You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The @flopflip/* 15.1.7 → 15.1.11 bump pulls in @launchdarkly/js-client-sdk v4 as a
transitive dependency, replacing the unscoped launchdarkly-js-client-sdk v3. This is a
breaking change for SetupFlopFlipProvider in application-shell:
The LaunchDarkly user context type now requires either a key or anonymous: true,
never an optional key. getUserContextForLaunchDarklyAdapter now returns an
anonymous context when there's no authenticated user, instead of a context with an
undefined key.
sdk.clientOptions.sendEventsOnlyForVariation was removed; the new SDK's allFlags
no longer sends analytics events by default, which was the entire point of that option.
@commercetools/composable-commerce-test-data 13.12.0 → 13.13.1 pulling in @faker-js/faker v10 (which dropped its CJS build) was previously allowlisted in the
root jest.test.config.js's transformIgnorePatterns, but jest-preset-mc-app's own
preset — the one actually consumed by the standalone starter templates
(application-templates/starter{,-typescript}, custom-views-templates/starter{,-typescript})
— has its own separate transformIgnorePatterns and was missed, so their CI jobs kept
failing with Cannot use import statement outside a module. Added @faker-js/faker
to that preset's allowlist too.
Bumped the following, each a real dependencies entry (not devDependencies) of the listed package(s), so each gets a version bump here:
cosmiconfig 9.0.0 → 9.0.2, graphql 16.11.0 → 16.14.2 — jest-preset-mc-app (the jest/babel-jest/babel-preset-jest/jest-environment-jsdom/jest-mock bump was reverted; see the pnpm-regression/typecheck fix commits on this branch for why)
Other updates in this batch (@testing-library/*, @manypkg/cli, @percy/cypress, @percy/puppeteer, @preconstruct/cli, @apollo/client, jest, jest-each, react, react-dom, react-redux, @commercetools/nimbus, @commercetools/composable-commerce-test-data, @percy/cli, @percy/core, @changesets/*, rimraf, sentry-testkit, start-server-and-test, fflate, formik, qs, node, pnpm, and GitHub Actions digest/version pins) only touch devDependencies, peerDependencies, root-level repo tooling, CI configuration, or private template/playground packages, so they don't require a version bump here.
webpack 5.105.1 → 5.109.2 was reverted: webpack's ProgressPlugin now defers option-schema validation from the constructor to a compiler.hooks.validate tap, reading this.options at that later point instead of validating the raw constructor args immediately. webpackbar@5.0.2 (unmaintained, used by mc-scripts's dev config via new WebpackBar()) calls super({ activeModules: true }) and then immediately overwrites this.options with its own name/color/reporters/reporter keys — none of which are in ProgressPlugin's schema. With eager validation this was masked; with the new deferred validation it fails every mc-scripts start/dev build with "Invalid options object. Progress Plugin has been initialized using an options object that does not match the API schema." Held back at 5.105.1 until webpackbar is fixed/replaced or dropped in favor of webpack's now-built-in progress bar.
#4009fae9486 Thanks @ByronDWall! - Scope the rollup pnpm override to rollup@^4 so it only affects Rollup 4.x consumers.
The unscoped "rollup": "^4.59.0" override introduced in 27.5.3 forced @preconstruct/cli's rollup@^2 dependency to resolve to Rollup 4.x. Rollup 4 no longer emits Object.defineProperty(exports, '__esModule', { value: true }) in CJS output by default, which broke jest.spyOn on namespace imports (import * as X from 'module') in downstream consumers.
#394165cc17a Thanks @ByronDWall! - fix(security): update ajv to 8.18.0 (ReDoS fix) and @flopflip/* to 15.1.7 (resolves transitive lodash prototype pollution via 4.17.23).
The remaining reported vulnerabilities (minimatch via serve-handler and inflight via react-dev-utils) have no upstream fix available. Both are transitive dependencies of mc-scripts dev-only build tooling and pose negligible security risk as they are not included in production bundles.
#39346c91a27 Thanks @ByronDWall! - fix(security): move babel-plugin-istanbul to optional peer dependency to resolve SNYK-JS-INFLIGHT-6095116
The babel-plugin-istanbul package transitively depends on the deprecated and vulnerable inflight@1.0.6 via test-exclude → glob@7 → inflight. By moving it from a direct dependency to an optional peer dependency, consumers of @commercetools-frontend/babel-preset-mc-app will no longer inherit this vulnerability in their dependency tree.
Breaking change: Projects that use ENABLE_BABEL_PLUGIN_ISTANBUL=true for code coverage instrumentation must now explicitly install babel-plugin-istanbul as a dev dependency:
pnpm add -D babel-plugin-istanbul
A runtime check has been added that provides a clear error message if coverage is enabled but the plugin is not installed. Projects that do not use Istanbul coverage instrumentation are not affected.
#40371c22248 Thanks @ByronDWall! - Add a portal target (mc-main-container-portal) inside MainContainer so that fixed-position components like SaveToolbar can portal into the MC content area and automatically constrain their width to the main pane, excluding the agent side panel.
#4009fae9486 Thanks @ByronDWall! - Scope the rollup pnpm override to rollup@^4 so it only affects Rollup 4.x consumers.
The unscoped "rollup": "^4.59.0" override introduced in 27.5.3 forced @preconstruct/cli's rollup@^2 dependency to resolve to Rollup 4.x. Rollup 4 no longer emits Object.defineProperty(exports, '__esModule', { value: true }) in CJS output by default, which broke jest.spyOn on namespace imports (import * as X from 'module') in downstream consumers.
The @flopflip/* 15.1.7 → 15.1.11 bump pulls in @launchdarkly/js-client-sdk v4 as a
transitive dependency, replacing the unscoped launchdarkly-js-client-sdk v3. This is a
breaking change for SetupFlopFlipProvider in application-shell:
The LaunchDarkly user context type now requires either a key or anonymous: true,
never an optional key. getUserContextForLaunchDarklyAdapter now returns an
anonymous context when there's no authenticated user, instead of a context with an
undefined key.
sdk.clientOptions.sendEventsOnlyForVariation was removed; the new SDK's allFlags
no longer sends analytics events by default, which was the entire point of that option.
@commercetools/composable-commerce-test-data 13.12.0 → 13.13.1 pulling in @faker-js/faker v10 (which dropped its CJS build) was previously allowlisted in the
root jest.test.config.js's transformIgnorePatterns, but jest-preset-mc-app's own
preset — the one actually consumed by the standalone starter templates
(application-templates/starter{,-typescript}, custom-views-templates/starter{,-typescript})
— has its own separate transformIgnorePatterns and was missed, so their CI jobs kept
failing with Cannot use import statement outside a module. Added @faker-js/faker
to that preset's allowlist too.
Bumped the following, each a real dependencies entry (not devDependencies) of the listed package(s), so each gets a version bump here:
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
renovateBot
changed the title
fix(deps): update all application-kit packages to v24.13.0
fix(deps): update all application-kit packages to v24.13.0 - autoclosed
Aug 10, 2026
renovateBot
changed the title
fix(deps): update all application-kit packages to v24.13.0 - autoclosed
fix(deps): update all application-kit packages to v27
Aug 13, 2026
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually
The artifact failure details are included below:
File name: pnpm-lock.yaml
Scope: all 3 workspace projects
? Verifying lockfile against supply-chain policies (1901 entries)...
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 36, reused 0, downloaded 0, added 0
. | [WARN] deprecated eslint@8.57.1
╭──────────────────────────────────────────╮
│ │
│ Update available! 11.17.0 → 11.22.0. │
│ Changelog: https://pnpm.io/v/11.22.0 │
│ To update, run: pnpm add -g pnpm │
│ │
╰──────────────────────────────────────────╯
Progress: resolved 40, reused 0, downloaded 0, added 0
Progress: resolved 42, reused 0, downloaded 0, added 0
Progress: resolved 43, reused 0, downloaded 0, added 0
Progress: resolved 44, reused 0, downloaded 0, added 0
Progress: resolved 46, reused 0, downloaded 0, added 0
Progress: resolved 47, reused 0, downloaded 0, added 0
Progress: resolved 48, reused 0, downloaded 0, added 0
Progress: resolved 50, reused 0, downloaded 0, added 0
[WARN] Request took 10244ms: https://registry.npmjs.org/@graphql-codegen%2Fcli
Progress: resolved 51, reused 0, downloaded 0, added 0
. | [WARN] Could not find preferred package import-meta-resolve@4.2.0 in lockfile
. | [WARN] Could not find preferred package import-meta-resolve@4.2.0 in lockfile
Progress: resolved 208, reused 0, downloaded 0, added 0
Progress: resolved 352, reused 0, downloaded 0, added 0
Progress: resolved 362, reused 0, downloaded 0, added 0
Progress: resolved 368, reused 0, downloaded 0, added 0
Progress: resolved 376, reused 0, downloaded 0, added 0
✓ Lockfile passes supply-chain policies (1901 entries in 16.6s)
Progress: resolved 385, reused 0, downloaded 0, added 0
Progress: resolved 516, reused 0, downloaded 0, added 0
Progress: resolved 683, reused 0, downloaded 0, added 0
Progress: resolved 901, reused 0, downloaded 0, added 0
Progress: resolved 1029, reused 0, downloaded 0, added 0
Progress: resolved 1043, reused 0, downloaded 0, added 0
Progress: resolved 1047, reused 0, downloaded 0, added 0
Progress: resolved 1050, reused 0, downloaded 0, added 0
Progress: resolved 1053, reused 0, downloaded 0, added 0
Progress: resolved 1246, reused 0, downloaded 1, added 0
Progress: resolved 1457, reused 0, downloaded 1, added 0
Progress: resolved 1568, reused 0, downloaded 1, added 0
Progress: resolved 1825, reused 0, downloaded 2, added 0
Progress: resolved 1953, reused 0, downloaded 2, added 0
[ERR_PNPM_NO_MATURE_MATCHING_VERSION] 10 versions do not meet the minimumReleaseAge constraint:
@flopflip/cache@15.1.12 was published at 2026-08-17T21:07:01.377Z, within the minimumReleaseAge cutoff (2026-08-17T14:20:37.604Z)
@flopflip/localstorage-cache@15.1.12 was published at 2026-08-17T21:06:55.203Z, within the minimumReleaseAge cutoff (2026-08-17T14:20:37.604Z)
@flopflip/react-broadcast@15.1.12 was published at 2026-08-17T21:07:12.314Z, within the minimumReleaseAge cutoff (2026-08-17T14:20:37.604Z)
@flopflip/react@15.1.12 was published at 2026-08-17T21:07:07.089Z, within the minimumReleaseAge cutoff (2026-08-17T14:20:37.604Z)
@flopflip/sessionstorage-cache@15.1.12 was published at 2026-08-17T21:06:55.578Z, within the minimumReleaseAge cutoff (2026-08-17T14:20:37.604Z)
@flopflip/types@15.1.12 was published at 2026-08-17T21:06:49.758Z, within the minimumReleaseAge cutoff (2026-08-17T14:20:37.604Z)
@flopflip/types@15.1.12 was published at 2026-08-17T21:06:49.758Z, within the minimumReleaseAge cutoff (2026-08-17T14:20:37.604Z)
@flopflip/types@15.1.12 was published at 2026-08-17T21:06:49.758Z, within the minimumReleaseAge cutoff (2026-08-17T14:20:37.604Z)
@flopflip/types@15.1.12 was published at 2026-08-17T21:06:49.758Z, within the minimumReleaseAge cutoff (2026-08-17T14:20:37.604Z)
@flopflip/types@15.1.12 was published at 2026-08-17T21:06:49.758Z, within the minimumReleaseAge cutoff (2026-08-17T14:20:37.604Z)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
24.13.0→27.9.324.13.0→27.9.324.13.0→27.9.324.13.0→27.9.324.13.0→27.9.3Release Notes
commercetools/merchant-center-application-kit (@commercetools-frontend/application-config)
v27.9.3Compare Source
Patch Changes
v27.9.2Compare Source
Patch Changes
v27.9.1Compare Source
Patch Changes
#4077
959d69eThanks @ByronDWall! - Batch-consolidated patch/minor Renovate dependency updates (rate-limited dashboard backlog, ~116 items reviewed).The
@flopflip/*15.1.7 → 15.1.11 bump pulls in@launchdarkly/js-client-sdkv4 as atransitive dependency, replacing the unscoped
launchdarkly-js-client-sdkv3. This is abreaking change for
SetupFlopFlipProviderinapplication-shell:keyoranonymous: true,never an optional
key.getUserContextForLaunchDarklyAdapternow returns ananonymous context when there's no authenticated user, instead of a context with an
undefined
key.sdk.clientOptions.sendEventsOnlyForVariationwas removed; the new SDK'sallFlagsno longer sends analytics events by default, which was the entire point of that option.
