deps(npm): bump the mui group across 1 directory with 2 updates#8820
Open
dependabot[bot] wants to merge 26 commits into
Open
deps(npm): bump the mui group across 1 directory with 2 updates#8820dependabot[bot] wants to merge 26 commits into
dependabot[bot] wants to merge 26 commits into
Conversation
dependabot
Bot
added
dependencies
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/app/mui-552f835451
branch
from
June 22, 2026 20:15
a26525d to
ef40b8b
Compare
Bumps the mui group with 2 updates in the /app directory: [@mui/icons-material](https://github.com/mui/material-ui/tree/HEAD/packages/mui-icons-material) and [@mui/material](https://github.com/mui/material-ui/tree/HEAD/packages/mui-material). Updates `@mui/icons-material` from 9.1.0 to 9.1.1 - [Release notes](https://github.com/mui/material-ui/releases) - [Changelog](https://github.com/mui/material-ui/blob/master/CHANGELOG.md) - [Commits](https://github.com/mui/material-ui/commits/v9.1.1/packages/mui-icons-material) Updates `@mui/material` from 9.1.0 to 9.1.2 - [Release notes](https://github.com/mui/material-ui/releases) - [Changelog](https://github.com/mui/material-ui/blob/master/CHANGELOG.md) - [Commits](https://github.com/mui/material-ui/commits/v9.1.2/packages/mui-material) --- updated-dependencies: - dependency-name: "@mui/icons-material" dependency-version: 9.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: mui - dependency-name: "@mui/material" dependency-version: 9.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: mui ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/app/mui-552f835451
branch
from
June 29, 2026 20:15
ef40b8b to
05cdb8f
Compare
MarkusNeusinger
enabled auto-merge (squash)
July 5, 2026 21:08
MarkusNeusinger
disabled auto-merge
July 23, 2026 22:10
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
MarkusNeusinger
enabled auto-merge (squash)
July 23, 2026 22:11
MarkusNeusinger
disabled auto-merge
July 23, 2026 22:26
MarkusNeusinger
added a commit
that referenced
this pull request
Jul 24, 2026
…illed (#9772) ## What happened On **2026-07-24, ~16:05–16:26 UTC** GitHub's API browned out — HTTP 502 on the workflow-dispatch endpoint, HTTP 504 on GraphQL, HTTP 429 on codeload. Four `radar-basic` PRs fell out of the pipeline and stayed out, because the calls that hand work to the next workflow had no retry: | PR | Library | State it was left in | Call that died | |---|---|---|---| | #9742 | seaborn | `ai-approved` q90 | `impl-merge` → `gh pr view` → **504** | | #9744 | pygal | `ai-rejected` q87 | repair dispatch → **504**; `ai-attempt-1` also lost | | #9749 | makie | `ai-rejected` q88 | repair dispatch → **502** | | #9751 | highcharts | `ai-rejected` q88 | repair dispatch → **502** | `impl-review`'s verdict step is the pipeline's **only hand-off point** — every downstream workflow starts from a call made there. So an unretried blip doesn't merely fail a step; it leaves a PR carrying a verdict label with nothing listening. All four have since been recovered manually and merged; this PR stops it recurring. ## Changes **`impl-review.yml` — the verdict step** - every API call retries 3× with linear backoff (same shape as the existing `Extract PR info` retry, added 2026-05-06 for this same class of failure) - the repair is **dispatched before** the attempt label is added, and the label can no longer gate it. Losing the label costs one over-strict review; losing the dispatch costs the whole PR - if the dispatch still exhausts its retries, the step drops `ai-rejected` on the way out: `ai-rejected` + `ai-attempt-N` matches **no** watchdog case (Case 2 excludes any verdict label, Case 4 excludes PRs that already have an attempt label), while the label-less state is exactly Case 2 — which re-dispatches the repair at the attempt number the remaining label still encodes - the label read tracks success explicitly instead of inferring it from empty output, and a successful read with no verdict label now fails loudly instead of ending the step green **Two bugs found while verifying the above** - **`ai-attempt-4` never existed as a label.** The attempt label encodes the cascading threshold (90 → 80 → 70 → 60 → 50), but the repo only has `ai-attempt-1..3`, so on the 4th repair the add failed every time and `|| true` swallowed it — #7268 and #7039 both reached "Repair Attempt 4/4" carrying only `ai-attempt-1..3`. Every 4th review therefore re-applied the ≥ 90 attempt-0 bar, and the attempts-exhausted branch (close PR, remove stale implementation) could never be reached. Labels are now created on demand. *This also means my first draft of this PR was a hard blocker:* with the label add fatal, the 4th repair would never have been dispatched at all. - **That newly-reachable branch rendered a literal `$SCORE/100`** — quoted heredoc. Now expands, with the markdown backticks escaped so they can't become command substitution. **`impl-merge.yml`** - the 5× merge retry re-reads PR state first. A merge that succeeded server-side but lost its HTTP response used to fail four more times with "already merged" and exit 1 — and because every post-merge step is gated on `should_run == 'true'` (implicit `success()`), that skipped GCS promotion, the `impl:{lib}:done` label, closing the issue and the Postgres sync. A merged PR with none of its bookkeeping: exactly the silent partial completion CLAUDE.md warns about **`auto-update-pr-branches.yml` — Dependabot PRs could never merge while the pipeline ran** - the workflow called `update-branch` on Dependabot PRs. That push is authored by `github-actions[bot]`, so GitHub gates the resulting runs behind manual approval (`action_required`) — and because `main` advances every few minutes during impl merges, each branch was re-updated long before anyone could approve. **PR #9674 accumulated 174 runs in 22 h: 162 `action_required` against only 4 green** (the original `dependabot[bot]` push) - Dependabot branches are now skipped. They merge fine while behind — the `main` ruleset is **not** strict (`strict_required_status_checks_policy: false`); the file's header claimed the opposite and is corrected - `/dependabot`'s playbook told operators to run that same harmful `update-branch` by hand; it now says the opposite and documents the `@dependabot recreate` remedy ## Verification `.github/workflows/` has no verification loop (CLAUDE.md), so this was reviewed by a 4-lens adversarial pass with an independent refutation round (regression / shell-under-`bash -e` / retry idempotency / the Dependabot premise), and every claim was re-checked against the live repo before acting. That pass is what caught the `ai-attempt-4` blocker and the false Dependabot-rebase premise in my first draft. - YAML parses; `bash -n` clean on the extracted steps - `gh_retry` semantics exercised under `bash -e`: succeeds first try / recovers after 2 failures / multi-arg passthrough / hard failure aborts the step - the corrected control flow tested for all three cases — normal, **attempt 4 with a permanently failing label add (dispatch must still fire)**, and dispatch exhaustion (`ai-rejected` dropped, exit 1) - confirmed the CI runner's `gh` adds labels fine; only the locally-installed gh 2.45.0 hits the `projectCards` GraphQL deprecation, so hard-failing on `--add-label` is safe in CI - ruleset strictness, the `ai-attempt-*` label set, and the poisoned Dependabot head commits were all read from the live repo, not assumed ## Follow-up (not in this PR) - #9674, #9648 and #8820 already have a `github-actions[bot]` merge commit as their head. Once this merges their head stops moving, so approving each gated run **once** is enough — verified that the required contexts do report as SUCCESS on a bot-authored head after approval (#9674, commit `59545076`). Doing it before this merges would just get re-gated by the next push to `main`. (`@dependabot recreate` is an equivalent alternative; it also restores a clean `dependabot[bot]` head but re-resolves the versions.) - Whether `auto-update-pr-branches.yml` should exist at all now that the ruleset is non-strict is worth deciding separately — it affects every auto-merge PR, so it isn't folded in here. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the mui group with 2 updates in the /app directory: @mui/icons-material and @mui/material.
Updates
@mui/icons-materialfrom 9.1.0 to 9.1.1Release notes
Sourced from @mui/icons-material's releases.
Changelog
Sourced from @mui/icons-material's changelog.
Commits
0f9b43f[release] v9.1.1 (#48656)ef607d7[code-infra] Port codebase to use tsgo (#48616)Updates
@mui/materialfrom 9.1.0 to 9.1.2Release notes
Sourced from @mui/material's releases.
... (truncated)
Changelog
Sourced from @mui/material's changelog.
... (truncated)
Commits
a1ea5d8[release] v9.1.2 (#48713)e6a054d[autocomplete] Don't submit forms when committingfreeSolovalue with Enter...8d0216f[transitions] Fix RTG import in ESM (#48645)8f8e4dd[code-infra] Bump to latest code-infra packages (#48672)0f9b43f[release] v9.1.1 (#48656)bfd57b6[ButtonBase] Fix focus ripple lingering after blur (#48650)aa5e12d[Transition] Mount child in same commit when opening from unmounted (#48649)7c749df[Autocomplete] Update fullWidth prop documentation (#48626)0798f38Update dependencies to resolve Dependabot security alerts (#48641)ef607d7[code-infra] Port codebase to use tsgo (#48616)