build(deps-dev): bump fast-check from 4.7.0 to 4.8.0#2722
Open
dependabot[bot] wants to merge 1 commit into
Open
build(deps-dev): bump fast-check from 4.7.0 to 4.8.0#2722dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [fast-check](https://github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check) from 4.7.0 to 4.8.0. - [Release notes](https://github.com/dubzzz/fast-check/releases) - [Changelog](https://github.com/dubzzz/fast-check/blob/main/packages/fast-check/CHANGELOG.md) - [Commits](https://github.com/dubzzz/fast-check/commits/HEAD/packages/fast-check) --- updated-dependencies: - dependency-name: fast-check dependency-version: 4.8.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
|
Suggested comment for Cursor review (copy and paste as a new comment): Note: GitHub Actions bot cannot trigger Cursor agent directly. Please copy the above comment to invoke the review. |
Contributor
Build Branch
Static preview entry points
QR codes (mobile preview)
Integration commandsnpm (Android / Extension): Swift Package Manager (Apple): .package(url: "https://github.com/duckduckgo/content-scope-scripts.git", branch: "pr-releases/dependabot/npm_and_yarn/main/fast-check-4.8.0")git submodule (Windows): git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/fast-check-4.8.0
git -C submodules/content-scope-scripts checkout origin/pr-releases/dependabot/npm_and_yarn/main/fast-check-4.8.0Pin to exact commitnpm (Android / Extension): Swift Package Manager (Apple): .package(url: "https://github.com/duckduckgo/content-scope-scripts.git", revision: "e44d0b23c664a1b159a8cb2327955d05f58cc181")git submodule (Windows): git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/fast-check-4.8.0
git -C submodules/content-scope-scripts checkout e44d0b23c664a1b159a8cb2327955d05f58cc181 |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Web Compatibility Assessment
No findings. The changed lines are limited to fast-check devDependency metadata in injected/package.json, special-pages/package.json, and package-lock.json; no injected runtime code, API wrapping/shimming, DOM behavior, platform entry points, or remote config behavior changes.
Security Assessment
No findings. This PR does not touch captured-globals.js, messaging transports, message bridge checks, origin validation, iframe handling, network calls, or any page-world executable code. fast-check@4.8.0 remains a dev-only test dependency with the same declared runtime dependency (pure-rand@^8.0.0) and Node engine as 4.7.0.
Risk Level
Low Risk: dependency-only dev/test update with no runtime bundle surface change.
Recommendations
No code changes requested. Validation performed:
npm view fast-check@4.7.0 .../npm view fast-check@4.8.0 ...confirmed unchanged dependency and engine metadata.npm diff --diff=fast-check@4.7.0 --diff=fast-check@4.8.0 --diff-name-onlyconfirmed package changes are limited to fast-check package exports/types/docs metadata.npm run build --workspace=injectedpassed.npm run test-unit --workspace=injectedpassed: 929 specs, 0 failures, 16 pending.npm run test-unit --workspace=special-pagespassed: 104 tests, 0 failures.
Sent by Cursor Automation: Web compat and sec
Contributor
There was a problem hiding this comment.
Dependency risk assessment for fast-check 4.7.0 -> 4.8.0: no blocking concerns found.
Evidence reviewed:
- PR diff only changes the
fast-checkdevDependency ranges ininjected/package.jsonandspecial-pages/package.json, plus the root lockfile entry fornode_modules/fast-check. - Repo usage is test-only:
fast-checkimports are limited to property-based unit tests underinjected/unit-testandspecial-pages/unit-test; I did not find production imports. - Upstream
v4.8.0release notes list one new public arbitrary,chainUntil, plus a TypeScript declaration fix for consumers not usingskipLibCheck; the remaining listed changes are CI/docs/test maintenance. - Published package diff adds
chainUntilexports/definitions and declaration updates, bumps the package version, and updates package dev tooling metadata; existing APIs used here (fc.assert,property,asyncProperty,anything,string,integer,object,dictionary, etc.) are not called out as changed. - Supply-chain checks: npm metadata keeps license
MIT, repodubzzz/fast-check, maintainerndubien, dependency onpure-randunchanged at^8.0.0with the lockfile still resolvingpure-rand@8.0.0.fast-check@4.8.0has an npm registry signature and SLSA provenance attestation;npm audit signaturesverified installed registry signatures. - Validation run with
fast-check@4.8.0: afternpm ci,npm ls fast-check --workspaces --depth=0resolved both workspaces to4.8.0; after building injected artifacts,npm run test-unit --workspace=injectedpassed (929 specs, 0 failures) andnpm run test-unit --workspace=special-pagespassed (104 tests, 0 failures).
Notes:
- The first injected unit-test attempt failed because generated bundle artifacts were absent in the fresh workspace, not because of this dependency update; rerunning after
npm run build --workspace=injectedpassed. npm auditstill reports unrelated existing transitive advisories outsidefast-check/pure-rand; I did not treat those as introduced by this PR.- No separate fix PR was drafted because I did not identify a repo change needed for this dependency update.
Sent by Cursor Automation: Review dependabot
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps fast-check from 4.7.0 to 4.8.0.
Release notes
Sourced from fast-check's releases.
Changelog
Sourced from fast-check's changelog.
Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Dev-only test dependency bump with no production or test code edits; risk is limited to property-based unit test behavior if upstream introduced subtle breaking changes.
Overview
Bumps the fast-check dev dependency from 4.7.0 to 4.8.0 in
injected/package.json,special-pages/package.json, and the root lockfile. No application or test source changes—only version pins and resolved package metadata.Upstream 4.8.0 adds a
chainUntilarbitrary and fixes TypeScript usage withoutskipLibCheck; existing tests that importfcfor property-based checks should behave the same unless you adopt the new API.Reviewed by Cursor Bugbot for commit ebcc741. Bugbot is set up for automated code reviews on this repo. Configure here.