@commercetools/composable-commerce-test-data13.12.0 → 13.13.1 pulling in@faker-js/fakerv10 (which dropped its CJS build) was previously allowlisted in theroot
jest.test.config.js'stransformIgnorePatterns, butjest-preset-mc-app's ownpreset — the one actually consumed by the standalone starter templates
(
application-templates/starter{,-typescript},custom-views-templates/starter{,-typescript})— has its own separate
transformIgnorePatternsand was missed, so their CI jobs keptfailing with
Cannot use import statement outside a module. Added@faker-js/fakerto that preset's allowlist too.
Bumped the following, each a real
dependenciesentry (notdevDependencies) of the listed package(s), so each gets a version bump here:@flopflip/*(combine-adapters, http-adapter, launchdarkly-adapter, memory-adapter, react-broadcast, types) 15.1.7 → 15.1.11 —application-shell(all six),application-components(react-broadcast)@pmmmwh/react-refresh-webpack-plugin0.6.1 → 0.6.2 —mc-scripts@radix-ui/react-dialog1.1.14 → 1.1.23,@types/react-dom^19.0.2 → ^19.2.4 —application-componentssemver7.7.2 → 7.8.5,uuid14.0.0 → 14.0.1 —cypress@rollup/pluginutils5.2.0 → 5.4.0,graphql16.11.0 → 16.14.2,html-webpack-plugin5.6.3 → 5.6.8,mini-css-extract-plugin2.9.4 → 2.10.2,postcss8.5.23 → 8.5.26,react-refresh0.17.0 → 0.18.0 —mc-scripts(webpack5.105.1 → 5.109.2 was reverted; see below)graphql16.11.0 → 16.14.2,uuid14.0.0 → 14.0.1 —application-shell-connectorscosmiconfig9.0.0 → 9.0.2,graphql16.11.0 → 16.14.2 —jest-preset-mc-app(thejest/babel-jest/babel-preset-jest/jest-environment-jsdom/jest-mockbump was reverted; see the pnpm-regression/typecheck fix commits on this branch for why)@types/react-dom^19.0.2 → ^19.2.4 —react-notifications,application-shell(also@reduxjs/toolkit2.9.0 → 2.12.0,graphql16.11.0 → 16.14.2,uuid14.0.0 → 14.0.1)typescript5.9.2 → 5.9.3 —eslint-config-mc-app,eslint-config-nodesemver7.7.2 → 7.8.5 —create-mc-appuuid14.0.0 → 14.0.1 —sdk@formatjs/icu-messageformat-parser2.11.2 → 2.11.4 —i18n@sentry/browser,@sentry/react,@sentry/types8.55.0 → 8.55.2 —sentryserialize-javascript7.0.5 → 7.0.7 —mc-html-templateajv8.18.0 → 8.20.0,cosmiconfig9.0.0 → 9.0.2,cosmiconfig-typescript-loader6.1.0 → 6.3.0 —application-configwinston3.17.0 → 3.19.0 —loggersOther updates in this batch (
@testing-library/*,@manypkg/cli,@percy/cypress,@percy/puppeteer,@preconstruct/cli,@apollo/client,jest,jest-each,react,react-dom,react-redux,@commercetools/nimbus,@commercetools/composable-commerce-test-data,@percy/cli,@percy/core,@changesets/*,rimraf,sentry-testkit,start-server-and-test,fflate,formik,qs,node,pnpm, and GitHub Actions digest/version pins) only touch devDependencies,peerDependencies, root-level repo tooling, CI configuration, or private template/playground packages, so they don't require a version bump here.webpack5.105.1 → 5.109.2 was reverted: webpack'sProgressPluginnow defers option-schema validation from the constructor to acompiler.hooks.validatetap, readingthis.optionsat that later point instead of validating the raw constructor args immediately.webpackbar@5.0.2(unmaintained, used bymc-scripts's dev config vianew WebpackBar()) callssuper({ activeModules: true })and then immediately overwritesthis.optionswith its ownname/color/reporters/reporterkeys — none of which are inProgressPlugin's schema. With eager validation this was masked; with the new deferred validation it fails everymc-scripts start/dev build with "Invalid options object. Progress Plugin has been initialized using an options object that does not match the API schema." Held back at 5.105.1 untilwebpackbaris fixed/replaced or dropped in favor of webpack's now-built-in progress bar.Updated dependencies []:
v27.9.0Compare Source
Patch Changes
1c22248]:v27.8.0Compare Source
Patch Changes
v27.7.0Compare Source
Patch Changes
v27.6.3Compare Source
Patch Changes
v27.6.2Compare Source
Patch Changes
v27.6.1Compare Source
Patch Changes
v27.6.0Compare Source
Patch Changes
v27.5.4Compare Source
Patch Changes
#4009
fae9486Thanks @ByronDWall! - Scope therolluppnpm override torollup@^4so it only affects Rollup 4.x consumers.The unscoped
"rollup": "^4.59.0"override introduced in 27.5.3 forced@preconstruct/cli'srollup@^2dependency to resolve to Rollup 4.x. Rollup 4 no longer emitsObject.defineProperty(exports, '__esModule', { value: true })in CJS output by default, which brokejest.spyOnon namespace imports (import * as X from 'module') in downstream consumers.Updated dependencies [
fae9486]:v27.5.3Compare Source
Patch Changes
#3989
222259aThanks @misama-ct! - Bump transitive dependencies via pnpm overrides to address 46 high-severity Dependabot alerts. Updated dependencies:@isaacs/brace-expansion>= 5.0.1@remix-run/router>= 1.23.2@xmldom/xmldom>= 0.8.13axios>= 1.15.2immutable>= 3.8.3lodash-es>= 4.17.21minimatch@^3^3.1.4minimatch@^4^4.2.5minimatch@^9^9.0.7minimatch@^10^10.2.3path-to-regexp@^6^6.3.0picomatch@^4^4.0.4rollup^4.59.0semver@^6^6.3.1svgo>= 2.8.1systeminformation>= 5.31.0tar>= 7.5.11tar-fs>= 3.1.1undici>= 6.24.0Updated dependencies [
222259a]:v27.5.2Compare Source
Patch Changes
#3993
241d4b2Thanks @abreu-ct! - Allow module resolution from outside of workspace.Updated dependencies []:
v27.5.1Compare Source
Patch Changes
v27.5.0Compare Source
Patch Changes
v27.4.2Patch Changes
v27.4.1Patch Changes
v27.4.0Compare Source
Patch Changes
v27.3.0Compare Source
Patch Changes
v27.2.0Compare Source
Patch Changes
f9e80c7]:v27.1.0Compare Source
Patch Changes
v27.0.0Compare Source
Patch Changes
v26.1.0Compare Source
Patch Changes
v26.0.2Compare Source
Patch Changes
v26.0.1Compare Source
Patch Changes
#3941
65cc17aThanks @ByronDWall! - fix(security): updateajvto 8.18.0 (ReDoS fix) and@flopflip/*to 15.1.7 (resolves transitivelodashprototype pollution via 4.17.23).The remaining reported vulnerabilities (
minimatchviaserve-handlerandinflightviareact-dev-utils) have no upstream fix available. Both are transitive dependencies ofmc-scriptsdev-only build tooling and pose negligible security risk as they are not included in production bundles.Updated dependencies []:
v26.0.0Compare Source
Patch Changes
v25.2.0Compare Source
Patch Changes
#3923
3b47e62Thanks @tylermorrisford! - Adds overrides for two transient dependencies.#3922
4d19484Thanks @tylermorrisford! - Adds override for transient dependency security issue.#3918
08c578cThanks @tylermorrisford! - Security fixes applied to application-config and react-notifications.#3924
a19546cThanks @tylermorrisford! - Adds override for tar package version.#3917
d817733Thanks @tylermorrisford! - Security fixes applied to application-config.Updated dependencies [
3b47e62,4d19484,a19546c]:v25.1.0Compare Source
Patch Changes
086d7e3]:v25.0.0Compare Source
Patch Changes
95dba14]:commercetools/merchant-center-application-kit (@commercetools-frontend/babel-preset-mc-app)
v27.9.3Compare Source
v27.9.2Compare Source
v27.9.1Compare Source
v27.9.0Compare Source
v27.8.0Compare Source
v27.7.0Compare Source
v27.6.3Compare Source
v27.6.2Compare Source
v27.6.1Compare Source
v27.6.0Compare Source
v27.5.4Compare Source
v27.5.3Compare Source
Patch Changes
#3989
222259aThanks @misama-ct! - Bump transitive dependencies via pnpm overrides to address 46 high-severity Dependabot alerts. Updated dependencies:@isaacs/brace-expansion>= 5.0.1@remix-run/router>= 1.23.2@xmldom/xmldom>= 0.8.13axios>= 1.15.2immutable>= 3.8.3lodash-es>= 4.17.21minimatch@^3^3.1.4minimatch@^4^4.2.5minimatch@^9^9.0.7minimatch@^10^10.2.3path-to-regexp@^6^6.3.0picomatch@^4^4.0.4rollup^4.59.0semver@^6^6.3.1svgo>= 2.8.1systeminformation>= 5.31.0tar>= 7.5.11tar-fs>= 3.1.1undici>= 6.24.0v27.5.2Compare Source
v27.5.1Compare Source
v27.5.0Compare Source
v27.4.2v27.4.1v27.4.0Compare Source
v27.3.0Compare Source
v27.2.0Compare Source
v27.1.0Compare Source
v27.0.0Compare Source
v26.1.0Compare Source
v26.0.2Compare Source
v26.0.1Compare Source
v26.0.0Compare Source
Major Changes
#3934
6c91a27Thanks @ByronDWall! - fix(security): movebabel-plugin-istanbulto optional peer dependency to resolve SNYK-JS-INFLIGHT-6095116The
babel-plugin-istanbulpackage transitively depends on the deprecated and vulnerableinflight@1.0.6viatest-exclude → glob@7 → inflight. By moving it from a direct dependency to an optional peer dependency, consumers of@commercetools-frontend/babel-preset-mc-appwill no longer inherit this vulnerability in their dependency tree.Breaking change: Projects that use
ENABLE_BABEL_PLUGIN_ISTANBUL=truefor code coverage instrumentation must now explicitly installbabel-plugin-istanbulas a dev dependency:A runtime check has been added that provides a clear error message if coverage is enabled but the plugin is not installed. Projects that do not use Istanbul coverage instrumentation are not affected.
v25.2.0Compare Source
Patch Changes
#3923
3b47e62Thanks @tylermorrisford! - Adds overrides for two transient dependencies.#3927
246ba28Thanks @misama-ct! - Fix SNYK-JS-INFLIGHT-6095116 vulnerability by removing dependencies on the deprecatedinflightpackage.#3922
4d19484Thanks @tylermorrisford! - Adds override for transient dependency security issue.#3924
a19546cThanks @tylermorrisford! - Adds override for tar package version.v25.1.0Compare Source
v25.0.0Compare Source
commercetools/merchant-center-application-kit (@commercetools-frontend/constants)
v27.9.3Compare Source
v27.9.2Compare Source
v27.9.1Compare Source
v27.9.0Compare Source
Minor Changes
1c22248Thanks @ByronDWall! - Add a portal target (mc-main-container-portal) insideMainContainerso that fixed-position components likeSaveToolbarcan portal into the MC content area and automatically constrain their width to the main pane, excluding the agent side panel.v27.8.0Compare Source
v27.7.0Compare Source
v27.6.3Compare Source
v27.6.2Compare Source
v27.6.1Compare Source
v27.6.0Compare Source
v27.5.4Compare Source
Patch Changes
#4009
fae9486Thanks @ByronDWall! - Scope therolluppnpm override torollup@^4so it only affects Rollup 4.x consumers.The unscoped
"rollup": "^4.59.0"override introduced in 27.5.3 forced@preconstruct/cli'srollup@^2dependency to resolve to Rollup 4.x. Rollup 4 no longer emitsObject.defineProperty(exports, '__esModule', { value: true })in CJS output by default, which brokejest.spyOnon namespace imports (import * as X from 'module') in downstream consumers.v27.5.3Compare Source
Patch Changes
#3989
222259aThanks @misama-ct! - Bump transitive dependencies via pnpm overrides to address 46 high-severity Dependabot alerts. Updated dependencies:@isaacs/brace-expansion>= 5.0.1@remix-run/router>= 1.23.2@xmldom/xmldom>= 0.8.13axios>= 1.15.2immutable>= 3.8.3lodash-es>= 4.17.21minimatch@^3^3.1.4minimatch@^4^4.2.5minimatch@^9^9.0.7minimatch@^10^10.2.3path-to-regexp@^6^6.3.0picomatch@^4^4.0.4rollup^4.59.0semver@^6^6.3.1svgo>= 2.8.1systeminformation>= 5.31.0tar>= 7.5.11tar-fs>= 3.1.1undici>= 6.24.0v27.5.2Compare Source
v27.5.1Compare Source
v27.5.0Compare Source
v27.4.2v27.4.1v27.4.0Compare Source
v27.3.0Compare Source
v27.2.0Compare Source
Minor Changes
f9e80c7Thanks @yassinejebli! - Add agentic channels service toGRAPHQL_TARGETSv27.1.0Compare Source
v27.0.0Compare Source
v26.1.0Compare Source
v26.0.2Compare Source
v26.0.1Compare Source
v26.0.0Compare Source
v25.2.0Compare Source
Patch Changes
#3923
3b47e62Thanks @tylermorrisford! - Adds overrides for two transient dependencies.#3922
4d19484Thanks @tylermorrisford! - Adds override for transient dependency security issue.#3924
a19546cThanks @tylermorrisford! - Adds override for tar package version.v25.1.0Compare Source
Minor Changes
086d7e3Thanks @LucasGrahn! - Added stores search constant valuesv25.0.0Compare Source
Major Changes
#3910
95dba14Thanks @Sarah4VT! - Jest 30 upgrade - Upgrade guideglobalsconfiguration (NODE_ENV set automatically)crypto.randomUUIDpolyfill (JSDOM 26 native support)uuiddependencycommercetools/merchant-center-application-kit (@commercetools-frontend/eslint-config-mc-app)
v27.9.3Compare Source
Patch Changes
v27.9.2Compare Source
Patch Changes
v27.9.1Compare Source
Patch Changes
#4077
959d69eThanks @ByronDWall! - Batch-consolidated patch/minor Renovate dependency updates (rate-limited dashboard backlog, ~116 items reviewed).The
@flopflip/*15.1.7 → 15.1.11 bump pulls in@launchdarkly/js-client-sdkv4 as atransitive dependency, replacing the unscoped
launchdarkly-js-client-sdkv3. This is abreaking change for
SetupFlopFlipProviderinapplication-shell:keyoranonymous: true,never an optional
key.getUserContextForLaunchDarklyAdapternow returns ananonymous context when there's no authenticated user, instead of a context with an
undefined
key.sdk.clientOptions.sendEventsOnlyForVariationwas removed; the new SDK'sallFlagsno longer sends analytics events by default, which was the entire point of that option.
@commercetools/composable-commerce-test-data13.12.0 → 13.13.1 pulling in@faker-js/fakerv10 (which dropped its CJS build) was previously allowlisted in theroot
jest.test.config.js'stransformIgnorePatterns, butjest-preset-mc-app's ownpreset — the one actually consumed by the standalone starter templates
(
application-templates/starter{,-typescript},custom-views-templates/starter{,-typescript})— has its own separate
transformIgnorePatternsand was missed, so their CI jobs keptfailing with
Cannot use import statement outside a module. Added@faker-js/fakerto that preset's allowlist too.
Bumped the following, each a real
dependenciesentry (notdevDependencies) of the listed package(s), so each gets a version bump here:@flopflip/*(combine-adapters, http-adapter, launchdarkly-adapter, memoConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.