Skip to content

chore(deps): bump fast-check from 3.23.2 to 4.9.0 in /packages/core#99

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/packages/core/fast-check-4.9.0
Closed

chore(deps): bump fast-check from 3.23.2 to 4.9.0 in /packages/core#99
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/packages/core/fast-check-4.9.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps fast-check from 3.23.2 to 4.9.0.

Release notes

Sourced from fast-check's releases.

Shrinkable entityGraph and few performance chips

[Code][Diff]

Features

  • (PR#7008) Towards shrinkable entityGraph thanks to chainUntil

Fixes

  • (PR#7010) Bug: Fix latent state-sharing bug in entityGraph
  • (PR#7063) Bug: Equiprobable alternatives in stringMatching
  • (PR#6973) CI: Drop caches on push for build package flow
  • (PR#6971) CI: Only mark fast-check's releases as latest
  • (PR#6974) CI: Drop pull_request_target flows
  • (PR#6975) CI: Drop discussion creation on release publish
  • (PR#6976) CI: Drop caches from publication steps
  • (PR#6977) CI: Revert "Drop caches from publication steps"
  • (PR#6978) CI: Make zizmor audit a required status check
  • (PR#6991) CI: Remove Claude Code workflow
  • (PR#6994) CI: Replace pnpm dlx with pnpm exec for pkg-pr-new
  • (PR#6995) CI: Inline zizmor ignores in workflow
  • (PR#6996) CI: Move to devEngines.packageManager
  • (PR#7005) CI: Update PULL_REQUEST_TEMPLATE.md
  • (PR#7011) CI: Drop OTP prompt from npm publish
  • (PR#7013) CI: Switch release jobs to npm stage publish
  • (PR#7027) CI: Run benchmarks against main
  • (PR#7037) CI: Use comparison mode for bench
  • (PR#7069) CI: Run pnpm dedupe to deduplicate lockfile
  • (PR#6959) CI: Announce releases on Bluesky
  • (PR#7105) CI: Switch to actions/attest for attestations
  • (PR#7117) CI: Use pnpm version in changelog script
  • (PR#7120) CI: Allow unclean tree in changelog generation
  • (PR#7125) CI: Stage publish using pnpm in publish jobs
  • (PR#7065) Clean: Delete skills directory
  • (PR#6983) Doc: Tweak PR Template to hint AI agents into revealing themselves
  • (PR#7092) Doc: Add back skills directory
  • (PR#7095) Doc: Add release notes for fast-check 4.8.0
  • (PR#7104) Doc: Add makeeno as doc contributor
  • (PR#7103) Doc: Fix info box in docs
  • (PR#7108) Doc: Add jneidel as doc contributor
  • (PR#7035) Performance: Faster fc.integer on generate
  • (PR#7046) Performance: Faster fc.record on generate
  • (PR#7047) Performance: Faster fc.dictionary on generate
  • (PR#7048) Performance: Faster fc.webPath/fc.webUrl on generate
  • (PR#7050) Performance: Faster fc.stringMatching for \W \D \S .
  • (PR#7054) Performance: Faster fc.stringMatching on generate
  • (PR#7049) Performance: Drop nested tuple on generate for fc.record
  • (PR#7045) Performance: Faster fc.entityGraph on generate
  • (PR#7071) Performance: Early exit on empty tuple in fc.entityGraph

... (truncated)

Changelog

Sourced from fast-check's changelog.

4.9.0

Shrinkable entityGraph and few performance chips [Code][Diff]

