build(deps): bump vite from 8.2.0 to 8.2.1 in the npm-dependencies group - #2
Closed
dependabot[bot] wants to merge 34 commits into
Closed
build(deps): bump vite from 8.2.0 to 8.2.1 in the npm-dependencies group#2dependabot[bot] wants to merge 34 commits into
dependabot[bot] wants to merge 34 commits into
Conversation
Type-narrow untrusted backup manifest data at the validation boundary in RestorePortfolioBackup instead of leaking mixed downstream, and guard raw DB/query values in the analytics widgets and middleware.
Widen types that json_decode/stdClass property access can't honestly narrow to string keys, and guard mixed-typed backfill columns before use. The export action's eager-load ordering closure is inlined since Builder::with() types its parameter as Relation<*,*,*>, which can't resolve the Project::ordered() scope through Larastan.
Added an image to the README
Centralize derived titles, descriptions, canonical URLs, locale handling, crawler directives, social metadata, and Schema.org profile data in PortfolioMetadata. Expand the Filament settings editor with indexing controls, production-origin validation, locale and social-handle validation, sharing-image constraints, and live search and social previews. Publish a sitemap only for indexable portfolios, carry the new settings through backup export and restore, and remove the unused SEO keywords field from the pre-release schema. Cover metadata fallbacks, indexing behavior, sitemap output, form validation, uploads, seed defaults, and backup round trips with focused feature tests.
Remove the deployment URL from portfolio content, persistence, seed data, and portable backups. Use the configured Laravel application URL for canonical links, social media, structured data, and sitemap output while preserving safe noindex behavior for invalid configuration. Show APP_URL as read-only deployment information in the admin SEO preview and cover the configuration-driven behavior with focused feature tests.
Use direct array indexing for decoded backup manifest records so Pest and static analysis agree on numeric keys. Annotate Laravel filesystem adapters and DOM elements at their type-narrowing boundaries, removing false-positive Intelephense method warnings without changing test behavior.
Render a cached SVG favicon from the same initials and validated appearance colors used by the navigation mark. Version the favicon URL when branding changes, remove the static Laravel icon assets, and cover the generated mark and response metadata in the public portfolio feature test.
Replace x-responsive-image with x-portfolio-image. The old component rendered a picture element with a webp srcset that nothing ever produced: both seeded placeholders are SVGs and every call site passed an empty webpSources array. The replacement keeps the storage-path resolution and the explicit width and height that actually prevent layout shift. Collapse four copies of the http(s) URL check and two copies of the web/mailto/tel social link validator into SiteSetting::isWebUrl() and SiteSetting::isSafeSocialLinkUrl(), so the Filament form rule and the backup restore validator can no longer drift on which schemes are safe. Hoist the repeated PortfolioMetadata calls in the document head, drop a no-op array_unique over distinct contrast messages, simplify a redundant branch in mediaUrl(), and rename PortfolioMediaSeeder::ORIGINAL_IMAGES to PLACEHOLDER_IMAGES now that no variants exist. Remove a test asserting a constant equals its own literal value along with the assertions guarding against variants the code can no longer emit.
The README still described the portfolio as a Blade-only redesign and listed a homepage variable contract from before the metadata refactor. Document the Appearance and SEO & Sharing tabs, note that APP_URL is the sole canonical origin, and correct the HomeController contract to include $metadata, $logoInitials, and $faviconVersion alongside the rename of x-responsive-image to x-portfolio-image. Agent guidance now lists site_locale and is_indexable among the required site settings, and directs appearance writes through resolveAppearance() and appearanceContrastFailures() rather than raw JSON, matching what the Filament form and backup restore already enforce. CLAUDE.md had drifted because only AGENTS.md was ever hand-edited, so it becomes a symlink to keep the pair from diverging again.
Dependabot only watched github-actions, leaving composer.json and package.json dependencies unmonitored. Add both ecosystems, grouping the Laravel/Livewire/Filament trio and dev-only tooling separately from the individually reviewed production packages, and grouping the small npm surface as one PR. tests.yml queued a full run on every push and PR sync regardless of what changed, with no cap on a hung step. Add a concurrency group so a new push cancels a stale in-flight run, a 5-minute timeout, and a paths-filter step that skips PHP setup and composer ci:check (and still reports success) unless the diff touches PHP, Blade, JS/CSS, Vite/Composer/Pint/PHPStan config, or the workflow file itself.
Bumps the npm-dependencies group with 2 updates: [concurrently](https://github.com/open-cli-tools/concurrently) and [@rollup/rollup-linux-x64-gnu](https://github.com/rollup/rollup). Updates `concurrently` from 9.2.4 to 10.0.4 - [Release notes](https://github.com/open-cli-tools/concurrently/releases) - [Commits](open-cli-tools/concurrently@v9.2.4...v10.0.4) Updates `@rollup/rollup-linux-x64-gnu` from 4.9.5 to 4.62.4 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.9.5...v4.62.4) --- updated-dependencies: - dependency-name: concurrently dependency-version: 10.0.4 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-dependencies - dependency-name: "@rollup/rollup-linux-x64-gnu" dependency-version: 4.62.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
The comment said "v2", shivammathur/setup-php's moving major-version alias, even though the pinned SHA already corresponds to the exact 2.37.2 release. Match the precise-tag comment style used for the other pinned actions in this workflow.
@rollup/rollup-linux-x64-gnu is declared under optionalDependencies in package.json but the lockfile's root manifest also listed it under dependencies, left over from the last dependency bump. Regenerate to match.
Ran composer update, bumping Filament to 5.7.6 and other direct/transitive packages. Includes the vendor-published assets and Boost skill files that laravel/boost's post-update hook regenerates alongside it.
boost:update regenerates AGENTS.md wholesale from Laravel Boost's guidelines, which silently dropped the hand-written Tinker-CMS-write and portfolio-backup sections during today's composer update. .ai/rules is never touched by that regeneration, so move both there instead: the Tinker content-write rules into a new models.md scoped to the CMS models, and the backup size/prerequisite limits into the existing actions.md alongside the restore-scope rule it already had.
Bumps the npm-dependencies group with 1 update: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `vite` from 8.2.0 to 8.2.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.2.1/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/npm-dependencies-7f7e8a2361
branch
August 19, 2026 18:16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm-dependencies group with 1 update: vite.
Updates
vitefrom 8.2.0 to 8.2.1Release notes
Sourced from vite's releases.
Changelog
Sourced from vite's changelog.
Commits
4216158release: v8.2.1fddf4eafix(server): use a random port when port is 0 (#23158)de041a7fix(css): don't re-run lightningcss visitor during minify (fix #23146) (#23147)15f0307fix(build): make client chunkImportMap work withsharedPlugins: true(#23184)c2155fetest(bundled-dev): enable sourcemap playgrounds (#23080)ef02435docs(build): fix incomplete@defaultfor build.minify (#23177)eac0cc8fix(bundled-dev): inject client script tag before chunk scripts (#23161)23b8a08refactor(bundled-dev): avoid injecting server values in the bundle (#22967)e72036erefactor(bundled-dev): remove rolldown lazy stub module workaround (#23129)14454fdfix(deps): update all non-major dependencies (#23136)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions