chore(deps): pin dependencies - #1833
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
|
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.
Updates Node/pnpm runtime requirements across packages/apps and tightens dependency constraints, plus refreshes a GitHub Action pin for releases.
Changes:
- Pin
enginesfor Node and pnpm to specific versions across multiplepackage.jsonfiles - Pin some
peerDependencies(React/ReactDOM/Sonner) to exact versions in UI-related packages - Update
actions/create-github-app-tokento a newer pinned commit in the release workflow
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/url-state-provider/package.json | Pins Node/pnpm engine versions |
| packages/ui-components/package.json | Pins Node/pnpm engines and tightens peer dependency versions |
| packages/template/package.json | Pins Node/pnpm engine versions |
| packages/oauth/package.json | Pins Node/pnpm engine versions |
| packages/messages-provider/package.json | Pins Node/pnpm engine versions |
| packages/greenhouse-auth-provider/package.json | Pins Node/pnpm engines and tightens React peer dependency |
| packages/communicator/package.json | Pins Node/pnpm engine versions |
| apps/template/package.json | Pins Node/pnpm engine versions |
| apps/heureka/package.json | Pins Node/pnpm engine versions |
| apps/example/package.json | Pins Node/pnpm engine versions |
| apps/carbon/package.json | Pins Node/pnpm engine versions |
| .github/workflows/release.yaml | Updates pinned create-github-app-token action digest |
Comment on lines
+26
to
+27
| "node": "v26.5.0", | ||
| "pnpm": "11.17.0" |
Comment on lines
+14
to
+15
| "node": "v26.5.0", | ||
| "pnpm": "11.17.0" |
Comment on lines
+59
to
+61
| "react": "19.2.8", | ||
| "react-dom": "19.2.8", | ||
| "sonner": "2.0.7" |
| }, | ||
| "peerDependencies": { | ||
| "react": ">=19.0.0" | ||
| "react": "19.2.8" |
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
July 28, 2026 08:02
47c4464 to
dc3e387
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (3)
packages/url-state-provider/package.json:27
- In
package.json#engines, values are expected to be SemVer ranges (and typically without a leadingv). Using\"v26.5.0\"may not be parsed as a valid range by npm’s semver range logic and can cause the engine check to be ignored or behave unexpectedly. Recommend switching to a valid range (e.g.,\">=26.5.0\"or a compatible range) and applying the same fix across the other updatedpackage.jsonfiles in this PR whereengines.nodewas changed similarly.
"node": "v26.5.0",
"pnpm": "11.17.0"
packages/ui-components/package.json:61
- These are
peerDependencies, so pinning to exact versions can create avoidable install conflicts for consumers (peer resolution will warn/error if they have19.2.xor newer patch versions). Prefer expressing the supported compatibility range (e.g., allowing compatible minor/patch versions) unless this package truly only works with those exact versions.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- Changing
reactinpeerDependenciesfrom a range to an exact version can unnecessarily restrict consumers and increase dependency resolution conflicts. Unless there’s a concrete incompatibility, prefer a compatibility range that reflects what versions are supported (e.g.,>=19.2.8 <20or similar).
"react": "19.2.8"
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
July 28, 2026 09:09
dc3e387 to
b9fee49
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (3)
packages/url-state-provider/package.json:27
enginesis typically expressed as a semver range (e.g.>=26.5.0) rather than an exact patch version, otherwise installs will fail for users/CI on newer patch releases. Also consider omitting thevprefix for consistency with semver ranges, and (if the goal is to pin pnpm exactly) prefer using thepackageManagerfield (usually at the repo root) to reliably enforce the pnpm version across tooling.
"node": "v26.5.0",
"pnpm": "11.17.0"
packages/ui-components/package.json:61
- Pinning
peerDependenciesto exact versions is likely to cause unnecessary peer resolution conflicts for consumers (e.g., when they have newer compatible patch/minor versions installed). Peer deps are generally expected to be semver ranges (e.g.,^19.2.0or>=19 <20) so package consumers can satisfy the contract without matching one exact version.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- This changes the React peer requirement from a compatible range (
>=19.0.0) to an exact version. Exact peer versions commonly create avoidable install warnings/conflicts for consumers who have a different (but compatible) 19.x installed; using a semver range would better reflect a peer contract.
"react": "19.2.8"
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
July 28, 2026 10:48
b9fee49 to
d482422
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (3)
packages/url-state-provider/package.json:27
- "engines.node"
is set to"v26.5.0". Theenginesfield is expected to contain a valid semver range/version, and thevprefix can cause semver parsing/tooling differences. Prefer"26.5.0"or a range like">=26.5.0"(and apply the same adjustment across the other package/apppackage.json` files touched in this PR).
"node": "v26.5.0",
"pnpm": "11.17.0"
packages/ui-components/package.json:61
- These
peerDependenciesare pinned to exact versions. Exact peer pins are typically too restrictive for consumers (they prevent using compatible patch/minor versions and can force unnecessary dependency conflicts). Prefer semver ranges (e.g.,^19.2.0/^2.0.7, or whatever compatibility policy you intend) unless there’s a concrete incompatibility that requires exact matching.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- Changing the React peer dependency from a range (
>=19.0.0) to an exact version (19.2.8) makes the package significantly harder to consume alongside other React 19.x installations. Unless you rely on behavior specific to exactly 19.2.8, consider switching back to a compatible range (e.g.,^19.2.0or>=19.0.0 <20).
"react": "19.2.8"
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
July 28, 2026 11:48
d482422 to
9dd2f4b
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (2)
packages/ui-components/package.json:61
- Pinning peerDependencies to exact versions is likely to cause unnecessary installation/compatibility failures for consumers (peer deps are typically declared as compatible ranges). Consider switching these to ranges (e.g. "^19.2.0" for React/ReactDOM and "^2.0.7" for Sonner, or another intended compatibility policy) so downstream projects can satisfy the peer deps without matching an exact patch version.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- Changing the React peer dependency from a range (previously ">=19.0.0") to an exact version ("19.2.8") is a breaking constraint for consumers and can lead to peer resolution conflicts. Prefer a compatible range (for example "^19.0.0" or ">=19.0.0 <20") unless you have a strong reason to require exactly 19.2.8.
"react": "19.2.8"
Comment on lines
+26
to
+27
| "node": "v26.5.0", | ||
| "pnpm": "11.17.0" |
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
July 29, 2026 07:13
9dd2f4b to
0303c5e
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (2)
packages/ui-components/package.json:61
- Pinning
peerDependenciesto exact versions significantly reduces compatibility and can cause avoidable dependency resolution conflicts for downstream apps (they must match exactly). For libraries, peer deps are typically specified as a compatible range (e.g.,^19.x/>=19 <20) to allow patch/minor updates while still protecting against breaking majors. If the intent is to require minimum versions, consider using a lower-bounded range instead of an exact pin.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- This tightens a previously broad peer dependency (
>=19.0.0) to an exact version, which can be a breaking change for consumers already on a different compatible React 19 version. Prefer a supported range that reflects actual compatibility (e.g.,>=19 <20or^19.2.0) unless there is a concrete technical requirement for an exact match.
"react": "19.2.8"
Comment on lines
+26
to
+27
| "node": "v26.5.0", | ||
| "pnpm": "11.17.0" |
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
July 29, 2026 08:44
0303c5e to
b8af907
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 13 changed files in this pull request and generated no new comments.
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
Comments suppressed due to low confidence (3)
packages/url-state-provider/package.json:27
- Pinning
enginesto exact versions is likely to cause unnecessary install/CI failures (e.g., Node 26.5.1 or pnpm 11.17.1 will be rejected even if compatible). Prefer a semver range (e.g.,>=26.5.0 <27for Node and>=11.17.0 <12for pnpm, or whatever ranges you support). This same pattern appears across multiple package/apppackage.jsonfiles in this PR.
"node": "v26.5.0",
"pnpm": "11.17.0"
packages/ui-components/package.json:61
- Tightening
peerDependenciesto exact versions makes the package harder to consume because it can force version conflicts in downstream apps that have compatible patch/minor versions installed. Prefer semver ranges for peers (e.g.,^19.2.0or>=19.1.0 <20for React/ReactDOM, and a similar compatible range forsonner) unless there is a concrete incompatibility that requires exact pinning.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- Same concern as in
ui-components: exactpeerDependenciesare unnecessarily restrictive for consumers and often lead to dependency resolution conflicts. Prefer a compatible range (e.g.,^19.2.0or>=19.0.0 <20) unless this provider is known to break with other 19.x releases.
"react": "19.2.8"
Contributor
|
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
July 29, 2026 14:02
b8af907 to
2c49d08
Compare
Contributor
Author
|
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (3)
apps/template/package.json:15
enginesvalues are typically expressed as semver ranges (and usually without a leadingv). Pinning to exact versions can unnecessarily block installs on compatible newer patch/minor versions (and some tooling expects a range like>=26.5.0). Consider switching to a range such as">=26.5.0"(or">=26.5.0 <27") and remove thevprefix; same suggestion applies to the other updatedpackage.jsonfiles in this PR.
"engines": {
"node": "v26.5.0",
"pnpm": "11.18.0"
packages/ui-components/package.json:61
- Exact peer dependency pins are very restrictive for consumers (they must match exactly), and can cause avoidable install conflicts with compatible patch/minor versions. For libraries, it’s usually better to keep peer dependencies as compatible ranges (e.g.,
^19.2.0for React/ReactDOM and^2.0.7for Sonner), unless there’s a concrete incompatibility that requires an exact pin.
"peerDependencies": {
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- Changing the
reactpeer dependency from a range (>=19.0.0) to an exact version can be a breaking change for downstream apps that are still on other compatible 19.x releases. If the package works across React 19, prefer a compatible range (e.g.,^19.0.0or^19.2.0); only use an exact version if there’s a known incompatibility that necessitates it.
"peerDependencies": {
"react": "19.2.8"
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
July 29, 2026 18:46
2c49d08 to
0c61c29
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (3)
packages/url-state-provider/package.json:27
- Pinning
enginesto exact versions is likely to cause avoidable install failures (e.g., Node 26.5.2 / pnpm 11.18.1 would be rejected whenengine-strictis enabled). Prefer semver ranges (as previously used) such as>=26.5.1 <27for Node and>=11.18.0(or a compatible range) for pnpm. Also consider using the rootpackageManagerfield (e.g.,\"packageManager\": \"pnpm@11.18.0\") for tool pinning instead ofengines.pnpm.
"node": "v26.5.1",
"pnpm": "11.18.0"
packages/ui-components/package.json:61
- Switching peer dependencies from ranges (e.g.,
^19.1.0) to exact versions makes the package much harder to consume and can cause unnecessary peer dependency conflicts for apps using compatible newer patch/minor releases. Peer dependencies typically should express the supported range (e.g.,^19.2.0or>=19.1.0 <20) rather than a single exact version.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- This narrows the
reactpeer dependency from>=19.0.0to an exact version, which is a breaking change for consumers on other React 19.x versions and will likely trigger peer resolution warnings/errors. Prefer a supported range (e.g.,>=19.0.0 <20or^19.2.0) unless there is a concrete incompatibility that requires pinning.
"react": "19.2.8"
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
August 3, 2026 14:14
0c61c29 to
5fc2e18
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.
Suppressed comments (3)
packages/url-state-provider/package.json:27
enginesvalues are typically semver ranges (and usually without avprefix). Using an exact version (and especiallyv26.6.0) can cause the engines check to be treated as an invalid range by some tooling and also makes installs fail unnecessarily when patch/minor versions differ. Consider switching to ranges like"node": ">=26.6.0"(or whatever minimum you require) and"pnpm": ">=11.18.0"(or a bounded range) for better compatibility.
"node": "v26.6.0",
"pnpm": "11.18.0"
packages/ui-components/package.json:61
- Pinning
peerDependenciesto exact versions is likely to create avoidable peer resolution conflicts for consumers (e.g., apps using19.2.xor19.3.xwill be considered incompatible). Peer deps are generally intended to be compatible ranges; consider reverting to ranges (e.g.,^19.0.0/^19.2.0for React, and an appropriate compatible range for Sonner) unless there is a hard incompatibility that necessitates an exact pin.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- Tightening the React
peerDependenciesconstraint from a range to an exact version is a breaking change for downstream apps/libraries that satisfy the peer with another compatible React 19 version. If the package is compatible with multiple 19.x versions, prefer a range (e.g.,>=19.0.0 <20or^19.0.0) to avoid unnecessary peer conflicts.
"react": "19.2.8"
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
August 3, 2026 14:37
5fc2e18 to
66ec9e5
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.
Suppressed comments (2)
packages/ui-components/package.json:61
- Pinning
peerDependenciesto exact versions is overly restrictive for consumers and commonly causes peer resolution conflicts when an app uses a different patch/minor that is still compatible. Prefer semver ranges (e.g.,^19.2.0or>=19 <20) unless there is a hard technical requirement for exact versions.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- This change makes the React peer dependency exact, which is likely to create avoidable conflicts for downstream apps. It also introduces inconsistency across packages in this repo (e.g.,
packages/messages-providercurrently peersreactat19.2.7). Recommend switching to a compatible range and/or aligning peer ranges across packages to avoid workspace-wide peer resolution friction.
"react": "19.2.8"
Comment on lines
+26
to
+27
| "node": "v26.6.0", | ||
| "pnpm": "11.20.0" |
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
August 4, 2026 10:07
66ec9e5 to
fccdcd3
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.
Suppressed comments (3)
packages/url-state-provider/package.json:27
- "engines"
typically uses semver *ranges* (and generally without a leadingv) to avoid unnecessary install failures. Pinning to exact versions (especially"node": "v26.6.0") can break consumers/CI that are on compatible patch/minor versions; consider switching back to ranges (e.g.,">=26.6.0"or a supported range for this repo) and keep exact tool pinning in a separate mechanism (e.g.,packageManager,.nvmrc`, Volta/asdf) if strict pinning is required.
"node": "v26.6.0",
"pnpm": "11.20.0"
packages/ui-components/package.json:61
- Changing peerDependencies from ranges (e.g.
^19.1.0) to exact versions makes the package much harder to consume because apps may have a compatible but not identical patch/minor installed and will get peer resolution warnings/errors. Unless there is a known incompatibility, prefer semver ranges for peers (e.g.,^19.2.0/^2.0.7) so consumers can receive compatible updates.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- This tightens the React peer requirement from
>=19.0.0to an exact patch version, which is a backwards-incompatible constraint for consumers and likely to cause peer conflicts. Prefer a range expressing the supported major/minor (e.g.^19.0.0or>=19 <20) unless the package truly only works with19.2.8.
"react": "19.2.8"
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
August 4, 2026 10:24
fccdcd3 to
3fb3cbe
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.
Suppressed comments (2)
packages/ui-components/package.json:61
- Pinning
peerDependenciesto exact versions is likely to cause unnecessary peer resolution failures/warnings for consumers (who may already be on compatible patch/minor versions). Peer deps are typically specified as compatible ranges (e.g.,^19.2.0for React/React DOM and^2.0.7for Sonner, or keep the previously-used caret ranges) unless there is a strict incompatibility that requires exact pinning.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- Same concern as other peer dep changes: pinning React
peerDependenciesto an exact version can create avoidable consumer friction. If the package is compatible with a broader set of React 19 releases, use a range (e.g.,>=19.0.0or^19.2.0) rather than19.2.8.
"react": "19.2.8"
Comment on lines
+26
to
+27
| "node": "v26.6.0", | ||
| "pnpm": "11.20.0" |
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
August 5, 2026 07:32
3fb3cbe to
81bb4ea
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.
Suppressed comments (3)
packages/url-state-provider/package.json:27
enginesvalues should be valid semver/range strings; thevprefix is typically not accepted by semver parsers (and can be ignored or misinterpreted by tooling). Also, pinning exact versions inenginesis unusually strict and may cause avoidable install warnings/errors for contributors/consumers; prefer a range (e.g.,>=26.6.0for Node and>=11.20.0for pnpm) and keep exact pinning in tooling files like.nvmrc/Volta/asdf where appropriate. This pattern appears across multiplepackage.jsonfiles in the PR.
"node": "v26.6.0",
"pnpm": "11.20.0"
packages/ui-components/package.json:61
- Pinning exact versions in
peerDependenciesis likely to create unnecessary installation conflicts for downstream apps (they must match exactly), which undermines the purpose of peer deps (compatibility ranges). Consider using a semver range that expresses compatibility (e.g.,^19.2.0or>=19.2.8 <20for React/React DOM, and a similar compatible range forsonner) unless there’s a concrete, documented incompatibility requiring exact pinning.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- Changing the React
peerDependenciesconstraint from a range (>=19.0.0) to an exact version (19.2.8) is a breaking compatibility restriction for consumers already on other React 19.x versions. If the package works across React 19, keep a compatible range (e.g.,>=19 <20, or^19.0.0), and only narrow it if there is a known incompatibility that’s documented.
"react": "19.2.8"
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.
Suppressed comments (3)
packages/url-state-provider/package.json:27
- Pinning
enginesto exact versions (instead of a compatible range) can cause otherwise-compatible developer environments/CI runners to fail installation (e.g., Node 26.6.1 or 26.x). Consider using semver ranges (e.g.,>=26.6.0or^26.6.0) consistently across packages to keep the enforcement intent while reducing avoidable install friction.
"node": "v26.6.0",
"pnpm": "11.20.0"
packages/ui-components/package.json:61
- Changing
peerDependenciesfrom ranges (e.g.,^19.1.0) to exact pins increases the chance of peer resolution conflicts for consumers (e.g., React 19.2.9) even when API-compatible. Prefer expressing compatibility via ranges (e.g.,^19.2.8/>=19.2.8 <20) unless there’s a hard incompatibility you’re intentionally enforcing.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- Tightening the React
peerDependenciesfrom a range (>=19.0.0) to an exact version can prevent consumers from using newer compatible React patch/minor releases. If exact pinning isn’t required for correctness, prefer a range to reduce downstream dependency conflicts.
"react": "19.2.8"
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
August 5, 2026 08:22
81bb4ea to
532a2e8
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.
Suppressed comments (3)
packages/url-state-provider/package.json:27
- "engines"
should generally use semver *ranges* (and typically without a leadingv) to avoid unnecessarily rejecting compatible patch/minor updates. Consider switching to a range (e.g.,>=26.6.0 <27or^26.6.0) and aligning the same pattern across all updatedpackage.json` files for consistent install behavior.
"node": "v26.6.0",
"pnpm": "11.20.0"
packages/ui-components/package.json:61
- Pinning
peerDependenciesto exact versions is likely to cause avoidable peer resolution conflicts for consumers (e.g., apps using a different compatible patch/minor). Peer deps typically should express a compatible range (for example>=19.2.0 <20for React/ReactDOM, and a suitable semver range forsonner) so downstream projects can satisfy them without forcing exact matches.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- Same concern as the other peer dependency changes: making React an exact-version peer dep can break consumers that use a different compatible React patch/minor. Prefer a range (e.g.,
>=19 <20or^19.2.0) to communicate compatibility without creating hard version lock.
"react": "19.2.8"
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
August 5, 2026 12:34
532a2e8 to
af3e0c0
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.
Suppressed comments (3)
packages/url-state-provider/package.json:27
- Pinning
enginesto exact versions (and to very new versions) is likely to break local dev/CI for contributors and consumers that have a compatible-but-not-exact Node/pnpm installed. Consider switching back to semver ranges (e.g.,>=...or^...) and enforcing exact tool versions via a repo-level mechanism like.nvmrc/.node-versionandpackageManager/Corepack. This same issue appears in the other modifiedpackage.jsonfiles in this PR as well.
"node": "v26.6.0",
"pnpm": "11.20.0"
packages/ui-components/package.json:61
- Setting
peerDependenciesto exact versions is very restrictive for consumers: package managers will warn or refuse install when the app uses a different compatible patch/minor. Prefer semver ranges for peers (e.g.,^19.2.0for React/ReactDOM and^2.0.7for Sonner) unless there is a concrete incompatibility that requires an exact pin.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- Changing a
peerDependencyfrom a range (>=19.0.0) to an exact version (19.2.8) can unnecessarily prevent consumers from using other React 19 patch/minor versions. If the package is compatible across React 19, prefer a range (e.g.,^19.0.0or>=19 <20) to avoid avoidable install conflicts.
"react": "19.2.8"
renovate
Bot
force-pushed
the
renovate/pin-dependencies
branch
from
August 5, 2026 16:03
af3e0c0 to
ec6baa3
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.
Suppressed comments (3)
packages/url-state-provider/package.json:27
package.json#enginesvalues are typically semver ranges (and generally should not include a leadingv). Using an exact version can unnecessarily reject patch/minor-compatible toolchains, and thevprefix may not be interpreted as valid semver by all tooling. Consider switching to a range like"node": ">=26.6.0"(or whatever minimum is intended) and"pnpm": ">=11.20.0". This same pattern appears in the other modifiedpackage.jsonfiles as well.
"node": "v26.6.0",
"pnpm": "11.20.0"
packages/ui-components/package.json:61
- Pinning
peerDependenciesto exact versions is very restrictive for consumers and can cause avoidable install conflicts (e.g., apps using a newer compatible patch/minor). Peer deps are usually declared as compatible ranges (e.g.,^19.2.0/^2.0.7or similar). If exact pinning is not strictly required, prefer a semver range that reflects the supported compatibility window.
"react": "19.2.8",
"react-dom": "19.2.8",
"sonner": "2.0.7"
packages/greenhouse-auth-provider/package.json:23
- This change narrows the React
peerDependenciesrequirement from a compatible range to a single exact version, which can break otherwise compatible consumers. Consider using a compatibility range (e.g.,^19.2.0or>=19.0.0 <20) unless there is a concrete incompatibility with other 19.x versions that needs to be enforced.
"react": "19.2.8"
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v3→v3.2.0>=20.19.0→v26.6.0>=20.12.0→v26.6.0>=8.0.0→11.20.0^19.1.0→19.2.8>=19.0.0→19.2.8^19.1.0→19.2.8^2.0.7→2.0.7Add the preset
:preserveSemverRangesto your config if you don't want to pin your dependencies.Configuration
📅 Schedule: (in timezone Europe/Berlin)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.