build(deps-dev): bump c8 from 11.0.0 to 12.0.0 - #78
Merged
Conversation
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/c8-12.0.0
branch
from
July 22, 2026 23:49
8477687 to
8d965ca
Compare
Bumps [c8](https://github.com/bcoe/c8) from 11.0.0 to 12.0.0. - [Release notes](https://github.com/bcoe/c8/releases) - [Changelog](https://github.com/bcoe/c8/blob/main/CHANGELOG.md) - [Commits](bcoe/c8@v11.0.0...v12.0.0) --- updated-dependencies: - dependency-name: c8 dependency-version: 12.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/c8-12.0.0
branch
from
August 3, 2026 23:53
8d965ca to
85a3c6d
Compare
hannsxpeter
added a commit
that referenced
this pull request
Aug 4, 2026
Merging PR #78 changed the root package.json, which invalidates the package.json source hash recorded in the roadmap's Evidence Provenance block. Dependabot cannot run `npm run version:sync`, so main goes red on `roadmap:hash:package.json` the moment any root-dependency pull request lands. This is the repair, not a fix for the underlying friction. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
hannsxpeter
added a commit
that referenced
this pull request
Aug 4, 2026
The roadmap's Evidence Provenance block hashed package.json, asserting a derivation that does not exist: god-roadmapper is spawned with the PRD and ARCH paths and never reads the manifest, ROADMAP.mdx derives no content from it, and the one value it does take, the version, is already asserted by roadmap:source-version. What the hash actually did was fail every pull request touching a root dependency, because Dependabot cannot run version:sync. PR #78 failed on exactly that with all three Node jobs green and coverage complete; c8 was never the problem. The documented remedy re-stamped the hash blind, and across 151 commits touching package.json it never once made anybody read a diff, which is U-07 inside a guard. The three genuine sources keep whole-file hashes at full strength. A new regression test proves a devDependency bump leaves roadmap evidence valid, and the staleness test is repointed at PRD.mdx rather than deleted. The deletion is paid for with more coverage than it removes: a root manifest shape check asserts the exact top-level key set and that dependencies, optionalDependencies and peerDependencies are all empty. The old check read only dependencies, so ADR-002's no-production-dependency claim could have been broken through optionalDependencies with nothing in the repo noticing. Also lands Dependabot PR #78 (c8 12, devDependency only, engines.node stays >=18) and PR #89 (checkout v7.0.1, setup-node v7.0.0, setup-python v7.0.0 across all four workflows). Self-truth ledger: 141 -> 140 checks. Static check: +1. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps c8 from 11.0.0 to 12.0.0.
Release notes
Sourced from c8's releases.
Changelog
Sourced from c8's changelog.
Commits
ae5a0cfchore(main): release 12.0.0 (#600)dc2d6c8feat!: update yargs to 18.x.x (#599)ee2f1cfchore(deps): update dependency@types/nodeto v24 (#579)923c238build: go back to publishing manually