You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
You can trigger a rebase of this PR by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Note
Low Risk
Low risk devDependency bump only, but it may change property-based test generation behavior and impact test stability/coverage.
Overview
Updates the fast-check devDependency from 4.6.0 to 4.7.0 across the root/injected and special-pages packages, and refreshes package-lock.json to the new resolved tarball and integrity hash.
Reviewed by Cursor Bugbot for commit d2101de. Bugbot is set up for automated code reviews on this repo. Configure here.
Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.
Suggested comment for Cursor review (copy and paste as a new comment):
@cursoragent can you review against the current code and outline potential impacts based on the changelogs of the update?
Can you check the test coverage and ensure that the new code is covered?
Can you think through if this dependency is still needed or if there's better practices used elsewhere.
Can you draft a separate PR with any fixes that might be needed?
Note: GitHub Actions bot cannot trigger Cursor agent directly. Please copy the above comment to invoke the review.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Web Compatibility Assessment
injected/package.json (devDependencies fast-check), special-pages/package.json (devDependencies fast-check), package-lock.json (lockfile resolution updates) — severity: info
Change scope is dependency metadata only (fast-check4.6.0 → 4.7.0) with no edits to injected runtime feature code, wrapper/shim utilities, API overrides, platform entry points, or DOM interaction paths. No observed risk to API surface fidelity, prototype-chain behavior, or third-party script compatibility from changed lines.
Security Assessment
injected/package.json, special-pages/package.json, package-lock.json — severity: info
This PR does not modify hostile-page trust-boundary code (captured globals, message bridge, transport validation, exemption logic, or iframe/origin handling). fast-check remains a dev-only dependency here, so there is no direct production-path expansion of attack surface from the diff itself.
Risk Level
Low Risk — Dependency-only dev-tooling bump with lockfile refresh; no runtime JavaScript injection or security-control-path modifications.
Recommendations
Keep CI coverage for property-based tests enabled in both injected and special-pages to catch generator/arb behavior shifts introduced by fast-check updates.
If determinism becomes an issue after the bump, standardize seeded runs in affected tests to reduce flake sensitivity.
Alternative hardening option: consider exact pinning (or workspace-level override) for fast-check in CI-critical lanes if reproducibility is prioritized over automatic minor uptake.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Dependency Risk Review: fast-check 4.6.0 → 4.7.0
Confirmed findings
No blocking issues found.
Evidence:
PR diff is limited to version metadata in injected/package.json, special-pages/package.json, and package-lock.json.
Lockfile shows only node_modules/fast-check tarball/version changed (4.6.0 → 4.7.0); no additional transitive churn in this diff.
Upstream changelog for 4.7.0 lists feature additions mainly around stringMatching unicode property parsing (\\p{} / \\P{}) plus reversible json arbitrary, with no breaking-change notes.
Test coverage check
fast-check is actively used in property tests in both affected workspaces (injected/unit-test/*properties*, injected/unit-test/timer-utils.js, special-pages/unit-test/color.spec.mjs, special-pages/unit-test/translations.mjs).
Generator behavior drift risk (low):fast-check minor updates can shift generated-case distributions/shrinking behavior. This can subtly change fuzzing signal over time even when tests pass in a single run.
Assumption: this repo does not rely on deterministic fast-check failure shrinking output as a contract.
Validation if desired: run CI with multiple seeds for the few property suites using fc.stringMatching.
Scope of new unicode regex support not directly exercised: repo usages of fc.stringMatching are ASCII regexes, so new unicode-property support paths in 4.7.0 are not directly covered here.
This is acceptable for current usage; just noting coverage boundary.
Is dependency still needed?
Yes. fast-check is still justified: it is used by multiple property-based test suites across injected and special-pages, and remains a dev-only dependency (not shipped in runtime bundles).
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Web Compatibility Assessment
injected/package.json (around 53-57) — info: fast-check dev dependency bumped from ^4.6.0 to ^4.7.0. This does not modify injected feature code, wrapper utilities, platform entry points, or any browser API shim surface, so no direct site compatibility regression vector is introduced.
special-pages/package.json (around 31-35) — info: same dev dependency bump in special-pages workspace only; no runtime JS/CSS behavior change on embedded pages from this diff alone.
package-lock.json (around 55-57, 4726-4734, 10891-10895) — info: lockfile refresh consistent with manifest updates; no additional runtime dependency tree changes beyond fast-check package metadata/version.
Security Assessment
injected/package.json / special-pages/package.json / package-lock.json (lines above) — info: change is limited to test tooling (devDependencies) and lockfile integrity hashes; no modifications to captured globals, message bridge, transports, wrapper/shim logic, exemption logic, or any runtime code executing in hostile page contexts.
package-lock.json (node_modules/fast-check entry) — info: integrity hash updated as expected for new tarball; no suspicious transitive additions in this diff segment.
Risk Level
Low Risk — dependency-only dev-tooling bump with no production injected-script code changes and no touched security-sensitive subsystems.
Recommendations
Run npm run test-unit (or targeted workspace unit suites using property-based tests) to catch any behavioral differences in arbitraries/shrinking introduced by fast-check4.7.0.
If deterministic CI reproducibility is prioritized over automatic patch/minor pickup, consider pinning exact fast-check versions instead of caret ranges in workspace manifests.
Keep Dependabot lockfile-only updates isolated (as here) to preserve rollback simplicity if test flakiness appears.
The reason will be displayed to describe this comment to others. Learn more.
Dependency review for fast-check4.6.0 -> 4.7.0:
Confirmed Findings
No blocking security or behavior regressions found in this PR diff.
Evidence:
Diff only updates manifests/lockfile: injected/package.json, special-pages/package.json, package-lock.json.
fast-check is a dev-only dependency in both workspaces (test-time only).
Repository callsites are limited to property-based unit tests in injected/unit-test/* and special-pages/unit-test/*.
Targeted validation passed after install:
npm run test-unit -w injected (889 specs passed, 0 failures)
npm run test-unit -w special-pages (104 tests passed, 0 failures)
Changelog Impact Assessment (4.7.0)
Upstream 4.7.0 changes are mainly:
reversible json arbitrary
stringMatching support for Unicode property escapes (\p{} / \P{})
Impact on this repo appears low:
We use fc.stringMatching(...), but current patterns are ASCII-focused and do not use Unicode property escapes.
No production/runtime code imports fast-check; usage remains test-only.
Uncertain / Residual Risk
Non-blocking: stringMatching parser updates can still subtly alter generated case distribution and shrinking behavior, potentially changing deterministic seeds or exposing latent flaky assertions over time. Current unit runs did not reproduce issues, but CI history should be watched for new test flake patterns.
Dependency Necessity / Alternatives
fast-check is still actively used and provides broad negative-input coverage that would be expensive to replace with ad-hoc loops.
Alternative if we want to reduce third-party surface: replace selected properties with deterministic fixture tests in high-value paths only.
Tradeoff: reduced fuzz coverage and less ability to discover edge cases.
No follow-up fix PR is needed based on current evidence.
A newer version of fast-check exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.
The reason will be displayed to describe this comment to others. Learn more.
Web Compatibility Assessment
File: injected/package.json; lines 53-57; severity: info fast-check is bumped only in devDependencies. This does not change injected runtime feature code, wrapper utilities, browser API shims, platform entry points, DOM manipulation, or third-party script-visible behavior.
File: special-pages/package.json; lines 31-35; severity: info
Same dev-only property-testing dependency bump. No embedded page runtime code, CSS, messaging contract, or browser API interaction is modified by this diff.
File: package-lock.json; relevant package and workspace dependency entries; severity: info
Lockfile update is consistent with fast-check4.6.0 -> 4.7.0; transitive dependency remains pure-rand only, with no additional dependency-tree expansion observed.
Security Assessment
File: injected/package.json; lines 53-57; severity: info
No change to hostile-page trust-boundary code: captured globals, wrapper/shim primitives, message bridge, origin validation, stack-trace exemptions, iframe access, or load-time injected behavior are untouched.
File: special-pages/package.json; lines 31-35; severity: info fast-check remains test tooling only; it is not part of production special-page bundles from this diff.
File: package-lock.json; relevant node_modules/fast-check entry; severity: info
Tarball metadata/integrity changed as expected for the version bump, with no new runtime package surface introduced.
Risk Level
Low Risk — dependency-only dev-tooling bump with no production injected-script or security-control-path changes.
Recommendations
No blocking changes needed.
Keep property-based unit suites in CI for both affected workspaces to catch future arbitrary/shrinking behavior drift.
If deterministic CI output becomes important, consider exact pinning for fast-check; otherwise the current caret range is consistent with normal Dependabot minor updates.
Validation performed:
npm ci
npm run build --workspace injected
npm run test-unit --workspace injected (929 specs, 0 failures)
npm run test-unit --workspace special-pages (104 tests, 0 failures)
The reason will be displayed to describe this comment to others. Learn more.
Dependency risk review for fast-check 4.6.0 -> 4.7.0:
No confirmed concerns found.
Evidence checked:
Diff only updates fast-check in injected/package.json, special-pages/package.json, and package-lock.json; the lockfile entry remains dev: true.
Upstream 4.7.0 changelog lists new fc.stringMatching support for Unicode property escapes (\p{} / \P{}) and reversible fc.json() shrinking. Current repo usage imports fast-check only from unit/property tests; there is no fc.json() usage, and existing fc.stringMatching regexes use ASCII character classes rather than Unicode-property escapes.
Package metadata did not show a dependency/engine/maintainer/license change relevant to this bump: still pure-rand@^8.0.0, Node >=12.17.0, MIT, same npm maintainer, 11 package files.
npm audit --package-lock-only did not attribute any advisory to fast-check or pure-rand. It still reports unrelated pre-existing advisories elsewhere in the tree.
The reason will be displayed to describe this comment to others. Learn more.
No blocking dependency-update concerns found.
Reviewed fast-check 4.6.0 -> 4.7.0 against the upstream release notes. The release adds reversible json arbitrary behavior and Unicode property support in stringMatching; I did not find breaking changes called out. In this repo fast-check is only a devDependency used by unit/property tests, so there is no production runtime/privacy surface change. The current stringMatching usages are simple ASCII regexes, and I found no fc.json usage.
Validation performed:
npm ci
npm ls fast-check --all confirms fast-check@4.7.0 for injected and special-pages
npm audit report has no advisories involving fast-check or pure-rand
GitHub CI gate is green, including unit and integration jobs
No separate fix PR drafted because I did not find changes needed.
Sent by Cursor Automation: Review dependabot
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesUpdate one or more dependencies versionminorIncrement the minor version when mergedsemver-patchBug fix / internal — no release needed
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Bumps fast-check from 4.6.0 to 4.7.0.
Release notes
Sourced from fast-check's releases.
Changelog
Sourced from fast-check's changelog.
Commits
fd1a184🔖 Update CHANGELOG.md for fast-check@4.7.0 (#6873)6661a31✨ Support negated unicode properties instringMatching(#6871)332f905✨ Support for\p{UnicodeProperty}instringMatching(#6870)285ed56✨ Parse\p{}and\P{}instringMatching(#6868)1e5d774✨ Reversiblejsonarbitrary (#6866)f16e672📝 Integrate API reference natively into our doc (#6855)e82af33🔨 Migrate from ESLint to oxlint (#6835)a82f7a1⬆️ Update dependency typedoc to ^0.28.19 (#6847)104640c⬆️ Update dependency@microsoft/api-extractorto ^7.58.2 (#6828)b3c86c2⬆️ Update typescript-eslint monorepo to ^8.58.1 (#6826)You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Low risk devDependency bump only, but it may change property-based test generation behavior and impact test stability/coverage.
Overview
Updates the
fast-checkdevDependency from4.6.0to4.7.0across the root/injected andspecial-pagespackages, and refreshespackage-lock.jsonto the new resolved tarball and integrity hash.Reviewed by Cursor Bugbot for commit d2101de. Bugbot is set up for automated code reviews on this repo. Configure here.