chore(deps): bump del-cli from 5.1.0 to 7.0.0 - #980
Conversation
Bumps [del-cli](https://github.com/sindresorhus/del-cli) from 5.1.0 to 7.0.0. - [Release notes](https://github.com/sindresorhus/del-cli/releases) - [Commits](sindresorhus/del-cli@v5.1.0...v7.0.0) --- updated-dependencies: - dependency-name: del-cli dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
There was a problem hiding this comment.
Dependabot review: del-cli 5.1.0 → 7.0.0 — safe to merge ✅
How it's used
del-cli is a dev-only build tool with a single usage in the repo: the clean script in packages/react-native/package.json → del-cli android/build dist. Both arguments are plain directory paths (no globs, no flags). It's wired through the pnpm catalog, and this PR updates the catalog specifier ^5.0.0 → ^7.0.0.
Changelog review (5→7, plus underlying del 7.1.0→8.0.1)
- del-cli v6.0.0: require Node 18; dep updates.
- del-cli v7.0.0: require Node 20; improved error presentation (new
presentable-errordep);--dry-runfix + help-text clarification (this repo doesn't use--dry-run). delv8.0.0: only breaking change is require Node 18; dependency bumps (globby 13→14, p-map 5→7, slash 4→5). No API/behavior change for non-glob directory deletion.- Net effect on the lockfile is a reduction (meow 14 has no dependencies) — 346 lines removed.
Node requirement
del-cli v7 needs Node 20 (via meow 14). The repo's .nvmrc is v24 and the react-native package's engines.node is >= 24.0.0, so this is satisfied in CI.
Security / performance
Dev-only build tool used only in a clean script. New transitive deps are standard sindresorhus packages, and the dependency tree shrinks overall. Socket Security and CodeQL checks on the PR pass.
Verification performed
pnpm install --frozen-lockfilesucceeds → lockfile is consistent.- Ran the actual
cleanscript: it deletesandroid/buildanddistwhile preserving the rest ofandroid/(build.gradle, src, gradle…). Behavior is identical to 5.1.0. - CI: lint-and-test, CodeQL, Socket Security, and Auto Format are green.
No code changes were needed. (Minor note: dependabot labels this direct:production, but it is effectively a devDependency.)
Bumps del-cli from 5.1.0 to 7.0.0.
Release notes
Sourced from del-cli's releases.
Commits
77857ae7.0.0aba3b05Require Node.js 206562054Add tests for directory paths with trailing slash822f27cImprove error presentationf71aaa6Fix--dry-runbehavior and clarify help textf6e46056.0.0de54031Require Node.js 18 and update dependencies028ebb1Meta tweaksDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)