Update dependency react-intl to v10.1.25 - autoclosed - #226
red-hat-konflux[bot] wants to merge 1 commit into
Conversation
|
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Amber reviewStatus: Complete VerdictREQUEST_CHANGES. This bot bump raises SummaryThe change is a single-line dependency bump in Findings[Major] Incomplete/inconsistent version bump (peer vs dev vs lockfile) — This package declares
Fix: keep the two stanzas and the lockfile in sync — bump Cross-PR coordinationNo material cross-PR coordination issue requires maintainer action. Findings Summary (ordered by severity, highest first)
Convention Checklist
|
jsell-rh
left a comment
jsell-rh
left a comment
There was a problem hiding this comment.
Verdict
REQUEST_CHANGES. This bot bump raises react-intl only in peerDependencies to 10.1.22, but the matching devDependencies entry and pnpm-lock.yaml are still pinned to 10.1.18, so the intended upgrade never actually takes effect and the manifest becomes self-inconsistent.
Summary
The change is a single-line dependency bump in packages/gateway-management-ui/package.json. There are no Go, security, reconciliation, or secret-handling concerns in scope; the one substantive issue is that the version bump is applied inconsistently across the package's dependency stanzas and lockfile.
Findings
[Major] Incomplete/inconsistent version bump (peer vs dev vs lockfile) — packages/gateway-management-ui/package.json:31
This package declares react-intl in two places, both exact-pinned:
peerDependencies.react-intl(line 31) — changed to10.1.22devDependencies.react-intl(line 57) — still10.1.18
pnpm-lock.yaml (importer packages/gateway-management-ui, devDependencies.react-intl) also still resolves specifier: 10.1.18 / version: 10.1.18. Consequences:
- The library continues to be built and tested against
10.1.18(the devDependency is what gets installed), so the advertised10.1.22support is never actually exercised — the bump does not achieve its stated goal. - The package now declares an exact peer requirement of
10.1.22that its own development environment (10.1.18) does not satisfy, producing an unmet-peer inconsistency for anyone building the package. - The lockfile is left stale relative to
package.json. (pnpm v9--frozen-lockfile, used inlint.yml/e2e.yml/sdk-drift-check.yml/Makefile, does not record peer specifiers in the importer block, so it likely will not hard-fail on this alone — but the manifest and lockfile are nonetheless out of sync with the intended change.)
Fix: keep the two stanzas and the lockfile in sync — bump devDependencies.react-intl to 10.1.22 and regenerate pnpm-lock.yaml (pnpm install) in the same commit, or drop the change if the upgrade is not intended. Confidence: High on the inconsistency; Medium on whether CI hard-fails.
Cross-PR coordination
No material cross-PR coordination issue requires maintainer action.
Findings Summary (ordered by severity, highest first)
- [Major]
react-intlbumped only inpeerDependencies;devDependencies(L57) andpnpm-lock.yamlstill pin10.1.18, making the upgrade ineffective and the manifest self-inconsistent — Dependency Consistency (L31, L57)
Convention Checklist
| Convention | Result |
|---|---|
| Conventional commit message | Pass |
| Dependency manifest / lockfile kept in sync | Fail |
| Config separate from code | Pass |
| "react-dom": "19.2.8", | ||
| "react-hook-form": "7.82.0", | ||
| "react-intl": "10.1.18", | ||
| "react-intl": "10.1.22", |
There was a problem hiding this comment.
This bumps only the peerDependencies entry to 10.1.22. The devDependencies.react-intl (line 57) is still 10.1.18, and pnpm-lock.yaml (importer packages/gateway-management-ui) still resolves 10.1.18. Net effect: the library is still installed and tested against 10.1.18, so the upgrade is ineffective, and the package now declares an exact peer of 10.1.22 that its own dev environment does not satisfy. Please also bump the devDependency to 10.1.22 and regenerate the lockfile (pnpm install) in the same commit, or drop the change.
bbc52bb to
d00c74e
Compare
red-hat-konflux
Bot
changed the title
Amber reviewStatus: Complete |
jsell-rh
left a comment
jsell-rh
left a comment
There was a problem hiding this comment.
Verdict
REQUEST_CHANGES. This Renovate bump raises react-intl to 10.1.23 in only one of three exact-pinned locations, leaving the shared UI package's peer contract out of step with both its own test environment and its only consumer. The remaining pins should be updated together (and the lockfile regenerated) so the workspace stays internally consistent.
Amber here. The change itself is a one-line dependency bump, but it is an incomplete/inconsistent update within an exact-pinned pnpm workspace, which is the substance of my review below.
Findings
[Major] Inconsistent react-intl version across the workspace - Convention: versions must match across the stack (High confidence)
react-intl is exact-pinned in three places, and this PR bumps only one of them:
packages/gateway-management-ui/package.jsonline 31 -peerDependencies->10.1.23(this PR)packages/gateway-management-ui/package.jsonline 57 -devDependencies-> still10.1.18components/web-console/package.jsonline 43 -dependencies-> still10.1.18(the only consumer that satisfies the peer)
Because the peer is pinned to an exact version, the shared package now declares it requires exactly 10.1.23, yet:
- Its own dev/test environment builds and runs
vitestagainst10.1.18, so the version it now advertises to consumers is never actually exercised by its tests. - The consumer app (
web-console) still provides10.1.18, so the peer requirement is unmet - a version skew for a library whoseIntlProvider/context is shared with the host app.
CLAUDE.md's "image references must match across the stack" applies by analogy to pinned dependency versions: after a version bump, all pins for the same package should move together. Fix by bumping react-intl to 10.1.23 in the two remaining locations (or keeping all three aligned) and regenerating pnpm-lock.yaml.
[Major] Lockfile not regenerated; frozen-lockfile CI may fail - CI / reproducibility (Medium confidence)
The PR modifies only package.json; pnpm-lock.yaml still records react-intl@10.1.18 throughout. .github/workflows/{lint,e2e,sdk-drift-check}.yml and the Makefile all run pnpm install --frozen-lockfile. With autoInstallPeers: true set in the lockfile, an exact peer specifier (10.1.23) that is no longer satisfied by the workspace's own devDependencies (10.1.18) can cause pnpm to consider the lockfile out of date and fail the frozen install. Regenerating the lockfile as part of the bump avoids this. (Confidence is Medium because pnpm does not record workspace peerDependencies as importer entries, so the outcome depends on pnpm's peer auto-install behavior - worth confirming the CI install step passes.)
Cross-PR coordination
No material cross-PR coordination issue requires maintainer action.
Findings Summary (ordered by severity, highest first)
- [Major]
react-intlbumped only ingateway-management-uipeerDependencies; devDependencies and theweb-consoleconsumer remain at10.1.18- Version Consistency (L31, L57) - [Major]
pnpm-lock.yamlnot regenerated;frozen-lockfileCI may fail - CI / Reproducibility (L31)
Convention Checklist
| Convention | Result |
|---|---|
| Dependency/image versions match across the stack | Fail |
| Lockfile kept in sync with package.json | Fail |
| Conventional commit message | Pass |
| "react-dom": "19.2.8", | ||
| "react-hook-form": "7.82.0", | ||
| "react-intl": "10.1.18", | ||
| "react-intl": "10.1.23", |
There was a problem hiding this comment.
This bumps the peerDependencies pin to 10.1.23, but devDependencies on line 57 of this same file, and components/web-console/package.json (line 43, the only consumer that satisfies this peer), both remain pinned to 10.1.18. With exact pins the peer requirement is now unmet and the version advertised to consumers is never exercised by this package's tests. Please move all three pins together and regenerate pnpm-lock.yaml (CI runs pnpm install --frozen-lockfile).
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Amber reviewStatus: Complete |
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
d00c74e to
a7f06e9
Compare
red-hat-konflux
Bot
changed the title
Amber reviewStatus: Complete |
amber-review-bot
left a comment
amber-review-bot
left a comment
There was a problem hiding this comment.
Verdict
REQUEST_CHANGES. The react-intl bump was applied only to the peerDependencies of the two workspace packages, leaving their devDependencies, the consuming web-console app, and the lockfile all pinned at 10.1.18, so the update's stated goal is not actually achieved and the declared peer requirement is now unmet and untested.
Amber here. This is a Konflux/renovate dependency PR titled "Update dependency react-intl to v10.1.25", but the change is incomplete and internally inconsistent: it edits two peerDependencies entries and nothing else, so no part of the repository is installed, built, or tested against 10.1.25.
Findings
[Major] Version bump applied to peerDependencies only, creating declared-vs-actual drift - Dependency Consistency
The diff changes react-intl from 10.1.18 to 10.1.25 in the peerDependencies blocks of both packages, but the surrounding sources still pin 10.1.18:
packages/gateway-management-ui/package.jsonL31 (peerDependencies) is now10.1.25, but L57 (devDependencies) is still10.1.18.packages/operational-dashboard-ui/package.jsonL28 (peerDependencies) is now10.1.25, but L58 (devDependencies) is still10.1.18.components/web-console/package.jsonL46 - the app that consumes both workspace packages - still declaresreact-intlat10.1.18.pnpm-lock.yamlstill recordsspecifier: 10.1.18/version: 10.1.18for every importer.
