build(deps-dev): bump tsdown from 0.18.4 to 0.22.14 - #57
Conversation
Bumps [tsdown](https://github.com/rolldown/tsdown) from 0.18.4 to 0.22.14. - [Release notes](https://github.com/rolldown/tsdown/releases) - [Commits](rolldown/tsdown@v0.18.4...v0.22.14) --- updated-dependencies: - dependency-name: tsdown dependency-version: 0.22.14 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Approve — this is a routine devDependency bump (tsdown ^0.18.0 to ^0.22.14) with a mechanically regenerated lockfile; no source or config files changed. The inline finding about tsdown's new engines.node requirement (^22.18.0 || >=24.11.0) being narrower than the repo's declared >=22 is a real but minor metadata mismatch — it's a devDependency only, and pnpm just warns on engine mismatches by default (no engine-strict setting in this repo), so it does not block installs or builds.
Extended reasoning...
Overview
The diff touches only package.json and pnpm-lock.yaml, bumping the devDependency tsdown (a build tool used to compile the TypeScript sources) from ^0.18.0 to ^0.22.14. No application source, runtime dependency, or CI/config file is modified. Confirmed via git diff that the only package.json change is the single version-range line; the lockfile diff is the expected transitive dependency-tree churn from resolving the new tsdown range.
Security risks
tsdown is a build-time-only tool (not bundled into runtime output), so there is no direct attack surface exposed to end users of this package from this change. Standard supply-chain risk applies to any dependency bump (trusting upstream releases), but this is a well-known, actively maintained tool pulled via the normal pnpm lockfile resolution — no unusual or unpinned sources were introduced.
Level of scrutiny
This warrants light scrutiny consistent with a routine dependency-bump PR: verify the package.json/lockfile changes are consistent and check for any newly introduced constraint mismatches (e.g., engines, peer deps) that could affect CI or downstream consumers. I confirmed the one substantive issue already surfaced as an inline finding — tsdown 0.22.14's engines.node: ^22.18.0 || >=24.11.0 (pnpm-lock.yaml:936) is stricter than this repo's own engines.node: ">=22" (package.json:52) — but judged it a minor nit rather than a blocking issue, since pnpm only warns (not errors) on engine mismatches absent an engine-strict config, and no such config exists in this repo (checked for .npmrc/.pnpmrc, found none). CI pins Node via node-version: 22.x in .github/workflows/ci.yml, which resolves to the latest 22.x patch at runtime and is likely to satisfy ^22.18.0 in practice, though this isn't guaranteed for all contributor environments.
Other factors
No CODEOWNERS/ANTOWNERS restrictions apply to package.json/pnpm-lock.yaml in this repo, and this is a Dependabot-originated PR with no prior review conversation or outstanding third-party objections to weigh. The change is small, self-contained, and mechanical in nature, fitting squarely within the approval criteria for version bumps.
| engines: {node: '>=20.19.0'} | ||
| tsdown@0.22.14: | ||
| resolution: {integrity: sha512-ule7Y+fsAN2iZbLDoo7C4KYljFJNJJ+fLshyn+9gozeTspVersWHxwdGB+Dm2hzA38s6muFnUTl0jK3vJm9ifQ==} | ||
| engines: {node: ^22.18.0 || >=24.11.0} |
There was a problem hiding this comment.
🟡 tsdown 0.22.14's own engines field now requires node ^22.18.0 || >=24.11.0 (pnpm-lock.yaml:936), stricter than the repo's declared engines.node ">=22" in package.json:52. Previously tsdown 0.18.4 only required node >=20.19.0 (well within the repo's range), so this bump introduces a new mismatch between the repo's stated Node support and an actual devDependency's requirement.
Extended reasoning...
A contributor or CI runner using Node 22.0-22.17 (valid per the repo's own package.json engines contract, which this diff does not update) runs pnpm install/build; pnpm emits an unsupported engine warning for tsdown (and pnpm install can fail outright if engine-strict is ever enabled), a regression that did not exist before this bump since 0.18.4's node >=20.19.0 requirement was satisfied by the same range. Fix: bump package.json engines.node to match tsdown's actual minimum (e.g. >=22.18.0) or pin CI/dev tooling accordingly.
Verification: Severity: nit. The mismatch is factually real. pnpm-lock.yaml:936 records engines: {node: ^22.18.0 || >=24.11.0} for tsdown@ 0.22.14, whereas package.json:51-52 declares "engines": {"node": ">=22"}. On the base branch tsdown@ 0.18.4 required only node >=20.19.0 (satisfied by >=22), so this bump does introduce a new gap for contributors on Node 22.0-22.17. However the consequence is minor
Bumps tsdown from 0.18.4 to 0.22.14.
Release notes
Sourced from tsdown's releases.
... (truncated)
Commits
ff3bdbdchore: release v0.22.148a14c35feat: add CLI build concurrency option0525465docs: add note aboutcjsDefaultonly applying to explicit entry modulesa3a3551refactor: fix lint3dec506refactor: use nativePromise.withResolverse0266c1docs: add tsdown users imagea733505refactor: upgrade verkit, simplify version parsee5fe2castyle: format3e1fc63chore: release v0.22.13a6c8734chore: upgrade depsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)