chore(deps): update non-major dependencies - #328

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

package.json (1)

43-58: ⚠️ Potential issue | 🔴 Critical

Lockfile must match manifest bumps before merge.

Line 43-Line 58 updates manifest versions and packageManager; ensure pnpm-lock.yaml is regenerated with pnpm 10.30.3 and committed. This is the same blocker previously reported.

#!/bin/bash
set -euo pipefail

test -f package.json
test -f pnpm-lock.yaml

python - <<'PY' > /tmp/expected_specs.txt
import json
deps = [
  "@biomejs/biome",
  "@types/node",
  "@vitest/coverage-v8",
  "cspell",
  "lint-staged",
  "prettier",
  "sort-package-json",
  "tsdown",
  "vitest",
]
pkg = json.load(open("package.json"))
for d in deps:
  print(f"{d}@{pkg['devDependencies'][d]}")
print(f"packageManager={pkg['packageManager']}")
PY

while IFS= read -r spec; do
  if rg -n --fixed-strings "$spec" pnpm-lock.yaml >/dev/null; then
    echo "OK   $spec"
  else
    echo "MISS $spec"
  fi
done < /tmp/expected_specs.txt

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 43 - 58, The package manifest was updated
(devDependencies like "@biomejs/biome", "@types/node", "@vitest/coverage-v8",
"cspell", "lint-staged", "prettier", "sort-package-json", "tsdown", "vitest" and
packageManager) but pnpm-lock.yaml was not regenerated; run pnpm using the
declared packageManager version (pnpm@10.30.3) to regenerate the lockfile (e.g.,
pnpm install or pnpm -w install if workspace), ensure pnpm-lock.yaml now
contains entries matching the new devDependency versions and
packageManager=pnpm@10.30.3, and commit the updated pnpm-lock.yaml alongside the
package.json change.

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

package.json (1)

43-58: ⚠️ Potential issue | 🔴 Critical

Lockfile is out of sync with updated deps (merge blocker).

CI already reports mismatches for these updated entries. Regenerate and commit pnpm-lock.yaml using pnpm@10.30.3 so Lines 43-58 are reflected.

#!/bin/bash
set -euo pipefail

test -f package.json
test -f pnpm-lock.yaml

python - <<'PY'
import json
with open("package.json") as f:
    pkg=json.load(f)
targets=[
  "@biomejs/biome","@types/node","@vitest/coverage-v8",
  "cspell","lint-staged","prettier","sort-package-json","tsdown","vitest"
]
for t in targets:
    print(f"{t}@{pkg['devDependencies'][t]}")
print("packageManager="+pkg["packageManager"])
PY

echo "--- lockfile hits ---"
python - <<'PY' | while read -r spec; do
import json
with open("package.json") as f:
    pkg=json.load(f)
targets=[
  "@biomejs/biome","@types/node","@vitest/coverage-v8",
  "cspell","lint-staged","prettier","sort-package-json","tsdown","vitest"
]
for t in targets:
    print(f"{t}@{pkg['devDependencies'][t]}")
PY
  rg -n --fixed-strings "$spec" pnpm-lock.yaml >/dev/null && echo "✓ $spec" || echo "✗ $spec"
done

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 43 - 58, The pnpm lockfile is out of sync with the
devDependencies (entries like `@biomejs/biome`, `@types/node`, `@vitest/coverage-v8`,
cspell, lint-staged, prettier, sort-package-json, tsdown, vitest) and the
packageManager field; regenerate pnpm-lock.yaml using pnpm@10.30.3 so the lock
reflects package.json, verify the lock contains those exact spec strings, and
commit the updated pnpm-lock.yaml and any lockfile metadata changes (ensuring
packageManager remains pnpm@10.30.3).

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

package.json (1)

58-58: 🧹 Nitpick | 🔵 Trivial

Align engines.pnpm with the pinned packageManager version.

Line 58 pins pnpm@10.30.3, but Line 61 still allows >=10.17.1, which permits older clients and version drift.

Proposed diff

   "engines": {
     "node": ">=22.14.0",
-    "pnpm": ">=10.17.1"
+    "pnpm": ">=10.30.3"
   },

#!/bin/bash
set -euo pipefail

python - <<'PY'
import json, re

def parse(v):
    return tuple(int(x) for x in v.split("."))

with open("package.json", "r", encoding="utf-8") as f:
    d = json.load(f)

pm = d.get("packageManager", "")
eng = d.get("engines", {}).get("pnpm", "")

m_pm = re.match(r"^pnpm@(\d+\.\d+\.\d+)$", pm)
m_eng = re.match(r"^>=\s*(\d+\.\d+\.\d+)$", eng)

print("packageManager:", pm)
print("engines.pnpm :", eng)

if not (m_pm and m_eng):
    print("Could not parse one or both fields.")
else:
    pm_v = m_pm.group(1)
    eng_v = m_eng.group(1)
    aligned = parse(eng_v) >= parse(pm_v)
    print("packageManager version:", pm_v)
    print("engines floor        :", eng_v)
    print("aligned              :", aligned)
PY

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@package.json` at line 58, package.json currently pins packageManager to
"pnpm@10.30.3" but engines.pnpm still allows ">=10.17.1"; update the
engines.pnpm field to at least ">=10.30.3" (or exactly "10.30.3" if you prefer a
strict pin) so the engines.pnpm floor aligns with the packageManager value,
ensuring the version strings in the packageManager and engines.pnpm fields match
and use the same semver format.

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

package.json (1)

43-58: ⚠️ Potential issue | 🔴 Critical

Lockfile is still out of sync with updated dependency specifiers.

Lines 43-58 changed multiple devDependencies and packageManager, and CI is already failing pnpm install --frozen-lockfile for specifier mismatch. Please regenerate and commit pnpm-lock.yaml using pnpm 10.30.3 before merge.

#!/bin/bash
set -euo pipefail

python - <<'PY' > /tmp/expected_specs.txt
import json
d = json.load(open("package.json"))
keys = [
  "@biomejs/biome",
  "@types/node",
  "@vitest/coverage-v8",
  "cspell",
  "lint-staged",
  "prettier",
  "sort-package-json",
  "tsdown",
  "vitest",
]
for k in keys:
  print(f"{k}@{d['devDependencies'][k]}")
print(d["packageManager"])
PY

echo "Checking expected specs in pnpm-lock.yaml..."
while IFS= read -r spec; do
  if rg -n --fixed-strings "$spec" pnpm-lock.yaml >/dev/null; then
    echo "FOUND   $spec"
  else
    echo "MISSING $spec"
  fi
done < /tmp/expected_specs.txt

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 43 - 58, The pnpm lockfile is out of sync with the
updated devDependencies and packageManager in package.json: update
pnpm-lock.yaml by running pnpm using the specified packageManager version
(pnpm@10.30.3) so the specifiers for the devDependencies (e.g.,
"@biomejs/biome", "@types/node", "@vitest/coverage-v8", "cspell", "lint-staged",
"prettier", "sort-package-json", "tsdown", "vitest") and the packageManager
entry are reflected in the lockfile, then commit the regenerated pnpm-lock.yaml
so CI no longer fails `pnpm install --frozen-lockfile`.

package.json (1)

58-58: ⚠️ Potential issue | 🔴 Critical

Lockfile still out of sync.

Pipeline fails with lockfile mismatch. Run pnpm install and commit pnpm-lock.yaml.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@package.json` at line 58, The repository's pnpm lockfile is out of sync with
package.json's packageManager setting; run `pnpm install` locally to
regenerate/update pnpm-lock.yaml, verify the lockfile changes, and commit the
updated pnpm-lock.yaml alongside the package.json change so the pipeline's
lockfile check passes (refer to the "packageManager" field and ensure
pnpm-lock.yaml is included in the commit).

package.json (1)

43-58: ⚠️ Potential issue | 🔴 Critical

Lockfile is out of sync with manifest changes (CI blocker).

Line 43-58 updates dependency specifiers and packageManager, and CI already reports specifier mismatches. Regenerate and commit pnpm-lock.yaml from this branch before merge.

#!/bin/bash
set -euo pipefail

python - <<'PY' > /tmp/updated-specs.txt
import json
d = json.load(open("package.json"))
for name in [
  "@biomejs/biome",
  "@types/node",
  "@vitest/coverage-v8",
  "cspell",
  "lint-staged",
  "prettier",
  "sort-package-json",
  "tsdown",
  "vitest",
]:
    print(f"{name}@{d['devDependencies'][name]}")
PY

echo "Checking whether updated specs are present in pnpm-lock.yaml..."
while IFS= read -r spec; do
  if rg -n --fixed-strings "$spec" pnpm-lock.yaml >/dev/null; then
    echo "✓ $spec"
  else
    echo "✗ missing: $spec"
  fi
done < /tmp/updated-specs.txt

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 43 - 58, The lockfile is out of sync with the
manifest changes: regenerate pnpm-lock.yaml so the updated devDependency
specifiers (e.g. "@biomejs/biome", "@types/node", "@vitest/coverage-v8",
"cspell", "lint-staged", "prettier", "sort-package-json", "tsdown", "vitest",
and others shown in package.json) and the packageManager value
("packageManager": "pnpm@10.30.3") are reflected in the lockfile; run the
appropriate pnpm command to update the lockfile (e.g. pnpm install or pnpm
install --lockfile-only with pnpm@10.30.3), verify pnpm-lock.yaml contains the
new specifiers, and commit the updated pnpm-lock.yaml to this branch before
merging.

package.json (1)

43-58: ⚠️ Potential issue | 🔴 Critical

Lockfile is out of sync with the updated specs (merge blocker).

CI already reports 9 specifier mismatches after these version bumps. Regenerate pnpm-lock.yaml with pnpm 10.30.3 and commit it with this PR.

#!/bin/bash
set -euo pipefail

python - <<'PY' | while read -r spec; do
import json
data = json.load(open("package.json"))
for p in [
  "@biomejs/biome",
  "@types/node",
  "@vitest/coverage-v8",
  "cspell",
  "lint-staged",
  "prettier",
  "sort-package-json",
  "tsdown",
  "vitest",
]:
  print(f"{p}@{data['devDependencies'][p]}")
PY
  if rg -n --fixed-strings "$spec" pnpm-lock.yaml >/dev/null 2>&1; then
    echo "OK  $spec"
  else
    echo "MISS $spec"
  fi
done

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 43 - 58, The pnpm lockfile is out of sync with the
bumped devDependencies in package.json (see packageManager "pnpm@10.30.3" and
the devDependencies like "@biomejs/biome", "@types/node", "@vitest/coverage-v8",
"cspell", "lint-staged", "prettier", "sort-package-json", "tsdown", "vitest");
regenerate pnpm-lock.yaml using pnpm 10.30.3 (e.g. run pnpm install with that
pnpm binary or use pnpm env to ensure version), verify the nine specifier
mismatches are resolved, and commit the updated pnpm-lock.yaml to the PR so CI
no longer reports missing specs.

package.json (1)

43-58: ⚠️ Potential issue | 🔴 Critical

Commit the matching pnpm-lock.yaml.

Lines 43-58 change package specifiers and the pinned pnpm version, and CI is already reporting a manifest/lockfile mismatch. Regenerate pnpm-lock.yaml with pnpm 10.31.0 and include it in this PR.

#!/bin/bash
set -euo pipefail

python - <<'PY'
import json
import subprocess
import sys

try:
    import yaml
except ImportError:
    subprocess.check_call([sys.executable, "-m", "pip", "install", "-q", "pyyaml"])
    import yaml

with open("package.json") as f:
    pkg = json.load(f)
with open("pnpm-lock.yaml") as f:
    lock = yaml.safe_load(f)

root = lock.get("importers", {}).get(".", {})
lock_specs = {}
for section in ("dependencies", "devDependencies", "optionalDependencies"):
    for name, meta in root.get(section, {}).items():
        lock_specs[name] = meta.get("specifier") if isinstance(meta, dict) else meta

targets = [
    "@biomejs/biome",
    "@types/node",
    "@vitest/coverage-v8",
    "cspell",
    "lint-staged",
    "prettier",
    "sort-package-json",
    "tsdown",
    "vitest",
]

failed = False
for name in targets:
    manifest_version = pkg["devDependencies"][name]
    lockfile_version = lock_specs.get(name)
    ok = manifest_version == lockfile_version
    print(f'{"OK" if ok else "MISMATCH"} {name}: manifest={manifest_version} lockfile={lockfile_version}')
    failed |= not ok

sys.exit(1 if failed else 0)
PY

Expected result: every line prints OK. If not, the lockfile still needs regeneration.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 43 - 58, The package manifest and pinned
packageManager were changed but the pnpm lockfile is out of sync; regenerate
pnpm-lock.yaml using pnpm@10.31.0 (as set in the packageManager field) so the
specifiers for the devDependencies (e.g., "@biomejs/biome", "@types/node",
"@vitest/coverage-v8", "cspell", "lint-staged", "prettier", "sort-package-json",
"tsdown", "vitest") match the lockfile, then add the updated pnpm-lock.yaml to
the PR and re-run CI to verify no manifest/lockfile mismatches.

package.json (2)

43-43: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Verify biome.json schema matches @biomejs/biome version.

If biome.json exists and its $schema field doesn't reference version 2.4.16, update it to match the dependency.

#!/bin/bash
# Check if biome.json schema version matches dependency version
if [ -f biome.json ]; then
  echo "=== Current biome.json schema ==="
  rg '\$schema' biome.json
  echo ""
  echo "=== Expected: 2.4.16 ==="
  if rg -q '2\.4\.16' biome.json; then
    echo "✓ Schema matches"
  else
    echo "✗ Schema needs update"
  fi
else
  echo "✓ biome.json not found"
fi

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 43, package.json lists "`@biomejs/biome`": "2.4.16" but
biome.json's $schema may not match; open biome.json and ensure the top-level
"$schema" value references the 2.4.16 schema URI (update the version segment to
2.4.16), then save; verify by searching for "$schema" in biome.json and
replacing the version there so it aligns with the dependency declared in
package.json.

---

53-53: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Verify tsdown configs migrated to deps.neverBundle syntax.

Tsdown v0.21.0 deprecated external in favor of deps.neverBundle. Check if packages/reactivity/tsdown.config.ts and packages/convert/tsdown.config.ts need migration.

#!/bin/bash
# Check for deprecated 'external' option in tsdown configs
echo "=== Checking for deprecated 'external' option ==="
fd 'tsdown\.config\.(ts|js)$' --exec rg -Hn '\bexternal\s*:' {} || echo "✓ No deprecated syntax found"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 53, The tsdown configs still use the deprecated
external option; update packages/reactivity/tsdown.config.ts and
packages/convert/tsdown.config.ts to use the new deps.neverBundle syntax instead
of external. Locate the exported config object (e.g. the default export or the
object passed to defineConfig) and replace the external: [...] entry with deps:
{ neverBundle: [...] } preserving the same module list and export shape so
tsdown receives the equivalent values.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

package.json (1)

43-53: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Lockfile is out of sync and currently blocks all CI jobs.

pnpm install --frozen-lockfile is failing because pnpm-lock.yaml still has old specifiers for the dependencies updated on Line 43 through Line 53. Regenerate and commit the lockfile with the pinned package manager version (pnpm@10.34.1) before merge.

Also applies to: 58-58

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 43 - 53, The lockfile is out of sync because
updated dependency specifiers (e.g., "`@biomejs/biome`", "`@types/node`",
"`@vitest/coverage-v8`", "`@xterm/headless`", "cspell", "husky",
"license-checker-rseidelsohn", "lint-staged", "prettier", "sort-package-json",
"tsdown") are not reflected in pnpm-lock.yaml; fix by regenerating the lockfile
with the pinned package manager version: run pnpm install --lockfile-only using
pnpm@10.34.1 (or use pnpm env use 10.34.1 then pnpm install --lockfile-only),
verify pnpm-lock.yaml updates include those specifiers, and commit the updated
pnpm-lock.yaml so CI no longer fails.

package.json (1)

43-58: ⚠️ Potential issue | 🔴 Critical

Regenerate and commit pnpm-lock.yaml for these specifier bumps.

CI is blocked by ERR_PNPM_OUTDATED_LOCKFILE; the manifest updates here are not reflected in the lockfile yet. Run install with the pinned pnpm version and commit the updated lockfile.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 43 - 58, The package manifest was changed but the
lockfile wasn't updated; run the pinned pnpm (packageManager "pnpm@10.34.1") to
regenerate pnpm-lock.yaml (e.g., use pnpm@10.34.1 install), verify no
ERR_PNPM_OUTDATED_LOCKFILE in CI, then add and commit the updated pnpm-lock.yaml
so the specifier bumps in package.json are reflected in the lockfile.

package.json (1)

43-53: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Lockfile is stale; CI is hard-blocked on frozen install.

Lines 43–53 and Line 58 update manifest/tooling pins, but CI fails at pnpm install --frozen-lockfile with ERR_PNPM_OUTDATED_LOCKFILE for these exact specifiers. Regenerate and commit pnpm-lock.yaml using pnpm@10.34.1 to unblock all jobs.

Also applies to: 58-58

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 43 - 53, The package manifest was updated (new
versions for dependencies like "`@biomejs/biome`", "`@types/node`",
"`@vitest/coverage-v8`", "`@xterm/headless`", "cspell", "husky",
"license-checker-rseidelsohn", "lint-staged", "prettier", "sort-package-json",
"tsdown") but the pnpm lockfile is stale causing ERR_PNPM_OUTDATED_LOCKFILE in
CI; regenerate pnpm-lock.yaml locally using pnpm@10.34.1 (run pnpm install with
that version to update the lock), verify the lockfile updated, and commit the
updated pnpm-lock.yaml so CI no longer fails on --frozen-lockfile.

Source: Pipeline failures

package.json (1)

43-53: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Regenerate and commit pnpm-lock.yaml for these specifier bumps.

pnpm install --frozen-lockfile is failing in CI because lockfile specifiers still reflect older versions for the deps changed here. This blocks all downstream jobs.

Also applies to: 58-58

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 43 - 53, The lockfile is out of sync with
package.json bumps; run pnpm install to regenerate pnpm-lock.yaml and commit the
updated pnpm-lock.yaml so CI's pnpm install --frozen-lockfile succeeds;
specifically update the lock to reflect the bumped specifiers (e.g.
"`@biomejs/biome`", "`@types/node`", "`@vitest/coverage-v8`", "`@xterm/headless`",
"cspell", "husky", "license-checker-rseidelsohn", "lint-staged", "prettier",
"sort-package-json", "tsdown"), verify no other dependency changes, and push the
updated pnpm-lock.yaml alongside the package.json changes.

Source: Pipeline failures

package.json (1)

58-61: 🧹 Nitpick | 🔵 Trivial | 💤 Low value

Consider aligning engines.pnpm floor with packageManager pin.

packageManager pins pnpm@10.34.1, but engines.pnpm allows >=10.17.1. Matching them reduces local/CI drift.

Proposed diff

   "engines": {
     "node": ">=22.14.0",
-    "pnpm": ">=10.17.1"
+    "pnpm": ">=10.34.1"
   },

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 58 - 61, The engines.pnpm version floor should be
aligned with the pinned packageManager to avoid local/CI drift: update the
"engines" entry (specifically the "pnpm" key) so its minimum version matches the
pinned packageManager value ("pnpm@10.34.1") by setting "pnpm": ">=10.34.1" (or
exactly "10.34.1" if you prefer strict matching) in package.json; ensure you
modify the existing "engines" object where "pnpm" is declared to reflect the new
constraint.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

package.json (2)

53-53: ⚠️ Potential issue | 🟠 Major | ⚖️ Poor tradeoff

Migrate tsdown configs before merging 0.22.2.

Past review evidence flags deprecated external syntax in:

• packages/reactivity/tsdown.config.ts:7
• packages/convert/tsdown.config.ts:7

Replace external: ['@deepnote/blocks'] with deps: { neverBundle: ['@deepnote/blocks'] } per v0.21.0 breaking change.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 53, Two tsdown config files still use the deprecated
external syntax; open the tsdown.config.ts files for the reactivity and convert
packages and replace the external: ['`@deepnote/blocks`'] entry with the new deps:
{ neverBundle: ['`@deepnote/blocks`'] } shape to conform to tsdown v0.21+; ensure
the updated object key is placed where external was removed and that the
surrounding export/default config (in each tsdown.config.ts) remains valid.

---

43-58: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Lockfile out of sync—all CI jobs blocked.

Pipeline evidence: all 15 jobs fail with ERR_PNPM_OUTDATED_LOCKFILE. Seven dependencies remain mismatched between lockfile and manifest. Run pnpm install using pnpm@10.34.1 and commit the updated pnpm-lock.yaml.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 43 - 58, The lockfile is out of sync with the
manifest: run pnpm install using the declared packageManager version
(pnpm@10.34.1) to regenerate pnpm-lock.yaml so it matches the dependency list
(e.g., entries under the dependencies/devDependencies such as "`@biomejs/biome`",
"typescript", "vitest" etc.), then add and commit the updated pnpm-lock.yaml;
ensure you use the packageManager field value (packageManager: "pnpm@10.34.1")
or the matching pnpm binary to avoid version skew and re-run CI.

package.json (1)

43-58: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Lockfile still out of sync—CI blocked.

All 19 pipeline jobs fail: ERR_PNPM_OUTDATED_LOCKFILE for the 7 updated devDependencies. Run pnpm install with pnpm 10.34.2, commit the updated pnpm-lock.yaml.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 43 - 58, The CI is failing with
ERR_PNPM_OUTDATED_LOCKFILE because the devDependencies in package.json (e.g.,
"`@biomejs/biome`", "`@types/node`", "prettier", "typescript", "vitest", etc.) were
changed but pnpm-lock.yaml wasn’t updated; run pnpm install using the declared
package manager version "pnpm@10.34.2" to regenerate the lockfile, verify no
local pnpm version mismatch, and commit the updated pnpm-lock.yaml so CI can
pass.

package.json (2)

53-53: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Migrate tsdown configs for v0.21.0 breaking change.

tsdown jumped from 0.15.9 to 0.22.2. v0.21.0 deprecated external in favor of deps.neverBundle. Update:

• packages/reactivity/tsdown.config.ts
• packages/convert/tsdown.config.ts

Replace external: ['@deepnote/blocks'] with deps: { neverBundle: ['@deepnote/blocks'] }.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 53, Update the tsdown config objects in
packages/reactivity/tsdown.config.ts and packages/convert/tsdown.config.ts:
locate the existing external: ['`@deepnote/blocks`'] property in the exported
config and replace it with deps: { neverBundle: ['`@deepnote/blocks`'] } so the
config matches tsdown v0.21.0+ expectations; keep the rest of the config object
intact.

---

43-43: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Update biome.json schema to 2.4.16.

@biomejs/biome is now 2.4.16 but biome.json still references the 2.2.7 schema. Update the $schema field to https://biomejs.dev/schemas/2.4.16/schema.json.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 43, Update the biome.json schema version to match the
new `@biomejs/biome` package: open biome.json and change the "$schema" value to
"https://biomejs.dev/schemas/2.4.16/schema.json" so the schema matches the
package version referenced in package.json (ensure the "$schema" key is updated
and saved).

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

package.json (1)

43-53: ⚠️ Potential issue | 🔴 Critical

Lockfile is not synchronized with these specifier bumps (merge blocker).

Lines 43–53 and Line 58 changed manifest specifiers, but CI is currently failing at pnpm install --frozen-lockfile with ERR_PNPM_OUTDATED_LOCKFILE for these exact packages. Regenerate and commit pnpm-lock.yaml using the pinned package manager version (pnpm@10.34.3).

Based on learnings from current CI failure logs and workflow install behavior, this is an active blocker, not a hypothetical risk.

Also applies to: 58-58

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 43 - 53, The package manifest was updated
(specifier bumps for "`@biomejs/biome`", "`@types/node`", "`@vitest/coverage-v8`",
"`@xterm/headless`", "cspell", "husky", "license-checker-rseidelsohn",
"lint-staged", "prettier", "sort-package-json", "tsdown") but the lockfile is
out of sync causing ERR_PNPM_OUTDATED_LOCKFILE in CI; regenerate and commit the
lockfile using the pinned pnpm version by running pnpm@10.34.3 to produce an
updated pnpm-lock.yaml (e.g., with pnpm install using pnpm@10.34.3 on your
machine or CI runner) and commit the updated pnpm-lock.yaml so pnpm install
--frozen-lockfile succeeds.

Source: Pipeline failures

package.json (1)

43-44: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Lockfile is stale relative to these manifest bumps (merge blocker).

pnpm install --frozen-lockfile is failing in CI because pnpm-lock.yaml still contains older specifiers for the dependencies bumped here. Regenerate and commit the lockfile using the pinned toolchain (pnpm@10.34.3).

Also applies to: 47-47, 50-53, 58-58

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 43 - 44, The manifest bump updated dependency
specifiers (e.g., "`@biomejs/biome`": "2.5.0", "`@types/node`": "22.19.21" and the
other bumped entries) but the lockfile is stale; run the pinned toolchain to
regenerate and commit the lockfile by executing pnpm@10.34.3 install
--lockfile-only (or pnpm install --frozen-lockfile after switching to
pnpm@10.34.3) to update pnpm-lock.yaml, verify the lockfile changes include the
new specifiers, and commit the updated pnpm-lock.yaml alongside the package.json
bumps so CI no longer fails.

Source: Pipeline failures

package.json (1)

43-58: ⚠️ Potential issue | 🔴 Critical

Lockfile is out of date; CI is hard-blocked.

pnpm install --frozen-lockfile fails in every workflow because pnpm-lock.yaml specifiers do not match the dependency bumps on Line 43 through Line 58. Regenerate and commit pnpm-lock.yaml using the pinned package manager version (pnpm@10.34.3).

#!/bin/bash
set -euo pipefail

echo "packageManager in manifest:"
python - <<'PY'
import json
p=json.load(open("package.json"))
print(p["packageManager"])
for k in ["`@biomejs/biome`","`@types/node`","`@vitest/coverage-v8`","cspell","lint-staged","prettier","sort-package-json","tsdown","vitest"]:
    print(f"{k}: {p['devDependencies'][k]}")
PY

echo
echo "Checking lockfile for mismatched specifiers in importer section:"
for dep in "`@biomejs/biome`" "`@types/node`" "`@vitest/coverage-v8`" "cspell" "lint-staged" "prettier" "sort-package-json" "tsdown" "vitest"; do
  rg -n --fixed-strings "$dep" pnpm-lock.yaml | head -n 5 || true
done

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 43 - 58, The pnpm-lock.yaml file is out of sync
with the dependency versions specified in package.json (lines 43-58). Regenerate
the lockfile by running pnpm install using the pinned package manager version
specified in the packageManager field (pnpm@10.34.3), then commit the updated
pnpm-lock.yaml file. This will ensure that pnpm install --frozen-lockfile
succeeds in CI workflows by matching the dependency specifiers in the lockfile
with the versions declared in package.json.

Source: Pipeline failures