Features

  • (PR#7008) Towards shrinkable entityGraph thanks to chainUntil

Fixes

  • (PR#7010) Bug: Fix latent state-sharing bug in entityGraph
  • (PR#7063) Bug: Equiprobable alternatives in stringMatching
  • (PR#6973) CI: Drop caches on push for build package flow
  • (PR#6971) CI: Only mark fast-check's releases as latest
  • (PR#6974) CI: Drop pull_request_target flows
  • (PR#6975) CI: Drop discussion creation on release publish
  • (PR#6976) CI: Drop caches from publication steps
  • (PR#6977) CI: Revert "Drop caches from publication steps"
  • (PR#6978) CI: Make zizmor audit a required status check
  • (PR#6991) CI: Remove Claude Code workflow
  • (PR#6994) CI: Replace pnpm dlx with pnpm exec for pkg-pr-new
  • (PR#6995) CI: Inline zizmor ignores in workflow
  • (PR#6996) CI: Move to devEngines.packageManager
  • (PR#7005) CI: Update PULL_REQUEST_TEMPLATE.md
  • (PR#7011) CI: Drop OTP prompt from npm publish
  • (PR#7013) CI: Switch release jobs to npm stage publish
  • (PR#7027) CI: Run benchmarks against main
  • (PR#7037) CI: Use comparison mode for bench
  • (PR#7069) CI: Run pnpm dedupe to deduplicate lockfile
  • (PR#6959) CI: Announce releases on Bluesky
  • (PR#7105) CI: Switch to actions/attest for attestations
  • (PR#7117) CI: Use pnpm version in changelog script
  • (PR#7120) CI: Allow unclean tree in changelog generation
  • (PR#7125) CI: Stage publish using pnpm in publish jobs
  • (PR#7065) Clean: Delete skills directory
  • (PR#6983) Doc: Tweak PR Template to hint AI agents into revealing themselves
  • (PR#7092) Doc: Add back skills directory
  • (PR#7095) Doc: Add release notes for fast-check 4.8.0
  • (PR#7104) Doc: Add makeeno as doc contributor
  • (PR#7103) Doc: Fix info box in docs
  • (PR#7108) Doc: Add jneidel as doc contributor
  • (PR#7035) Performance: Faster fc.integer on generate
  • (PR#7046) Performance: Faster fc.record on generate
  • (PR#7047) Performance: Faster fc.dictionary on generate
  • (PR#7048) Performance: Faster fc.webPath/fc.webUrl on generate
  • (PR#7050) Performance: Faster fc.stringMatching for \W \D \S .
  • (PR#7054) Performance: Faster fc.stringMatching on generate
  • (PR#7049) Performance: Drop nested tuple on generate for fc.record
  • (PR#7045) Performance: Faster fc.entityGraph on generate

... (truncated)

Commits
  • 0d3c254 🔖 Update CHANGELOG.md for fast-check@4.9.0, @​fast-check/packaged@​0.7.1 (#7124)
  • bd85efe ⬆️ Update dependency @​types/node to ^24.13.3 (#7118)
  • a0596ab ⬆️ Update dependency vitest to ^4.1.10 (#7119)
  • 3c085da ⬆️ Update dependency prettier to v3.9.4 (#7114)
  • 6538ff0 👥 Add jneidel as doc contributor (#7108)
  • 8096ab0 👥 Add makeeno as doc contributor (#7104)
  • 13fd4a6 ✏️ Typo in type EntityGraphContraints (#7088)
  • 36e70d2 ⬆️ Update dependency @​microsoft/api-extractor to ^7.58.9 (#7080)
  • 451ede0 ⬆️ Update dependency vitest to ^4.1.8 (#7074)
  • 949564d ⚡️ Early exit on empty tuple in fc.entityGraph (#7071)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-check since your current version.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 14, 2026
@agjs agjs mentioned this pull request Jul 16, 2026
Merged
agjs added a commit that referenced this pull request Jul 16, 2026
@agjs
chore(deps): batch ready dependabot bumps (skip TS7/fast-check4) (#101)
2357a77 
Consolidates the dependabot PRs that are ready today. Applied surgically
(per-package bun update, preserving the lockfile) so untouched deps don't float.

GitHub Actions (#84-88): checkout v7.0.0, setup-node v7.0.0, cache v6.1.0,
  paths-filter v4.0.2, action-gh-release v3.0.2.
npm: globals 17.7.0 (#95); docs: @astrojs/starlight 0.41.3 (#91),
  @tailwindcss/vite 4.3.2 (#96), astro 7.0.9 (#92), mermaid 11.16.0 (#90),
  sharp 0.35.3 (#97), tailwindcss 4.3.2 (#98), wrangler 4.110.0 (#94).

