Skip to content

chore: Dependency updates (c8 v11, soundcraft v5, openai, posthog)#268

Open
htilly wants to merge 2 commits intomasterfrom
develop
Open

chore: Dependency updates (c8 v11, soundcraft v5, openai, posthog)#268
htilly wants to merge 2 commits intomasterfrom
develop

Conversation

@htilly
Copy link
Owner

@htilly htilly commented Mar 4, 2026

Summary

Updates multiple dependencies including two major version bumps.

Dependency Updates

  • minimatch: 9.0.5 → 9.0.9
  • c8: 10.1.3 → 11.0.0 (major)
  • openai: 6.22.0 → 6.25.0
  • posthog-node: 5.24.15 → 5.26.2
  • soundcraft-ui-connection: 4.1.1 → 5.0.0 (major)
  • @simplewebauthn/server: 13.2.2 → 13.2.3

Testing

  • ✅ Docker Compose startup test passed
  • ✅ All 553 unit tests passing
  • ✅ Slack & Discord connections verified

Made with Cursor

- minimatch: 9.0.5 → 9.0.9
- c8: 10.1.3 → 11.0.0 (major)
- openai: 6.22.0 → 6.25.0
- posthog-node: 5.24.15 → 5.26.2
- soundcraft-ui-connection: 4.1.1 → 5.0.0 (major)
- @simplewebauthn/server: 13.2.2 → 13.2.3

Closes #262, #263, #265, #266, #267

Made-with: Cursor
@cursor
Copy link

cursor bot commented Mar 4, 2026

You have run out of free Bugbot PR reviews for this billing cycle. This will reset on April 11.

To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

Copilot AI review requested due to automatic review settings March 4, 2026 08:23
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates several npm dependencies (including major bumps) to keep SlackONOS’s tooling and integrations current, primarily affecting coverage tooling (c8) and the Soundcraft mixer integration (soundcraft-ui-connection).

Changes:

  • Bump c8 to v11 (major) and refresh its transitive deps (e.g., test-exclude, glob, minimatch).
  • Bump soundcraft-ui-connection to v5 (major) and refresh lockfile accordingly.
  • Update lockfile-resolved versions for openai, posthog-node, @simplewebauthn/server, and others.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

File Description
package.json Updates c8 (major) and soundcraft-ui-connection (major) version ranges.
package-lock.json Updates resolved versions/metadata for the bumped deps and their transitive dependency graph.

Comment on lines 51 to 53
"sonos": "^1.14.2",
"soundcraft-ui-connection": "^4.1.1",
"soundcraft-ui-connection": "^5.0.0",
"urlencode": "^2.0.0",
Copy link

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

soundcraft-ui-connection@^5.0.0 declares engines.node >=22 (see lockfile), but the project package.json still advertises engines.node >=17 and CI currently runs tests on Node 20. Since index.js requires the Soundcraft handler at startup, this dependency bump effectively raises the minimum supported Node version and may break installs/runs on Node <22. Please either bump the project's Node engine (and align CI/Docker/docs), or keep soundcraft-ui-connection on v4 / make the Soundcraft integration an optional/conditional dependency so the app can still run on older Node versions.

Copilot uses AI. Check for mistakes.
Comment on lines 28 to 31
"devDependencies": {
"c8": "^10.1.3",
"c8": "^11.0.0",
"chai": "6.2.2",
"mocha": "^11.7.5",
Copy link

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

c8@^11.0.0 requires Node 20 || >=22 (per its published engines). With package.json currently declaring engines.node >=17, developers may try running coverage on unsupported Node versions and hit install/runtime issues. Consider updating the project's Node engine range to match the strictest dependency requirement.

Copilot uses AI. Check for mistakes.
- Override serialize-javascript, undici, diff, ip to patched versions
- Add docs/SECURITY.md (overrides + known npm audit false positive for ip/sonos)
- Link to SECURITY.md from README

Made-with: Cursor
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants