chore(deps): pin dependencies by Coldaine · Pull Request #64 · MooseGooseConsulting/ColdSearch

Coldaine · 2026-08-14T06:08:08Z

User description

Agent review expected: verify the dependency impact, summarize CI status, and merge only when the update is coherent for this repo.

This PR contains the following updates:

Package	Type	Update	Change
@types/node (source)	devDependencies	pin	`^20.0.0` → `20.19.37`
searxng/searxng		pinDigest	→ `11a9b34`
typescript (source)	devDependencies	pin	`^5.3.0` → `5.9.3`

⚠️ Renovate's pin functionality does not currently wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).

Add the preset :preserveSemverRanges to your config if you don't want to pin your dependencies.

Configuration

📅 Schedule: (in timezone America/Chicago)

Branch creation
- Between 04:00 AM and 08:59 AM, Monday through Friday (* 4-8 * * 1-5)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

CodeAnt-AI Description

Pin development tools and the SearXNG container to fixed versions

What Changed

TypeScript and Node.js type definitions now use fixed versions instead of floating version ranges
SearXNG now runs from a fixed image digest rather than the moving latest tag
Dependency lock data is updated to match the pinned development tool versions

Impact

✅ Reproducible development builds
✅ Consistent SearXNG container deployments
✅ Fewer unexpected dependency changes

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

codeant-ai · 2026-08-14T06:08:13Z

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Incremental review completed	`e680237`	Aug 27, 2026 · 18:10	18:11
✅ Incremental review completed	`da3257a`	Aug 24, 2026 · 10:36	10:36
✅ Incremental review completed	`c45906b`	Aug 21, 2026 · 10:28	10:28
✅ Incremental review completed	`2fab426`	Aug 20, 2026 · 10:27	10:28
✅ Incremental review completed	`17b5098`	Aug 18, 2026 · 10:27	10:27

codeant-ai · 2026-08-14T06:08:13Z

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

Copilot

Pull request overview

This PR pins key development and deployment dependencies to improve reproducibility: TypeScript/@types/node are moved from caret ranges to exact versions, and the SearXNG container is pinned by digest to avoid drifting deployments.

Changes:

Pin @types/node to 20.19.37 and typescript to 5.9.3 in package.json and package-lock.json.
Pin the searxng/searxng container image by digest in docker-compose.yml.

CI status: Not available from this review environment (GitHub API access to workflow/PR status was not permitted), so merge should be contingent on CI being green.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
package.json	Pins dev toolchain versions for deterministic local/CI builds.
package-lock.json	Aligns lockfile with pinned devDependencies to ensure `npm ci` is reproducible.
docker/searxng/docker-compose.yml	Pins SearXNG image by digest for deterministic deployments.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

kilo-code-bot · 2026-08-14T06:35:01Z

Code Review Summary

Status: No Issues Found | Recommendation: Merge

_{Model: step-3.7-flash:free}

Files Reviewed (3 files)

docker/searxng/docker-compose.yml - image pinned by digest; no issues
package-lock.json - lockfile sync; no issues
package.json - dependency pinning; no issues

Previous Review Summaries (7 snapshots, latest commit da3257a)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit `da3257a`)

Status: No Issues Found | Recommendation: Merge

_{Model: step-3.7-flash:free}

Files Reviewed (3 files)

docker/searxng/docker-compose.yml - no new issues in changed lines
package-lock.json - lockfile sync; no issues
package.json - dependency pinning; no issues

Previous review (commit `c45906b`)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 file)

docker/searxng/docker-compose.yml - SHA digest update only; no issues in changed lines

Previous review (commit `2fab426`)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 file)

docker/searxng/docker-compose.yml - SHA digest update only; no issues in changed lines

Previous review (commit `17b5098`)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (3 files)

docker/searxng/docker-compose.yml
package-lock.json
package.json

Previous review (commit `f0ad145`)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 file)

docker/searxng/docker-compose.yml - no new issues in changed lines

Previous review (commit `dee9fba`)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (3 files)

docker/searxng/docker-compose.yml
package-lock.json
package.json

Previous review (commit `e324a34`)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (3 files)

docker/searxng/docker-compose.yml
package-lock.json
package.json

_{Reviewed by step-3.7-flash:free · Input: 49K · Output: 4.6K · Cached: 98.7K}

codeant-ai · 2026-08-17T10:32:15Z

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

cursor · 2026-08-17T10:32:18Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_ce421983-6424-4e26-94b1-68813ed59149)

codeant-ai · 2026-08-18T10:27:09Z

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

codeant-ai · 2026-08-20T10:27:58Z

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

codeant-ai · 2026-08-21T10:28:18Z

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

codeant-ai · 2026-08-24T10:36:08Z

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

Coldaine · 2026-08-27T17:51:34Z

Review

Changes look correct and low-risk: pinning @types/node/typescript to exact versions and pinning the searxng/searxng image by digest in docker-compose.yml. CI is green.