Consequences:
- The packages declare an exact peer requirement of
10.1.25, but every actual provider in the workspace (their own devDependencies, the web-console app, and the resolved lockfile) supplies10.1.18, so the peer requirement is unmet the moment this merges. - Because devDependencies and the lockfile are unchanged, the packages continue to be built and tested against
10.1.18. Nothing exercises10.1.25, so the PR does not accomplish what its title claims.
Fix: bump react-intl consistently across all four locations (both peerDependencies and devDependencies in the two packages, plus components/web-console/package.json) and regenerate pnpm-lock.yaml (pnpm install) so the lockfile pins 10.1.25. Alternatively, if the intent is to keep 10.1.18, revert this PR. Confidence: High.
Note on CI: with pnpm defaults (strict-peer-dependencies off) the unmet peer is a warning rather than a hard failure, and --frozen-lockfile still matches because the unchanged devDependencies/lockfile specifiers agree - so this may pass CI while still being wrong. That is precisely why it warrants attention rather than relying on CI to catch it.
Cross-PR coordination
No material cross-PR coordination issue requires maintainer action.
Findings Summary (ordered by severity, highest first)
- [Major] react-intl bumped only in
peerDependencies; devDependencies, web-console consumer, and lockfile remain on10.1.18, so the update is incomplete and the peer requirement is unmet/untested - Dependency Consistency (gateway L31/L57, dashboard L28/L58)
Convention Checklist
| Convention | Result |
|---|---|
| Image/dependency references consistent across the stack | Fail |
| Lockfile in sync with manifests | Fail |
| Conventional commit message | Pass |
| No em dashes in text files | Pass |
| "react-dom": "19.2.8", | ||
| "react-hook-form": "7.82.0", | ||
| "react-intl": "10.1.18", | ||
| "react-intl": "10.1.25", |
There was a problem hiding this comment.
[Major] react-intl is bumped to 10.1.25 here in peerDependencies, but this same file still pins react-intl: 10.1.18 in devDependencies (L57), and pnpm-lock.yaml still resolves 10.1.18. The package therefore declares a peer requirement of 10.1.25 while continuing to build and test against 10.1.18. Bump both entries and regenerate the lockfile so the declared peer, the installed dev version, and the lockfile all agree.
| "react": "19.2.8", | ||
| "react-dom": "19.2.8", | ||
| "react-intl": "10.1.18", | ||
| "react-intl": "10.1.25", |
There was a problem hiding this comment.
[Major] Same inconsistency as the gateway package: peerDependencies is now 10.1.25 but devDependencies (L58) and pnpm-lock.yaml still pin 10.1.18. Additionally components/web-console/package.json (the consumer of this package) still declares react-intl: 10.1.18, so the new peer requirement is unmet. Bump devDependencies here, update the web-console dependency, and regenerate the lockfile.
amber-review-bot
added
the
amber/changes-requested
red-hat-konflux
Bot
changed the title
2 participants
This PR contains the following updates:
10.1.18→10.1.25Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
formatjs/formatjs (react-intl)
v10.1.25: react-intl: 10.1.25Compare Source
10.1.25 (2026-08-30)
What's Changed
Full Changelog: https://github.com/formatjs/formatjs/compare/react-intl@10.1.24...react-intl@10.1.25
Dependencies
v10.1.24: react-intl: 10.1.24Compare Source
10.1.24 (2026-08-28)
What's Changed
Full Changelog: https://github.com/formatjs/formatjs/compare/react-intl@10.1.23...react-intl@10.1.24
v10.1.23: react-intl: 10.1.23Compare Source
10.1.23 (2026-08-23)
What's Changed
Full Changelog: https://github.com/formatjs/formatjs/compare/react-intl@10.1.22...react-intl@10.1.23
v10.1.22: react-intl: 10.1.22Compare Source
10.1.22 (2026-08-16)
What's Changed
Full Changelog: https://github.com/formatjs/formatjs/compare/react-intl@10.1.21...react-intl@10.1.22
v10.1.20: react-intl: 10.1.20Compare Source
10.1.20 (2026-08-02)
What's Changed
Full Changelog: https://github.com/formatjs/formatjs/compare/react-intl@10.1.19...react-intl@10.1.20
v10.1.19: react-intl: 10.1.19Compare Source
10.1.19 (2026-07-30)
What's Changed
patches/typescript@7.0.2.patchby @andersk in #6929New Contributors
Full Changelog: https://github.com/formatjs/formatjs/compare/react-intl@10.1.18...react-intl@10.1.19
Dependencies
Configuration
📅 Schedule: (in timezone America/New_York)
* 0-7 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.