Skip to content

fix(deps): update all application-kit packages to v27 - #1029

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-application-kit-packages
Open

fix(deps): update all application-kit packages to v27#1029
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-application-kit-packages

Conversation

@renovate

@renovate renovate Bot commented Aug 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@commercetools-frontend/application-config (source) 24.13.0 → 27.9.2 age confidence
@commercetools-frontend/babel-preset-mc-app (source) 24.13.0 → 27.9.2 age confidence
@commercetools-frontend/constants (source) 24.13.0 → 27.9.2 age confidence
@commercetools-frontend/eslint-config-mc-app (source) 24.13.0 → 27.9.2 age confidence
@commercetools-frontend/mc-scripts (source) 24.13.0 → 27.9.2 age confidence

Release Notes

commercetools/merchant-center-application-kit (@​commercetools-frontend/application-config)

v27.9.2

Compare Source

Patch Changes

v27.9.1

Compare Source

Patch Changes

  • #​4077 959d69e Thanks @​ByronDWall! - Batch-consolidated patch/minor Renovate dependency updates (rate-limited dashboard backlog, ~116 items reviewed).

    The @flopflip/* 15.1.7 → 15.1.11 bump pulls in @launchdarkly/js-client-sdk v4 as a
    transitive dependency, replacing the unscoped launchdarkly-js-client-sdk v3. This is a
    breaking change for SetupFlopFlipProvider in application-shell:

    • The LaunchDarkly user context type now requires either a key or anonymous: true,
      never an optional key. getUserContextForLaunchDarklyAdapter now returns an
      anonymous context when there's no authenticated user, instead of a context with an
      undefined key.
    • sdk.clientOptions.sendEventsOnlyForVariation was removed; the new SDK's allFlags
      no longer sends analytics events by default, which was the entire point of that option.

    @commercetools/composable-commerce-test-data 13.12.0 → 13.13.1 pulling in
    @faker-js/faker v10 (which dropped its CJS build) was previously allowlisted in the
    root jest.test.config.js's transformIgnorePatterns, but jest-preset-mc-app's own
    preset — the one actually consumed by the standalone starter templates
    (application-templates/starter{,-typescript}, custom-views-templates/starter{,-typescript})
    — has its own separate transformIgnorePatterns and was missed, so their CI jobs kept
    failing with Cannot use import statement outside a module. Added @faker-js/faker
    to that preset's allowlist too.

    Bumped the following, each a real dependencies entry (not devDependencies) of the listed package(s), so each gets a version bump here:

    • @flopflip/* (combine-adapters, http-adapter, launchdarkly-adapter, memory-adapter, react-broadcast, types) 15.1.7 → 15.1.11 — application-shell (all six), application-components (react-broadcast)
    • @pmmmwh/react-refresh-webpack-plugin 0.6.1 → 0.6.2 — mc-scripts
    • @radix-ui/react-dialog 1.1.14 → 1.1.23, @types/react-dom ^19.0.2 → ^19.2.4 — application-components
    • semver 7.7.2 → 7.8.5, uuid 14.0.0 → 14.0.1 — cypress
    • @rollup/pluginutils 5.2.0 → 5.4.0, graphql 16.11.0 → 16.14.2, html-webpack-plugin 5.6.3 → 5.6.8, mini-css-extract-plugin 2.9.4 → 2.10.2, postcss 8.5.23 → 8.5.26, react-refresh 0.17.0 → 0.18.0 — mc-scripts (webpack 5.105.1 → 5.109.2 was reverted; see below)
    • graphql 16.11.0 → 16.14.2, uuid 14.0.0 → 14.0.1 — application-shell-connectors
    • cosmiconfig 9.0.0 → 9.0.2, graphql 16.11.0 → 16.14.2 — jest-preset-mc-app (the jest/babel-jest/babel-preset-jest/jest-environment-jsdom/jest-mock bump was reverted; see the pnpm-regression/typecheck fix commits on this branch for why)
    • @types/react-dom ^19.0.2 → ^19.2.4 — react-notifications, application-shell (also @reduxjs/toolkit 2.9.0 → 2.12.0, graphql 16.11.0 → 16.14.2, uuid 14.0.0 → 14.0.1)
    • typescript 5.9.2 → 5.9.3 — eslint-config-mc-app, eslint-config-node
    • semver 7.7.2 → 7.8.5 — create-mc-app
    • uuid 14.0.0 → 14.0.1 — sdk
    • @formatjs/icu-messageformat-parser 2.11.2 → 2.11.4 — i18n
    • @sentry/browser, @sentry/react, @sentry/types 8.55.0 → 8.55.2 — sentry
    • serialize-javascript 7.0.5 → 7.0.7 — mc-html-template
    • ajv 8.18.0 → 8.20.0, cosmiconfig 9.0.0 → 9.0.2, cosmiconfig-typescript-loader 6.1.0 → 6.3.0 — application-config
    • winston 3.17.0 → 3.19.0 — loggers

    Other updates in this batch (@testing-library/*, @manypkg/cli, @percy/cypress, @percy/puppeteer, @preconstruct/cli, @apollo/client, jest, jest-each, react, react-dom, react-redux, @commercetools/nimbus, @commercetools/composable-commerce-test-data, @percy/cli, @percy/core, @changesets/*, rimraf, sentry-testkit, start-server-and-test, fflate, formik, qs, node, pnpm, and GitHub Actions digest/version pins) only touch devDependencies, peerDependencies, root-level repo tooling, CI configuration, or private template/playground packages, so they don't require a version bump here.

    webpack 5.105.1 → 5.109.2 was reverted: webpack's ProgressPlugin now defers option-schema validation from the constructor to a compiler.hooks.validate tap, reading this.options at that later point instead of validating the raw constructor args immediately. webpackbar@5.0.2 (unmaintained, used by mc-scripts's dev config via new WebpackBar()) calls super({ activeModules: true }) and then immediately overwrites this.options with its own name/color/reporters/reporter keys — none of which are in ProgressPlugin's schema. With eager validation this was masked; with the new deferred validation it fails every mc-scripts start/dev build with "Invalid options object. Progress Plugin has been initialized using an options object that does not match the API schema." Held back at 5.105.1 until webpackbar is fixed/replaced or dropped in favor of webpack's now-built-in progress bar.

  • Updated dependencies []:

v27.9.0

Compare Source

Patch Changes

v27.8.0

Compare Source

Patch Changes

v27.7.0

Compare Source

Patch Changes

v27.6.3

Compare Source

Patch Changes

v27.6.2

Compare Source

Patch Changes

v27.6.1

Compare Source

Patch Changes

v27.6.0

Compare Source

Patch Changes

v27.5.4

Compare Source

Patch Changes

  • #​4009 fae9486 Thanks @​ByronDWall! - Scope the rollup pnpm override to rollup@^4 so it only affects Rollup 4.x consumers.

    The unscoped "rollup": "^4.59.0" override introduced in 27.5.3 forced @preconstruct/cli's rollup@^2 dependency to resolve to Rollup 4.x. Rollup 4 no longer emits Object.defineProperty(exports, '__esModule', { value: true }) in CJS output by default, which broke jest.spyOn on namespace imports (import * as X from 'module') in downstream consumers.

  • Updated dependencies [fae9486]:

v27.5.3

Compare Source

Patch Changes

  • #​3989 222259a Thanks @​misama-ct! - Bump transitive dependencies via pnpm overrides to address 46 high-severity Dependabot alerts. Updated dependencies:

    • @isaacs/brace-expansion >= 5.0.1
    • @remix-run/router >= 1.23.2
    • @xmldom/xmldom >= 0.8.13
    • axios >= 1.15.2
    • immutable >= 3.8.3
    • lodash-es >= 4.17.21
    • minimatch@^3 ^3.1.4
    • minimatch@^4 ^4.2.5
    • minimatch@^9 ^9.0.7
    • minimatch@^10 ^10.2.3
    • path-to-regexp@^6 ^6.3.0
    • picomatch@^4 ^4.0.4
    • rollup ^4.59.0
    • semver@^6 ^6.3.1
    • svgo >= 2.8.1
    • systeminformation >= 5.31.0
    • tar >= 7.5.11
    • tar-fs >= 3.1.1
    • undici >= 6.24.0

  • Updated dependencies [222259a]:

v27.5.2

Compare Source

Patch Changes

v27.5.1

Compare Source

Patch Changes

v27.5.0

Compare Source

Patch Changes

v27.4.2

Patch Changes

v27.4.1

Patch Changes

v27.4.0

Compare Source

Patch Changes

v27.3.0

Compare Source

Patch Changes

v27.2.0

Compare Source

Patch Changes

v27.1.0

Compare Source

Patch Changes

v27.0.0

Compare Source

Patch Changes

v26.1.0

Compare Source

Patch Changes

v26.0.2

Compare Source

Patch Changes

v26.0.1

Compare Source

Patch Changes

  • #​3941 65cc17a Thanks @​ByronDWall! - fix(security): update ajv to 8.18.0 (ReDoS fix) and @flopflip/* to 15.1.7 (resolves transitive lodash prototype pollution via 4.17.23).

    The remaining reported vulnerabilities (minimatch via serve-handler and inflight via react-dev-utils) have no upstream fix available. Both are transitive dependencies of mc-scripts dev-only build tooling and pose negligible security risk as they are not included in production bundles.

  • Updated dependencies []:

v26.0.0

Compare Source

Patch Changes

v25.2.0

Compare Source

Patch Changes

v25.1.0

Compare Source

Patch Changes

v25.0.0

Compare Source

Patch Changes
commercetools/merchant-center-application-kit (@​commercetools-frontend/babel-preset-mc-app)

v27.9.2

Compare Source

v27.9.1

Compare Source

v27.9.0

Compare Source

v27.8.0

Compare Source

v27.7.0

Compare Source

v27.6.3

Compare Source

v27.6.2

Compare Source

v27.6.1

Compare Source

v27.6.0

Compare Source

v27.5.4

Compare Source

v27.5.3

Compare Source

Patch Changes

  • #​3989 222259a Thanks @​misama-ct! - Bump transitive dependencies via pnpm overrides to address 46 high-severity Dependabot alerts. Updated dependencies:

    • @isaacs/brace-expansion >= 5.0.1
    • @remix-run/router >= 1.23.2
    • @xmldom/xmldom >= 0.8.13
    • axios >= 1.15.2
    • immutable >= 3.8.3
    • lodash-es >= 4.17.21
    • minimatch@^3 ^3.1.4
    • minimatch@^4 ^4.2.5
    • minimatch@^9 ^9.0.7
    • minimatch@^10 ^10.2.3
    • path-to-regexp@^6 ^6.3.0
    • picomatch@^4 ^4.0.4
    • rollup ^4.59.0
    • semver@^6 ^6.3.1
    • svgo >= 2.8.1
    • systeminformation >= 5.31.0
    • tar >= 7.5.11
    • tar-fs >= 3.1.1
    • undici >= 6.24.0

v27.5.2

Compare Source

v27.5.1

Compare Source

v27.5.0

Compare Source

v27.4.2

v27.4.1

v27.4.0

Compare Source

v27.3.0

Compare Source

v27.2.0

Compare Source

v27.1.0

Compare Source

v27.0.0

Compare Source

v26.1.0

Compare Source

v26.0.2

Compare Source

v26.0.1

Compare Source

v26.0.0

Compare Source

Major Changes

  • #​3934 6c91a27 Thanks @​ByronDWall! - fix(security): move babel-plugin-istanbul to optional peer dependency to resolve SNYK-JS-INFLIGHT-6095116

    The babel-plugin-istanbul package transitively depends on the deprecated and vulnerable inflight@1.0.6 via test-exclude → glob@7 → inflight. By moving it from a direct dependency to an optional peer dependency, consumers of @commercetools-frontend/babel-preset-mc-app will no longer inherit this vulnerability in their dependency tree.

    Breaking change: Projects that use ENABLE_BABEL_PLUGIN_ISTANBUL=true for code coverage instrumentation must now explicitly install babel-plugin-istanbul as a dev dependency:

    pnpm add -D babel-plugin-istanbul

    A runtime check has been added that provides a clear error message if coverage is enabled but the plugin is not installed. Projects that do not use Istanbul coverage instrumentation are not affected.

v25.2.0

Compare Source

Patch Changes

v25.1.0

Compare Source

v25.0.0

Compare Source

commercetools/merchant-center-application-kit (@​commercetools-frontend/constants)

v27.9.2

Compare Source

v27.9.1

Compare Source

v27.9.0

Compare Source

Minor Changes
  • #​4037 1c22248 Thanks @​ByronDWall! - Add a portal target (mc-main-container-portal) inside MainContainer so that fixed-position components like SaveToolbar can portal into the MC content area and automatically constrain their width to the main pane, excluding the agent side panel.

v27.8.0

Compare Source

v27.7.0

Compare Source

v27.6.3

Compare Source

v27.6.2

Compare Source

v27.6.1

Compare Source

v27.6.0

Compare Source

v27.5.4

Compare Source

Patch Changes

  • #​4009 fae9486 Thanks @​ByronDWall! - Scope the rollup pnpm override to rollup@^4 so it only affects Rollup 4.x consumers.

    The unscoped "rollup": "^4.59.0" override introduced in 27.5.3 forced @preconstruct/cli's rollup@^2 dependency to resolve to Rollup 4.x. Rollup 4 no longer emits Object.defineProperty(exports, '__esModule', { value: true }) in CJS output by default, which broke jest.spyOn on namespace imports (import * as X from 'module') in downstream consumers.

v27.5.3

Compare Source

Patch Changes

  • #​3989 222259a Thanks @​misama-ct! - Bump transitive dependencies via pnpm overrides to address 46 high-severity Dependabot alerts. Updated dependencies:

    • @isaacs/brace-expansion >= 5.0.1
    • @remix-run/router >= 1.23.2
    • @xmldom/xmldom >= 0.8.13
    • axios >= 1.15.2
    • immutable >= 3.8.3
    • lodash-es >= 4.17.21
    • minimatch@^3 ^3.1.4
    • minimatch@^4 ^4.2.5
    • minimatch@^9 ^9.0.7
    • minimatch@^10 ^10.2.3
    • path-to-regexp@^6 ^6.3.0
    • picomatch@^4 ^4.0.4
    • rollup ^4.59.0
    • semver@^6 ^6.3.1
    • svgo >= 2.8.1
    • systeminformation >= 5.31.0
    • tar >= 7.5.11
    • tar-fs >= 3.1.1
    • undici >= 6.24.0

v27.5.2

Compare Source

v27.5.1

Compare Source

v27.5.0

Compare Source

v27.4.2

v27.4.1

v27.4.0

Compare Source

v27.3.0

Compare Source

v27.2.0

Compare Source

Minor Changes

v27.1.0

Compare Source

v27.0.0

Compare Source

v26.1.0

Compare Source

v26.0.2

Compare Source

v26.0.1

Compare Source

v26.0.0

Compare Source

v25.2.0

Compare Source

Patch Changes

v25.1.0

Compare Source

Minor Changes

v25.0.0

Compare Source

Major Changes

  • #​3910 95dba14 Thanks @​Sarah4VT! - Jest 30 upgrade - Upgrade guide

    • Removed globals configuration (NODE_ENV set automatically)
    • Removed crypto.randomUUID polyfill (JSDOM 26 native support)
    • Removed uuid dependency
    • Updated peer dependency to Jest 30.x
    • Breaking changes: deprecated matcher aliases removed, non-enumerable properties excluded from object matchers
    • JSDOM upgraded from v21 to v26 with improved spec compliance
commercetools/merchant-center-application-kit (@​commercetools-frontend/eslint-config-mc-app)

v27.9.2

Compare Source

Patch Changes

v27.9.1

Compare Source

Patch Changes

  • #​4077 959d69e Thanks @​ByronDWall! - Batch-consolidated patch/minor Renovate dependency updates (rate-limited dashboard backlog, ~116 items reviewed).

    The @flopflip/* 15.1.7 → 15.1.11 bump pulls in @launchdarkly/js-client-sdk v4 as a
    transitive dependency, replacing the unscoped launchdarkly-js-client-sdk v3. This is a
    breaking change for SetupFlopFlipProvider in application-shell:

    • The LaunchDarkly user context type now requires either a key or anonymous: true,
      never an optional key. getUserContextForLaunchDarklyAdapter now returns an
      anonymous context when there's no authenticated user, instead of a context with an
      undefined key.
    • sdk.clientOptions.sendEventsOnlyForVariation was removed; the new SDK's allFlags
      no longer sends analytics events by default, which was the entire point of that option.

