plugin-react@6.0.3889efb0fix(deps): update all non-major dependencies (#1249)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit