chore(deps): batch trivial dependency updates (2026-09) by jamesbhobbs · Pull Request #511 · deepnote/vscode-deepnote

jamesbhobbs · 2026-09-10T12:03:50Z

Summary

Batch-applies the open Renovate/Dependabot updates that need no substantive source
changes, re-derived on top of current main (the perf-fixture bot PRs were opened
against the pre-#497 lockfile) and verified locally against the full CI suite. Each
update was triaged individually rather than per-PR, so mixed group PRs are split.
Same approach as #474.

Included updates

Root (`package.json` / `package-lock.json`)

Dependency	Change	Source PR
`oxlint`	`1.77.0` → `1.81.0`	#289 (partial)
`dompurify` (override)	`3.4.13` → `3.4.15`	#479
`@jupyter-widgets/base`	`6.0.11` → `6.0.12` (lockfile only)	#477
`@jupyter-widgets/controls`	`5.0.12` → `5.0.13` (lockfile only)	#478
`@types/*` (lockfile only, 25 packages)	`chai-arrays` 2.0.3, `chai-as-promised` 7.1.8, `cors` 2.8.19, `debug` 4.1.13, `dedent` 0.7.2, `del` 4.0.3, `format-util` 1.0.4, `glob` 5.0.38, `json2csv` 5.0.7, `loadable__component` 5.13.10, `lodash` 4.17.25, `node-fetch` 2.6.13, `promisify-node` 0.4.3, `react-dom` 16.9.25, `react-redux` 7.1.34, `react-virtualized` 9.22.3, `redux-logger` 3.0.13, `sinon` 10.0.20, `strip-comments` 2.0.4, `svg-to-pdfkit` 0.1.4, `tcp-port-used` 1.0.4, `tmp` 0.2.6, `url-parse` 1.4.11, `vscode-notebook-renderer` 1.72.4	#288 (partial)

Perf fixture (`src/test/vscode-notebook-perf/`)

Dependency	Change	Source PR
`@vscode/test-cli`	`^0.0.8` → `^0.0.15`	#505, #289 (partial)
`glob`	`^7.1.2` → `^13.0.6`	#507

Neither package is imported by the fixture's two source files (src/api.ts,
src/extension.ts), so the glob major has no API surface to break; npm install
and npm run compile both succeed.

Test venv requirements (`build/venv-test-ipywidgets8-requirements.txt`)

Requirement	Change	Source PR
`pillow`	`>=10.2.0` → `>=12.3.0`	#500
`zipp`	`>=3.19.1` → `>=4.1.0`	#501
`jupyter-server`	`>=2.14.1` → `>=2.21.0`	#503
`tornado`	`>=6.5` → `>=6.5.8`	#506
`urllib3`	`>=2.2.2` → `>=2.7.0`	#508

No workflow in .github/workflows/ currently installs this file (the only Python
setup is in e2e.yml, which runs npm ci only), so it cannot break CI. Resolution
was verified locally instead: uv pip compile --python-version 3.12 resolves both
the current and the bumped file, and each bumped lower bound is the current latest
release.

Supporting changes

Fixture overrides gains mocha → diff 5.2.2, copied from the root
package.json. @vscode/test-cli 0.0.15 nests mocha 11.8.0, which depends on
diff ^7.0.0; diff@7.0.0 is vulnerable to GHSA-73rr-hh4g-fpgx and the
qlty check --all --filter=osv-scanner gate that fix(ci): refresh perf-fixture lockfile and gate it with osv-scanner #497 turned on fails on it
(verified: 1 medium finding without the override, No issues with it). This is
the same mechanism fix(ci): refresh perf-fixture lockfile and gate it with osv-scanner #497 used for serialize-javascript.
The fixture lockfile grows by the nested mocha 11.8 / c8 11 / yargs 18 tree
under @vscode/test-cli. This matches what chore(deps-dev): bump @vscode/test-cli from 0.0.8 to 0.0.15 in /src/test/vscode-notebook-perf #505 itself produces; the top-level
mocha stays at 10.8.2.
Root lockfile was re-resolved only for the targeted packages (npm install for
the two package.json edits, npm update <pkg>... for the lockfile-only bumps),
not blanket-regenerated. typescript stays at 5.8.3, @types/node at 22.15.31.

Excluded (needs its own PR)

Dependency	Reason	Source PR
`mocha` `11.0.1` → `11.8.0`	Deliberately pinned to `11.0.1` — 11.8 loads the `--require` bootstrap as ESM and kills the unit suite (see #474).	#289 (partial)
`@types/node` `22.15.31` → `22.20.x`	Verified locally: 3 errors in `src/platform/common/process/proc.node.ts` (`NonSharedBuffer` not assignable to `string`). Needs source changes.	#288 (partial)
`@types/chai` `4.3.6` → `4.3.20`	Verified locally: `assert.isOk<T>` in `src/test/datascience/notebook/helper.ts` now `TS2558` (no type args), and an assertion-narrowing change makes `federatedAuthSqlBlockCodeGenerator.node.unit.test.ts:348` a `never`. Needs source changes.	#288 (partial)
fixture `@types/node` `18.19.130` → `26.4.1`	Major; Node 26 typings while `.nvmrc` is 22.	#504
fixture `mocha` `10.8.2` → `12.0.0`	Major.	#502
fixture `typescript` `5.9.3` → `7.0.2`	Major (TypeScript 7 native compiler).	#499
`uuid` `13.0.2` → `14.0.0`	Major, runtime dependency.	#391
Node.js 22 → 24 (`.nvmrc`)	Runtime/environment change, drives lockfile drift via a different bundled npm (see #474).	#285
`@nteract/transform-vega` → `7.0.10`	Per #474 it pulls `@blueprintjs/core` 3.54 and fails both audit jobs; not re-verified here.	#281
`react-svgmt` `1.1.11` → `1.2.0`	`ERESOLVE`: peer `react@^17`, repo is on `react@16`.	#268

Supersedes

Renovate and Dependabot close their own PRs automatically once the dependency is at
the target version on main, so after this merges these should close on their own:

Already satisfied by main before this PR and closed separately: #417
(@vscode/extension-telemetry 1.5.2 via #469), #494 (fixture nested glob 10.5.0
via #497), #495 (js-yaml 4.3.2 via #498), #496 (morgan 1.12.0 via #498).

Verification

Run locally in a worktree on Node 22.21.1 / npm 10.9.4. Root install used
npm ci --ignore-scripts + npm run postinstall because zeromqold (zeromq
6.0.0-beta.6) has no darwin-arm64 prebuild and this machine has no cmake; that is
a local-environment limitation unrelated to anything in this PR.

Check	Result
`tsc -p ./` (`compile-tsc`)	pass (0 errors)
`npm run typecheck`	pass
`npm run test:unittests`	2771 passing, 234 pending, 0 failing
`npm run lint`	pass (27 `no-unused-vars` warnings — identical count under oxlint 1.77.0 and 1.81.0)
`npm run format`	pass
`npm run spell-check`	pass (172 files, 0 issues)
`npm run check-licenses`	pass
`npm audit --omit=dev`	0 vulnerabilities
`npx tsx build/esbuild/build.ts`	pass
`npm install --package-lock-only` idempotency (drift check)	pass — lockfile byte-identical
fixture `npm install` + `npm run compile`	pass
fixture `npm audit`	0 vulnerabilities
`qlty check --all --filter=osv-scanner` (qlty 0.643.0)	`No issues`
`uv pip compile --python-version 3.12 build/venv-test-ipywidgets8-requirements.txt`	resolves

npm audit (including dev) still reports the same 5 low-severity findings as main
(elliptic via browserify-sign/create-ecdh/crypto-browserify/node-stdlib-browser);
those are not introduced here.

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Updated development and test tooling to newer versions.
- Refreshed pinned transitive packages used by the ipywidgets 8 test environment.
- Updated notebook performance test tooling while retaining required compatibility pins.

Root: oxlint 1.81.0, dompurify override 3.4.15, @jupyter-widgets/base 6.0.12 and controls 5.0.13 (lockfile only), and the DefinitelyTyped group minus @types/node and @types/chai (lockfile only). Perf fixture: @vscode/test-cli ^0.0.15 and glob ^13.0.6, plus a mocha->diff 5.2.2 override copied from the root package.json so the nested mocha 11.8 does not reintroduce diff@7.0.0 (GHSA-73rr-hh4g-fpgx) under the qlty osv-scanner gate. Test venv requirements: raise pillow, zipp, tornado, jupyter-server and urllib3 lower bounds to the dependabot targets. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

coderabbitai · 2026-09-10T12:03:59Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: fdf02f1a-9431-46ac-ba10-4e659ab02691

📥 Commits

Reviewing files that changed from the base of the PR and between 2361da9 and a4be686.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

package.json

Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📝 Walkthrough

Walkthrough

Updated pinned versions for five ipywidgets 8 test dependencies. Updated oxlint and the dompurify override. Moved zeromqold to optional dependencies. Updated VS Code notebook performance test dependencies and added an npm override for mocha version 5.2.2.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: tkislan

Merge Risk: ⚪ Minimal · up to a4be6

The reviewed dependency changes show no established current-head correctness, security, or availability risk.

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the batch dependency updates across the pull request and includes the relevant date. It is concise and related to the main changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Updates Docs	✅ Passed	PASS — The pull request changes only dependency requirements, package manifests, overrides, and lockfiles. It does not implement a feature, so the documentation-update condition does not apply. No doc…

_{Comment @coderabbitai help to get the list of available commands.}

codecov · 2026-09-10T12:06:55Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 37%. Comparing base (f26120f) to head (a4be686).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@          Coverage Diff          @@
##            main    #511   +/-   ##
=====================================
  Coverage     37%     37%           
=====================================
  Files        828     828           
  Lines      41679   41679           
  Branches    9136    9136           
=====================================
  Hits       15449   15449           
  Misses     24116   24116           
  Partials    2114    2114

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

jamesbhobbs · 2026-09-10T12:22:07Z

@coderabbitai please re-review this PR

coderabbitai · 2026-09-10T12:22:26Z

@jamesbhobbs I will re-review this PR.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

jamesbhobbs · 2026-09-10T12:26:06Z

@coderabbitai please re-review this PR

coderabbitai · 2026-09-10T12:26:22Z

@jamesbhobbs I will run a full re-review of this PR.

✅ Action performed

Full review finished.

jamesbhobbs marked this pull request as ready for review September 10, 2026 12:08

jamesbhobbs requested a review from a team as a code owner September 10, 2026 12:08

coderabbitai Bot approved these changes Sep 10, 2026

View reviewed changes

Merge branch 'main' into chore/deps-batch-2026-09

a4be686

dinohamzic approved these changes Sep 14, 2026

View reviewed changes

dinohamzic merged commit 584935c into main Sep 14, 2026
20 checks passed

dinohamzic deleted the chore/deps-batch-2026-09 branch September 14, 2026 07:21

This was referenced Sep 14, 2026

chore(deps): update urllib3 requirement from >=2.2.2 to >=2.7.0 #508

Closed

chore(deps-dev): bump glob from 7.2.3 to 13.0.6 in /src/test/vscode-notebook-perf #507

Closed

chore(deps): update tornado requirement from >=6.5 to >=6.5.8 #506

Closed

Navigation Menu

chore(deps): batch trivial dependency updates (2026-09) - #511

chore(deps): batch trivial dependency updates (2026-09)#511
dinohamzic merged 2 commits into
mainfrom
chore/deps-batch-2026-09

jamesbhobbs commented Sep 10, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Sep 10, 2026 •

edited

Loading

Walkthrough

Uh oh!

codecov Bot commented Sep 10, 2026 •

edited

Loading

Uh oh!

jamesbhobbs commented Sep 10, 2026

Uh oh!

coderabbitai Bot commented Sep 10, 2026 •

edited

Loading

Uh oh!

jamesbhobbs commented Sep 10, 2026

Uh oh!

coderabbitai Bot commented Sep 10, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

jamesbhobbs commented Sep 10, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Included updates

Root (package.json / package-lock.json)

Perf fixture (src/test/vscode-notebook-perf/)

Test venv requirements (build/venv-test-ipywidgets8-requirements.txt)

Supporting changes

Excluded (needs its own PR)

Supersedes

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

codecov Bot commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

jamesbhobbs commented Sep 10, 2026

Uh oh!

coderabbitai Bot commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jamesbhobbs commented Sep 10, 2026

Uh oh!

coderabbitai Bot commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jamesbhobbs commented Sep 10, 2026 •

edited by coderabbitai Bot

Loading

Root (`package.json` / `package-lock.json`)

Perf fixture (`src/test/vscode-notebook-perf/`)

Test venv requirements (`build/venv-test-ipywidgets8-requirements.txt`)

coderabbitai Bot commented Sep 10, 2026 •

edited

Loading

codecov Bot commented Sep 10, 2026 •

edited

Loading

coderabbitai Bot commented Sep 10, 2026 •

edited

Loading

coderabbitai Bot commented Sep 10, 2026 •

edited

Loading