Skip to content

deps: update dependencies to latest#377

Open
jongio wants to merge 3 commits into
mainfrom
deps/update-2026-07-25
Open

deps: update dependencies to latest#377
jongio wants to merge 3 commits into
mainfrom
deps/update-2026-07-25

Conversation

@jongio

@jongio jongio commented Jul 25, 2026

Copy link
Copy Markdown
Owner

Routine dependency refresh across Go modules, the Astro site, the screenshots tool, and GitHub Actions pins.

What moved

Package From To
typescript 6.0.3 7.0.2 (side-by-side)
actions/checkout v7.0.0 v7.0.1
goreleaser (release action) v2.16.0 v2.17.0
playwright (screenshots) 1.61.1 1.62.0
golang.org/x/exp 20260709172345 20260718201538
charmbracelet/x/exp/golden 20260705004817 20260720091843
@emnapi/core, @emnapi/runtime 1.11.2 1.11.3
@emnapi/wasi-threads 1.2.2 1.2.3

Everything else was already on latest. Held back: nothing.

TypeScript 7 side-by-side

astro check, @astrojs/language-server and @volar/kit import TypeScript by the bare typescript specifier and need its programmatic API, which the 7.x native compiler doesn't ship. Microsoft's side-by-side layout resolves it:

"@typescript/native": "npm:typescript@^7.0.2",
"typescript": "npm:@typescript/typescript6@^6.0.2"

@typescript/native is the real TS 7 compiler; the typescript specifier resolves to the 6.0 API re-export the Astro toolchain needs. Not a downgrade: the 6.0.2 in the diff is the shim. npx tsc --version reports 7.0.2, and the shim's bin is tsc6, so it doesn't collide.

Side effect: @astrojs/check 0.9.9's ^5 || ^6 peer range is now genuinely satisfied, so npm install no longer emits an ERESOLVE warning. The lockfile gains the 20 @typescript/typescript-<platform> natives, which is expected.

Also fixed

Four pre-existing problems the validation run surfaced:

  • TestRegisterDefaults called config.Load(), which reads the real user config file and fails when another process holds it. Switched to config.LoadDefaults(), the filesystem-free variant documented for test helpers.
  • RunUpdate locks under os.UserConfigDir(), and go test runs package binaries concurrently, so cmd's update test raced internal/update's four RunUpdate tests over the real user-level lock. Both sites now point that dir at a temp dir with t.Setenv.
  • TestStartDetachedFn_ReaperTimeout asserted a 2s bound that measured process-spawn latency, not blocking. Raised to 5s, still far under the ~9s a real regression would take.
  • Three docs pages imported KeybindingTable without using it.

Validation

build / cross-compile (6 platforms) / vet / gofmt / gofumpt / mod verify / mod tidy / deadcode / golangci-lint / govulncheck / go test / astro check / astro build / npm audit: pass. Coverage 81.7% (threshold 75%). astro check: 54 files, 0 errors, 0 warnings, 0 hints.

- actions/checkout: v7.0.0 -> v7.0.1
- goreleaser: v2.16.0 -> v2.17.0
- playwright: 1.61.1 -> 1.62.0
- golang.org/x/exp: 20260709172345 -> 20260718201538
- charmbracelet/x/exp/golden: 20260705004817 -> 20260720091843
- @emnapi/core, @emnapi/runtime: 1.11.2 -> 1.11.3
- @emnapi/wasi-threads: 1.2.2 -> 1.2.3

TypeScript stays on 6.0.3. astro check needs TypeScript's programmatic
API, which the 7.x native compiler doesn't ship yet.

Also fixes three pre-existing issues the full validation run surfaced:
TestRegisterDefaults read the real user config file instead of embedded
defaults, TestStartDetachedFn_ReaperTimeout's 2s bound measured
process-spawn latency rather than blocking behavior, and three docs
pages imported KeybindingTable without using it.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2127a7a3-47c9-410a-9f75-7eaf08125751
@jongio jongio self-assigned this Jul 25, 2026
@jongio jongio added the deps Dependency updates label Jul 25, 2026
jongio and others added 2 commits July 25, 2026 21:19
Uses Microsoft's documented TypeScript 6.0/7.0 side-by-side layout so
nothing stays held back:

- @typescript/native: npm:typescript@^7.0.2 (the real TS 7 compiler)
- typescript: npm:@typescript/typescript6@^6.0.2 (6.0 API re-export)

astro check, @astrojs/language-server and @volar/kit import TypeScript
by the bare "typescript" specifier and need the programmatic API, which
the 7.x native compiler doesn't ship. Pointing that specifier at the 6.0
re-export satisfies them while @typescript/native supplies TS 7 itself.
npx tsc reports 7.0.2, and the shim's bin is tsc6, so it doesn't collide.

This isn't a downgrade. The 6.0.2 in the diff is the API shim.

Side effect: @astrojs/check 0.9.9's ^5 || ^6 peer range is now genuinely
satisfied, so npm install no longer emits an ERESOLVE peer warning.

astro check: 54 files, 0 errors, 0 warnings, 0 hints. TypeScript 7
surfaced no new type errors.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2127a7a3-47c9-410a-9f75-7eaf08125751
RunUpdate takes an exclusive lock under os.UserConfigDir(). go test runs
package binaries concurrently, so cmd's TestUpdateCmd_ErrorWrapping held
the real user-level lock through a network fetch while internal/update's
four RunUpdate tests raced it over the same file. The losing side failed
with "another update is already in progress". This surfaced on macOS CI.

Both sites now redirect os.UserConfigDir() to a per-test temp dir via
t.Setenv, matching the t.TempDir() isolation the other lock tests use.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2127a7a3-47c9-410a-9f75-7eaf08125751
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

deps Dependency updates

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant