chore(deps): bump stylelint-scss from 5.3.2 to 7.2.0 - #15127
chore(deps): bump stylelint-scss from 5.3.2 to 7.2.0#15127dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
🔵 Review postedLast updated: 2026-08-02 21:16 UTC |
npm Package VersionsWarning The following packages have changed files but no version bump:
If these changes affect published code, consider bumping the version. |
Build Artifacts
Smoke test screenshot |
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #15127 — stylelint-scss 5.3.2 → 7.2.0 in packages/kolibri-format. Major bump (two majors), and it sits in dependencies, not devDependencies, of a published package (private: false). CI passes — but see below, none of 7.2.0's code runs in CI.
Changelog (5.3.2 → 7.2.0)
- Breaking (7.0.0): peer range is now
stylelint@^16.8.2 || ^17.0.0; package converted to ES Modules; Node floor raised to>=20.19.0; four deprecatedat-import-partial-extension*rules removed. - Behavioural (6.13.0): all rules migrated off
context.fixonto stylelint 16.8.2's autofix callback. - Security fixes: none in the range.
- Node engines: fine — root and
kolibri-formatalready require>= 20.19.0. - Removed rules: not an issue — none are configured by
.stylelintrc.jsor the extended configs (scss/at-import-partial-extension-disallowed-liststill ships in 7.2.0).
Blocking — unmet peer dependency. kolibri-format still pins "stylelint": "^15.11.0", and the lockfile records the mismatch verbatim (stylelint-scss@7.2.0 peer ^16.8.2 || ^17.0.0, resolved against stylelint@15.11.0). pnpm only warns, so --frozen-lockfile in CI is green; npm hard-fails with ERESOLVE, and npm_publish.yml publishes this package on changes to its package.json. Reproduced with pnpm 10.19.0 / Node 20.20.2:
└─┬ stylelint-scss 7.2.0
└── ✕ unmet peer stylelint@"^16.8.2 || ^17.0.0": found 15.11.0
Blocking — the bump changes nothing about linting. stylelint-scss is never named in a plugins array; it arrives via extends: ['stylelint-config-recommended-scss', 'stylelint-config-sass-guidelines'], both of which depend on stylelint-scss@6.14.0 directly. stylelint resolves plugin specifiers relative to the declaring config, so 6.14.0 is what loads — confirmed behaviourally: scss/at-import-partial-extension (removed in 7.0.0) still resolves as a known rule. The top-level entry is a dedupe pin that no longer dedupes (6.14.0 remains in the lockfile after this PR), and green CI is not evidence 7.2.0 works here.
Behaviour to flag if 7.2.0 ever does load. SCSS autofix silently stops working under stylelint 15, since 15's report() ignores the autofix callback 6.13.0+ relies on. Linting @if (true) { … } with fix: true and scss/at-rule-conditional-no-parentheses against stylelint@15.11.0: 5.3.2 rewrites it to @if true, 7.2.0 leaves it unchanged and emits an unfixable warning. Since prek's lint-frontend hook runs stylelint in --write mode, autofixable scss/* violations would start failing commits instead of being fixed. (The ESM conversion itself is fine — stylelint 15's CJS require() of the ESM plugin works on Node ≥20.19.)
Also: npm_version_check flagged that kolibri-format (2.4.0) wasn't version-bumped. Because this is a runtime dependencies entry, the change does alter the published artifact's dependency graph.
Recommendation: hold or close. This is the coordinated stylelint upgrade @rtibbles asked for on #14492 — stylelint-config-recommended-scss (peer ^16.6.1) and stylelint-config-sass-guidelines (peer ^16.1.0) are already mismatched against stylelint 15, and .stylelintrc.js still configures indentation and stylelint-config-prettier, both gone in stylelint 16. Land it as part of that upgrade, or @dependabot ignore this major version again until it's scheduled. I couldn't find the stylelint-upgrade follow-up issue requested on #14492 — it may still be unfiled.
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
| "stylelint-config-standard": "34.0.0", | ||
| "stylelint-csstree-validator": "3.0.0", | ||
| "stylelint-scss": "5.3.2" | ||
| "stylelint-scss": "7.2.0" |
There was a problem hiding this comment.
blocking: stylelint-scss@7.2.0 requires stylelint@^16.8.2 || ^17.0.0; line 39 of this file still pins "stylelint": "^15.11.0". pnpm only warns (so CI stays green), but npm install of the published kolibri-format fails with ERESOLVE. This needs to move as a unit with the stylelint 16/17 upgrade — which also means bumping stylelint-config-recommended-scss / -sass-guidelines / -standard and dropping indentation + stylelint-config-prettier from .stylelintrc.js.
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #15127 — no new commits since the last review (HEAD is still 1f84b423); 0 of 4 prior findings resolved, all 4 still open.
stylelint-scss 5.3.2 → 7.2.0 — major (two majors), dev dependency of packages/kolibri-format. CI passing, but CI does not exercise this: the copy stylelint actually loads is still 6.14.0.
Peer dependency change (the blocker): 7.x requires stylelint@^16.8.2 || ^17.0.0; packages/kolibri-format pins stylelint@^15.11.0. pnpm-lock.yaml:19009 records the mismatch verbatim as stylelint-scss@7.2.0(stylelint@15.11.0(...)).
The bump is also inert: pnpm-lock.yaml:9189 / :18997 still carry stylelint-scss@6.14.0, pulled in directly by stylelint-config-recommended-scss and stylelint-config-sass-guidelines (lines 18962, 18979) — the configs this repo extends. So the top-level entry is a dedupe pin that no longer dedupes, and SCSS autofix would silently break the day 7.2.0 does get loaded under stylelint 15.
Breaking changes across 6.x and 7.x: dropped stylelint 15 support, Node ≥18.12, and rule removals/renames — none of which can be evaluated while the 6.14.0 copy is what runs.
Secondary: kolibri-format (2.4.0) is a published package and its dependencies changed without a version bump.
Recommendation is unchanged: hold or close this, and land it as part of the coordinated stylelint 15 → 16/17 upgrade @rtibbles asked for on #14492 — or @dependabot ignore this major version until that work is scheduled.
Prior-finding status
UNADDRESSED — packages/kolibri-format/package.json:50 — unmet peer dependency (stylelint-scss@7.2.0 needs stylelint ^16.8.2 || ^17.0.0)
UNADDRESSED — packages/kolibri-format/package.json:50 — bump changes nothing about linting (6.14.0 still loads via the extended configs)
UNADDRESSED — packages/kolibri-format/package.json:50 — SCSS autofix silently breaks if 7.2.0 ever does load under stylelint 15
UNADDRESSED — general — kolibri-format (2.4.0) not version-bumped despite a dependencies change to a published package
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
Bumps [stylelint-scss](https://github.com/stylelint-scss/stylelint-scss) from 5.3.2 to 7.2.0. - [Release notes](https://github.com/stylelint-scss/stylelint-scss/releases) - [Changelog](https://github.com/stylelint-scss/stylelint-scss/blob/master/CHANGELOG.md) - [Commits](stylelint-scss/stylelint-scss@v5.3.2...v7.2.0) --- updated-dependencies: - dependency-name: stylelint-scss dependency-version: 7.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
1f84b42 to
138a180
Compare
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #15127 — stylelint-scss 5.3.2 → 7.2.0 in packages/kolibri-format. Major (two majors), and it sits in dependencies of a published package (kolibri-format@2.4.0, private: false), not devDependencies. CI passing.
1 prior finding still open (plus the three below it, all unchanged): the only change since the last round was a rebase onto develop — the diff is byte-identical.
Peer dependency (blocking). stylelint-scss@7.2.0 declares peer stylelint: ^16.8.2 || ^17.0.0 and engines.node: >=20.19.0 (pnpm-lock.yaml:9155-9159), but packages/kolibri-format/package.json:42 still pins "stylelint": "^15.11.0". The lockfile resolves it anyway as stylelint-scss@7.2.0(stylelint@15.11.0(...)) (pnpm-lock.yaml:18928). pnpm downgrades an unmet peer to a warning, which is why --frozen-lockfile CI stays green; npm hard-fails this with ERESOLVE. No accompanying stylelint upgrade in this PR.
The bump is inert (blocking). pnpm-lock.yaml:9149 and :18916 still carry stylelint-scss@6.14.0 alongside 7.2.0. Neither .stylelintrc.js lists stylelint-scss in a plugins array — it arrives via the extended configs (stylelint-config-recommended-scss, stylelint-config-sass-guidelines), which depend on 6.14.0 directly and resolve plugins relative to themselves. 6.14.0 is what stylelint actually loads, so green CI says nothing about 7.2.0's compatibility here.
Breaking change, latent (important). From 6.13.0 on, every rule migrated off context.fix to stylelint 16.8.2's autofix callback, which stylelint 15's report() ignores. prek's lint-frontend hook runs stylelint in --write mode, so the day 7.2.0 does load, autofixable scss/* violations would start failing commits instead of being fixed.
Version (suggestion). kolibri-format is published at 2.4.0 and this changes its dependencies graph without a version bump — the npm_version_check bot comment flags the same thing.
Recommendation. Hold this for the coordinated stylelint 15 → 16/17 upgrade @rtibbles asked for on #14492 — stylelint-config-recommended-scss (peer ^16.6.1) and stylelint-config-sass-guidelines (peer ^16.1.0) are already mismatched against stylelint 15, and .stylelintrc.js still configures indentation and stylelint-config-prettier, both removed in stylelint 16. Otherwise @dependabot ignore this major version until that work is scheduled.
Prior-finding status
UNADDRESSED — packages/kolibri-format/package.json:50 — unmet peer dependency (stylelint-scss@7.2.0 needs stylelint ^16.8.2 || ^17.0.0)
UNADDRESSED — packages/kolibri-format/package.json:50 — bump changes nothing about linting (6.14.0 still loads via the extended configs)
UNADDRESSED — packages/kolibri-format/package.json:50 — SCSS autofix silently breaks if 7.2.0 ever does load under stylelint 15
UNADDRESSED — general — kolibri-format (2.4.0) not version-bumped despite a dependencies change to a published package
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
1 participant
Bumps stylelint-scss from 5.3.2 to 7.2.0.
Release notes
Sourced from stylelint-scss's releases.
... (truncated)
Changelog
Sourced from stylelint-scss's changelog.
... (truncated)
Commits
e7c92d17.2.0ecdc3c3Prepare version 7.2.0 (#1301)ddffe93build(deps-dev): bump stylelint from 17.10.0 to 17.12.0 (#1300)6eb7630Update Jest to latest version (#1299)ac4dffbbuild(deps-dev): bump@lavamoat/allow-scriptsfrom 5.0.1 to 5.0.2 (#1298)ac1e7fabuild(deps): bump@csstools/css-calcfrom 3.2.0 to 3.2.1 (#1297)b483811build(deps-dev): bump postcss from 8.5.14 to 8.5.15 (#1295)2c88165build(deps-dev): bump lint-staged from 16.4.0 to 17.0.5 (#1292)f4aea26build(deps): bump@csstools/css-syntax-patches-for-csstree(#1294)db3c20ebuild(deps-dev): bump eslint from 10.3.0 to 10.4.0 (#1293)Most Recent Ignore Conditions Applied to This Pull Request