    @commercetools/composable-commerce-test-data 13.12.0 → 13.13.1 pulling in
    @faker-js/faker v10 (which dropped its CJS build) was previously allowlisted in the
    root jest.test.config.js's transformIgnorePatterns, but jest-preset-mc-app's own
    preset — the one actually consumed by the standalone starter templates
    (application-templates/starter{,-typescript}, custom-views-templates/starter{,-typescript})
    — has its own separate transformIgnorePatterns and was missed, so their CI jobs kept
    failing with Cannot use import statement outside a module. Added @faker-js/faker
    to that preset's allowlist too.

    Bumped the following, each a real dependencies entry (not devDependencies) of the listed package(s), so each gets a version bump here:

    • @flopflip/* (combine-adapters, http-adapter, launchdarkly-adapter, memory-adapter, react-broadcast, types) 15.1.7 → 15.1.11 — application-shell (all six), application-components (react-broadcast)
    • @pmmmwh/react-refresh-webpack-plugin 0.6.1 → 0.6.2 — mc-scripts
    • @radix-ui/react-dialog 1.1.14 → 1.1.23, @types/react-dom ^19.0.2 → ^19.2.4 — application-components
    • semver 7.7.2 → 7.8.5, uuid 14.0.0 → 14.0.1 — cypress
    • @rollup/pluginutils 5.2.0 → 5.4.0, graphql 16.11.0 → 16.14.2, html-webpack-plugin 5.6.3 → 5.6.8, mini-css-extract-plugin 2.9.4 → 2.10.2, postcss 8.5.23 → 8.5.26, react-refresh 0.17.0 → 0.18.0 — mc-scripts (webpack 5.105.1 → 5.109.2 was reverted; see below)
    • graphql 16.11.0 → 16.14.2, uuid 14.0.0 → 14.0.1 — application-shell-connectors
    • cosmiconfig 9.0.0 → 9.0.2, graphql 16.11.0 → 16.14.2 — jest-preset-mc-app (the jest/babel-jest/babel-preset-jest/jest-environment-jsdom/jest-mock bump was reverted; see the pnpm-regression/typecheck fix commits on this branch for why)
    • @types/react-dom ^19.0.2 → ^19.2.4 — react-notifications, application-shell (also @reduxjs/toolkit 2.9.0 → 2.12.0, graphql 16.11.0 → 16.14.2, uuid 14.0.0 → 14.0.1)
    • typescript 5.9.2 → 5.9.3 — eslint-config-mc-app, eslint-config-node
    • semver 7.7.2 → 7.8.5 — create-mc-app
    • uuid 14.0.0 → 14.0.1 — sdk
    • @formatjs/icu-messageformat-parser 2.11.2 → 2.11.4 — i18n
    • @sentry/browser, `@se

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "after 10pm every weekday,before 8am every weekday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@changeset-bot

changeset-bot Bot commented Aug 6, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 06ef00e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@ByronDWall ByronDWall mentioned this pull request Aug 10, 2026
Merged
@renovate renovate Bot changed the title fix(deps): update all application-kit packages to v24.13.0 fix(deps): update all application-kit packages to v24.13.0 - autoclosed Aug 10, 2026
@renovate renovate Bot closed this Aug 10, 2026
@renovate
renovate Bot deleted the renovate/all-application-kit-packages branch August 10, 2026 20:05
@renovate renovate Bot changed the title fix(deps): update all application-kit packages to v24.13.0 - autoclosed fix(deps): update all application-kit packages to v27 Aug 13, 2026
@renovate renovate Bot reopened this Aug 13, 2026
@renovate
renovate Bot force-pushed the renovate/all-application-kit-packages branch 2 times, most recently from 55c6ad8 to 6a26650 Compare August 13, 2026 22:20
@renovate
renovate Bot force-pushed the renovate/all-application-kit-packages branch from 6a26650 to 06ef00e Compare August 14, 2026 17:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

🤖 Type: Dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants