deps(deps): bump which from 5.0.0 to 7.0.0#685
Conversation
Bumps [which](https://github.com/npm/node-which) from 5.0.0 to 7.0.0. - [Release notes](https://github.com/npm/node-which/releases) - [Changelog](https://github.com/npm/node-which/blob/main/CHANGELOG.md) - [Commits](npm/node-which@v5.0.0...v7.0.0) --- updated-dependencies: - dependency-name: which dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
❌ Changes requested
🤖 Claude Sonnet 4.6 (OpenRouter) (anthropic/claude-sonnet-4.6) via OpenRouter
Gate wrong or a false positive? Do not edit this workflow to pass — open an issue on lagowski/pr-review-gate.
There was a problem hiding this comment.
⚠️ Human review required
🤖 Claude Sonnet 4.6 (OpenRouter) (anthropic/claude-sonnet-4.6) via OpenRouter
Gate wrong or a false positive? Do not edit this workflow to pass — open an issue on lagowski/pr-review-gate.
There was a problem hiding this comment.
❌ Changes requested
🤖 Claude Sonnet 4.6 (OpenRouter) (anthropic/claude-sonnet-4.6) via OpenRouter
This PR bumps which from 5.0.0 to 7.0.0 and removes @upstash/context7-mcp from dependencies. The critical concern is that which 7.0.0 declares a Node.js engine requirement of ^22.22.2 || ^24.15.0 || >=26.0.0, which is incompatible with the project's stated minimum of Node.js >=16 and the current LTS baseline, meaning the package will fail to install or produce engine warnings on any Node 16, 18, or 20 environment.
1 finding:
- 🟠 HIGH HIGH package.json:153 / package-lock.json:10676 —
which@7.0.0declaresengines: { node: '^22.22.2 || ^24.15.0 || >=26.0.0' }butpackage.jsonspecifiesengines: { node: '>=16' }for this project. Any CI runner or user on Node 16, 18, or 20 (all still in common use and within the project's stated support range) will get an engine incompatibility error or silent misbehaviour when npm strict-engine checks are enabled, andnpm installwith--engine-strictwill hard-fail. The lock file confirms the new top-levelnode_modules/whichentry carries this constraint.- Fix: Either pin
whichto^5.0.0(or^6.xwhich supports>=18) until the project's ownenginesfield is updated to require Node >=22, or updatepackage.jsonenginesto^22.22.2 || ^24.15.0 || >=26.0.0and update CI matrix accordingly before merging. - Evidence:
'"engines": { "node": "^22.22.2 || ^24.15.0 || >=26.0.0" }' in lock file for 'node_modules/which' vs project 'engines: '>=16''
- Fix: Either pin
Gate wrong or a false positive? Do not edit this workflow to pass — open an issue on lagowski/pr-review-gate.
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
|
Closing per AI Review Gate finding.
Two paths forward (separate decisions):
Both are real architectural calls, not auto-merge material. |
3 participants
Bumps which from 5.0.0 to 7.0.0.
Release notes
Sourced from which's releases.
Changelog
Sourced from which's changelog.
Commits
297db11chore: release 7.0.0 (#177)9bdf003chore: template-oss-apply471d90bfeat!: bump to new node engine range8aac36ffeat!: template-oss-apply4824908deps & engine updatebbc63bachore: release 6.0.1 (#169)bd22353deps: bump isexe from 3.1.5 to 4.0.0 (#168)46b25d7chore: bump@npmcli/template-ossfrom 4.28.0 to 4.28.1 (#165)af2ddb4chore: bump@npmcli/template-ossfrom 4.27.1 to 4.28.0 (#164)fc4c209chore: bump@npmcli/eslint-configfrom 5.1.0 to 6.0.0 (#163)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for which since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)