However, this PR cannot merge as-is: branch protection on main requires all review conversations to be resolved, and there is an unresolved review thread from copilot-pull-request-reviewer:

Using :latest@sha256:... is functionally pinned by digest, but the latest tag is redundant and can be misleading for readers and tooling (it still looks like an unpinned tag). Prefer digest-only (or an explicit version tag) to make the pin unambiguous.

This is a valid, minor nit — the pin is functionally correct either way, but dropping the latest tag (leaving just searxng/searxng@sha256:...) would remove the ambiguity and let this merge cleanly. Leaving open for someone to either apply that one-line fix or explicitly resolve/dismiss the thread.

`searxng/searxng:latest@sha256:...` resolves purely by digest — the tag is ignored, so carrying `:latest` alongside it only suggests the image floats when it does not. Addresses the review finding on this PR. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MuDNMH9kcRBvcr853PJA5Z

codeant-ai · 2026-08-27T18:10:29Z

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

Coldaine · 2026-08-27T20:09:20Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Copilot AI lite review requested due to automatic review settings August 14, 2026 06:08

Coldaine added agent-review Needs agent review before merge dependencies Pull requests that update a dependency file labels Aug 14, 2026

Coldaine self-assigned this Aug 14, 2026

codeant-ai Bot added the size:XS This PR changes 0-9 lines, ignoring generated files label Aug 14, 2026

Copilot started reviewing on behalf of Coldaine August 14, 2026 06:08 View session

Copilot AI reviewed Aug 14, 2026

View reviewed changes

Comment thread docker/searxng/docker-compose.yml Outdated

Coldaine force-pushed the renovate/pin-dependencies branch 2 times, most recently from dee9fba to f0ad145 Compare August 17, 2026 10:32

codeant-ai Bot added size:XS This PR changes 0-9 lines, ignoring generated files and removed size:XS This PR changes 0-9 lines, ignoring generated files labels Aug 17, 2026

Coldaine force-pushed the renovate/pin-dependencies branch from f0ad145 to 17b5098 Compare August 18, 2026 10:27

codeant-ai Bot added size:XS This PR changes 0-9 lines, ignoring generated files and removed size:XS This PR changes 0-9 lines, ignoring generated files labels Aug 18, 2026

Coldaine force-pushed the renovate/pin-dependencies branch from 17b5098 to 2fab426 Compare August 20, 2026 10:27

codeant-ai Bot added size:XS This PR changes 0-9 lines, ignoring generated files and removed size:XS This PR changes 0-9 lines, ignoring generated files labels Aug 20, 2026

Coldaine force-pushed the renovate/pin-dependencies branch from 2fab426 to c45906b Compare August 21, 2026 10:28

codeant-ai Bot added size:XS This PR changes 0-9 lines, ignoring generated files and removed size:XS This PR changes 0-9 lines, ignoring generated files labels Aug 21, 2026

chore(deps): pin dependencies

da3257a

Coldaine force-pushed the renovate/pin-dependencies branch from c45906b to da3257a Compare August 24, 2026 10:36

codeant-ai Bot added size:XS This PR changes 0-9 lines, ignoring generated files and removed size:XS This PR changes 0-9 lines, ignoring generated files labels Aug 24, 2026

codeant-ai Bot added size:XS This PR changes 0-9 lines, ignoring generated files and removed size:XS This PR changes 0-9 lines, ignoring generated files labels Aug 27, 2026

Uh oh!

Conversation

Coldaine commented Aug 14, 2026 • edited by codeant-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

Configuration

CodeAnt-AI Description

What Changed

Impact

Checking Your Pull Request

Talking to CodeAnt AI

Example

Preserve Org Learnings with CodeAnt

Example

Retrigger review

Check Your Repository Health

Uh oh!

codeant-ai Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 CodeAnt AI — Review Status

Uh oh!

codeant-ai Bot commented Aug 14, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

kilo-code-bot Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Previous review (commit da3257a)

Previous review (commit c45906b)

Previous review (commit 2fab426)

Previous review (commit 17b5098)

Previous review (commit f0ad145)

Previous review (commit dee9fba)

Previous review (commit e324a34)

Uh oh!

codeant-ai Bot commented Aug 17, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

cursor Bot commented Aug 17, 2026

Bugbot couldn't run - usage limit reached

Uh oh!

codeant-ai Bot commented Aug 18, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

codeant-ai Bot commented Aug 20, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

codeant-ai Bot commented Aug 21, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

codeant-ai Bot commented Aug 24, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

Coldaine commented Aug 27, 2026

Review

Uh oh!

codeant-ai Bot commented Aug 27, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

Coldaine commented Aug 27, 2026

Edited/Blocked Notification

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Coldaine commented Aug 14, 2026 •

edited by codeant-ai Bot

Loading

codeant-ai Bot commented Aug 14, 2026 •

edited

Loading

kilo-code-bot Bot commented Aug 14, 2026 •

edited

Loading

Previous review (commit `da3257a`)

Previous review (commit `c45906b`)

Previous review (commit `2fab426`)

Previous review (commit `17b5098`)

Previous review (commit `f0ad145`)

Previous review (commit `dee9fba`)

Previous review (commit `e324a34`)