Verified: full `bun run validate` green + docs `astro build` green (47 pages).

SKIPPED (need their own migration PRs, not ready with our TS6 toolchain):
- #89 dev-toolchain group: contains TypeScript 6->7 (no stable programmatic API
  until 7.1; breaks proptest + typescript-eslint) and TS7-built sonarjs/eslint.
- #93/#99 fast-check 4: breaks the proptest oracle (generation timing).
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/packages/core/fast-check-4.9.0 branch 2 times, most recently from fcc8866 to 31302d1 Compare July 16, 2026 12:35
@dependabot
chore(deps): bump fast-check from 3.23.2 to 4.9.0 in /packages/core
592e11d 
Bumps [fast-check](https://github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check) from 3.23.2 to 4.9.0.
- [Release notes](https://github.com/dubzzz/fast-check/releases)
- [Changelog](https://github.com/dubzzz/fast-check/blob/main/packages/fast-check/CHANGELOG.md)
- [Commits](https://github.com/dubzzz/fast-check/commits/v4.9.0/packages/fast-check)

---
updated-dependencies:
- dependency-name: fast-check
  dependency-version: 4.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/packages/core/fast-check-4.9.0 branch from 31302d1 to 592e11d Compare July 17, 2026 20:20
agjs added a commit that referenced this pull request Jul 20, 2026
@agjs
chore(deps): consolidate the 14 dependabot bumps (#164)
b7f8bfa 
* chore(deps): consolidate the 14 open dependabot bumps

Single PR superseding the open dependabot PRs:
- fast-check 3.23.2 → 4.9.0 (packages/core) — full suite green on v4 (#93/#99)
- astro 7.0.9 → 7.1.3 (root + apps/docs) — clears GHSA-4g3v-8h47-v7g6 (#158/#162)
- @astrojs/react 5.0.6 → 6.0.1 (#114), @astrojs/sitemap 3.7.2 → 3.7.3 (#116)
- astro-mermaid 2.0.1 → 2.1.0 (#119)
- tailwindcss + @tailwindcss/vite 4.3.2 → 4.3.3 (#115/#117)
- wrangler 4.110.0/4.111.0 → 4.112.0 (#161), @ast-grep/cli 0.43.0 → 0.44.1 (#118)

Validated: typecheck + lint + full suite (2820) green. Docs build + osv run by CI.
NOTE: the transitive brace-expansion CVE (not a dependabot PR) is separate and may
still need an override; GH Actions bumps (#160 checkout, #112 lychee) are workflow
YAML, follow-up.

* fix(deps): pin brace-expansion to patched 5.0.7 (CVE-2026-13149)

New high-severity ReDoS advisory CVE-2026-13149 / GHSA-3jxr-9vmj-r5cp (published
~2026-07-20 21:00) affects brace-expansion <1.1.16 / <2.1.2 / <5.0.7. The lockfile
had 1.1.15 and 5.0.6 (transitive via eslint→minimatch/glob — a real runtime dep of
the published package, so it is FIXED, not ignored). Override forces all instances
to 5.0.7 (patched; API is a single stable expand() fn across majors). typecheck +
lint (uses minimatch/glob) + full suite green.

* fix(deps): pin js-yaml to patched 4.3.0 (GHSA-52cp-r559-cp3m)

The astro/tooling bumps pulled js-yaml 4.2.0 (High ReDoS, GHSA-52cp-r559-cp3m,
fixed 4.3.0). Transitive, 4.x only (no 3.x consumers) → override to 4.3.0.
osv-scanner local run: 'No issues found', exit 0. typecheck + lint + full suite green.
@agjs

agjs commented Jul 20, 2026

Copy link
Copy Markdown
Owner

Superseded by #164 (consolidated dependabot bumps), merged to main.

@agjs agjs closed this Jul 20, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/packages/core/fast-check-4.9.0 branch July 20, 2026 22:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@agjs