chore(deps): bump @typescript-eslint/parser from 8.56.1 to 8.57.2 in /docs#317
Conversation
Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 8.56.1 to 8.57.2. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.2/packages/parser) --- updated-dependencies: - dependency-name: "@typescript-eslint/parser" dependency-version: 8.57.2 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
Greptile SummaryThis is a routine Dependabot dependency bump that upgrades
Confidence Score: 5/5Safe to merge — version-bump-only release with no code changes and only docs/ affected. All changes are confined to the docs Docusaurus site. The typescript-eslint changelog explicitly states this is a version-bump-only release for the parser package. No application logic is touched, and Dependabot reports a high compatibility score. No files require special attention. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A["Dependabot bump\n@typescript-eslint/parser\n8.56.1 → 8.57.2"] --> B["docs/package.json\nspecifier updated"]
A --> C["docs/pnpm-lock.yaml\nresolved versions updated"]
C --> D["@typescript-eslint/* packages\n8.56.1 → 8.57.2"]
C --> E["ts-api-utils\n2.4.0 → 2.5.0"]
C --> F["Minor transitive bumps\nbabel/runtime, caniuse-lite,\npicomatch, brace-expansion…"]
D --> G["No parser code changes\n(version-bump-only release)"]
Reviews (1): Last reviewed commit: "chore(deps): bump @typescript-eslint/par..." | Re-trigger Greptile |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — routine Dependabot parser bump in docs tooling only.
Extended reasoning...
Overview
This PR bumps @typescript-eslint/parser from 8.56.1 to 8.57.2 in docs/package.json and its associated pnpm-lock.yaml. Only two files are touched, both confined to the docs site's dev dependency toolchain.
Security risks
None. This is a linting toolchain dependency for the docs site; it is not shipped in any production artifact. There are no auth, crypto, or permission code paths affected.
Level of scrutiny
Low scrutiny is appropriate. The 8.57.0, 8.57.1, and 8.57.2 parser releases were all version-bump-only (no code changes), as confirmed by the changelog. The lockfile changes are mechanical version updates consistent with the package.json change.
Other factors
The inline comment flags a pre-existing plugin/parser version mismatch (eslint-plugin at 8.54.0, parser now at 8.57.2). This gap existed before this PR (8.54.0 vs 8.56.1) and the practical risk is negligible given the parser bump had no code changes. It is a valid nit worth a follow-up Dependabot bump for the plugin, but it does not block this PR.
| "@docusaurus/tsconfig": "3.9.2", | ||
| "@docusaurus/types": "3.9.2", | ||
| "@typescript-eslint/eslint-plugin": "^8.0.0", | ||
| "@typescript-eslint/parser": "^8.56.1", | ||
| "@typescript-eslint/parser": "^8.57.2", |
There was a problem hiding this comment.
🟡 This PR bumps @typescript-eslint/parser to 8.57.2 but leaves @typescript-eslint/eslint-plugin constrained to ^8.0.0 (resolving to 8.54.0), creating a 3-minor-version gap that the typescript-eslint project recommends against. While this mismatch was pre-existing (8.54.0 plugin vs 8.56.1 parser before this PR), the fix is straightforward: also update @typescript-eslint/eslint-plugin to ^8.57.2 in docs/package.json.
Extended reasoning...
What the bug is and how it manifests
The PR updates @typescript-eslint/parser from 8.56.1 to 8.57.2 in docs/package.json, but the @typescript-eslint/eslint-plugin constraint remains at ^8.0.0. pnpm resolves this to 8.54.0, meaning there is now a 3-minor-version gap between the plugin (8.54.0) and the parser (8.57.2). The typescript-eslint versioning docs explicitly recommend keeping the plugin and parser at the same version.
The specific code path that triggers it
In docs/package.json lines 36-39, @typescript-eslint/eslint-plugin is pinned at ^8.0.0 while @typescript-eslint/parser is now at ^8.57.2. The lockfile confirms this: the plugin snapshot still depends on the 8.54.0 versions of scope-manager, type-utils, utils, and visitor-keys, while the parser uses the 8.57.2 equivalents. Both sets of internal packages coexist in the dependency tree.
Why existing code does not prevent it
The ^8.0.0 semver range for the eslint-plugin accepts any 8.x version, so pnpm is free to leave it at 8.54.0 when resolving. There is no constraint or peer-dependency rule that forces the plugin and parser to resolve to the same minor version. Dependabot only bumped the parser, leaving the plugin behind.
What the impact would be
If the AST node shapes, type APIs in scope-manager, or visitor key sets differ between 8.54.0 and 8.57.2, the plugin (using its 8.54.0 internal packages to traverse the AST) could produce incorrect lint results or even runtime errors, since it is analyzing AST output produced by the parser's 8.57.2 internals. In practice, the risk here is low: 8.57.0, 8.57.1, and 8.57.2 were version-bump-only releases for the parser, and pnpm's lockfile shows some cross-version deduplication already occurring (e.g., @typescript-eslint/project-service@8.54.0 pulling in tsconfig-utils@8.57.2 and types@8.57.2). Additionally, this is only the docs linting toolchain, not production code.
Pre-existing nature
Importantly, this mismatch was already present before this PR: the plugin was at 8.54.0 and the parser at 8.56.1 (a 2-minor-version gap). This PR worsens the gap by one additional minor version. It is therefore a pre-existing issue that this PR makes slightly worse without fixing.
How to fix it
In docs/package.json, change "@typescript-eslint/eslint-plugin": "^8.0.0" to "@typescript-eslint/eslint-plugin": "^8.57.2". This will cause pnpm to resolve both packages to the same version, eliminating the duplicate internal packages and aligning with the typescript-eslint team's versioning recommendation.
Step-by-step proof
- Before this PR:
docs/package.jsonhad parser at^8.56.1→ lockfile resolved to 8.56.1; plugin was^8.0.0→ resolved to 8.54.0. Gap: 2 minor versions. - This PR changes parser to
^8.57.2→ lockfile resolves to 8.57.2; plugin constraint unchanged at^8.0.0→ still resolves to 8.54.0. - The lockfile snapshots confirm two parallel sets:
@typescript-eslint/scope-manager@8.54.0and@typescript-eslint/scope-manager@8.57.2, and similarly fortypes,typescript-estree, andvisitor-keys. - The eslint-plugin@8.54.0 snapshot uses parser@8.57.2 (updated pnpm peer) but internally depends on scope-manager@8.54.0, types@8.54.0, etc.—a mix of 8.54.0 internals analyzing parser output built on 8.57.2 internals.
Bumps @typescript-eslint/parser from 8.56.1 to 8.57.2.
Release notes
Sourced from
@typescript-eslint/parser's releases.... (truncated)
Changelog
Sourced from
@typescript-eslint/parser's changelog.Commits
be4d54dchore(release): publish 8.57.2c7c38aachore(release): publish 8.57.12c6aeeechore(release): publish 8.57.0f696dadchore: use pnpm catalog (#12047)a09921echore: update vitest to 4.x (#12071)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)