Skip to content

deps(ts): bump prettier from 3.8.3 to 3.9.6 in /frontend - #134

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/prettier-3.9.6
Closed

deps(ts): bump prettier from 3.8.3 to 3.9.6 in /frontend#134
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/prettier-3.9.6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 15, 2026

Copy link
Copy Markdown
Contributor

Bumps prettier from 3.8.3 to 3.9.6.

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

🔗 Changelog

3.9.5

🔗 Changelog

3.9.4

  • Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

🔗 Changelog

3.9.1

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

🔗 Changelog

3.8.4

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}

TypeScript: Support import defer (#19624, #19675 by @​fisker)

// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:

  1. Install the plugin:

    yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.8.3...3.9.6)

---
updated-dependencies:
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Aug 15, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, typescript. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@pacphi

pacphi commented Aug 15, 2026

Copy link
Copy Markdown
Owner

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@pacphi

pacphi commented Aug 25, 2026

Copy link
Copy Markdown
Owner

Superseded by #138, which consolidates this bump (latest-compatible) along with the other open PRs into a single branch. Closing in favor of #138.

@pacphi pacphi closed this Aug 25, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 25, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/frontend/prettier-3.9.6 branch August 25, 2026 16:10
pacphi added a commit that referenced this pull request Aug 25, 2026
* chore(deps): consolidate PRs #128-137, fix h2/lru advisories

Consolidates 8 of the 11 open Dependabot PRs into a single branch:

- deps(rust): serde_json 1.0.150 -> 1.0.151 (#128)
- deps(rust): calamine 0.36.0 -> 0.36.1 (#131)
- deps(rust): http-body-util 0.1.4 -> 0.1.5 (#132)
- deps(ts): js-yaml 5.2.2 -> 5.2.3 (#130)
- deps(ts): vite 8.0.16 -> 8.2.1 (#133)
- deps(ts): prettier 3.8.3 -> 3.9.6 (#134)
- deps(ts): recharts 3.8.1 -> 3.10.1 (#135)
- deps(actions): taiki-e/install-action 2.85.8 -> 2.86.3 (#137)

Deferred (left open, not applied):
- #116/#126 (candle-core/candle-transformers 0.10.2 -> 0.11.0): still
  blocked on a mistralrs release supporting candle 0.11 (mistralrs is
  still pinned at 0.8.1); would create duplicate candle-core/candle-nn
  builds, same as previously deferred in #127.
- #136 (@tanstack/react-table 8.21.3 -> 9.1.2): 8.21.3 is still the
  latest 8.x release, so this is a major-version rewrite, not a patch
  bump — same situation as previously-deferred #119.

Pre-existing/upgrade-caused fixes:
- Prettier 3.9 changed union-type-alias wrapping ("don't break union
  type when it can fit"), which flipped two already-passing files to
  fail the format-check gate. Reformatted with `prettier --write`
  (RecurringPage.tsx, models.ts) — no logic changes.

Security audit (cargo audit / pnpm audit / GitHub Dependabot alerts):
- RUSTSEC-2026-0258 (h2 0.4.14, unbounded empty DATA frames DoS):
  fixed by bumping h2 to 0.4.16 (in-range lockfile-only update via
  aws-smithy-http-client/hyper's transitive dependency).
- RUSTSEC-2026-0253 (lru 0.16.4, use-after-free risk in
  LruCache::pop() under panic): no fix available — aws-sdk-s3 (latest
  1.143.0 checked) still hard-pins `lru = "^0.16.3"`; the fix requires
  lru 0.18, a semver-major bump upstream hasn't adopted. Documented
  and ignored in audit-ignore / .cargo/audit.toml pending an
  aws-sdk-s3 release.
- RUSTSEC-2026-0235 (rkyv 0.7.46, pre-existing ignore): also added to
  .cargo/audit.toml, which was missing it despite audit-ignore already
  covering it — brings the two files back in sync.
- pnpm audit: no known vulnerabilities.
- GitHub Dependabot alerts: 0 open.

Verification (mirrors CI exactly):
- Frontend: pnpm install --frozen-lockfile, lint, tsc --noEmit,
  prettier --check, vitest --run, build — all pass.
- Backend: cargo fmt --all --check, cargo clippy --workspace
  --all-targets -- -D warnings, cargo test --workspace (incl. DB
  integration tests via docker-compose.test.yml) — all pass.
- Security: bash .github/scripts/cargo-audit.sh (CI's exact gate) —
  passes with 9 documented exceptions.

* fix(api): box large S3 SdkError variants to satisfy clippy::result_large_err

CI's floating `dtolnay/rust-toolchain@stable` action advanced to a newer
Rust/clippy since the last green run on main, and the newer clippy now
flags StorageError's Err variants (392-432 bytes, dominated by
aws_sdk_s3::error::SdkError) under result_large_err. Box each SdkError
source field to shrink the enum; no behavior change.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant