chore(deps):(deps-dev): bump tinyglobby from 0.2.15 to 0.2.16#285
chore(deps):(deps-dev): bump tinyglobby from 0.2.15 to 0.2.16#285dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps [tinyglobby](https://github.com/SuperchupuDev/tinyglobby) from 0.2.15 to 0.2.16. - [Release notes](https://github.com/SuperchupuDev/tinyglobby/releases) - [Changelog](https://github.com/SuperchupuDev/tinyglobby/blob/main/CHANGELOG.md) - [Commits](SuperchupuDev/tinyglobby@0.2.15...0.2.16) --- updated-dependencies: - dependency-name: tinyglobby dependency-version: 0.2.16 dependency-type: indirect update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 78bde54. Configure here.
| "arm" | ||
| ], | ||
| "dev": true, | ||
| "libc": [ |
There was a problem hiding this comment.
Missing libc fields in lockfile breaks Alpine builds
Medium Severity
The libc field has been removed from all native binary packages in package-lock.json (sharp, rolldown, lightningcss — both glibc and musl variants). This project builds on node:24-alpine (musl-based), and without libc filtering, npm ci will attempt to install incompatible glibc native binaries alongside musl ones, causing unnecessary install failures (silently ignored since they're optional), wasted build time, and potential resolution issues. This is an unintentional side effect of regenerating the lockfile — the tinyglobby bump shouldn't have affected these unrelated packages.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 78bde54. Configure here.
Bumps tinyglobby from 0.2.15 to 0.2.16.
Release notes
Sourced from tinyglobby's releases.
Changelog
Sourced from tinyglobby's changelog.
Commits
5779202release 0.2.16071954fbump deps once moree541ddedo not import the wholefsmodule2381b76fix root being too broad0addeb9chore(deps): update all non-major dependencies (#191)91ac26cchore(deps): update pnpm/action-setup action to v5 (#192)c50558eupgrade picomatch (and everything else)6185175chore(deps): update dependency picomatch to v4.0.4 [security] (#193)49c2b93enable pnpmtrustPolicybc825c4chore(deps): update all non-major dependencies (#181)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Lockfile-only update bumping a dev dependency; runtime/app logic is unchanged, with minimal risk beyond potential build tooling differences.
Overview
Updates the lockfile to bump dev dependency
tinyglobbyfrom0.2.15to0.2.16, including itspicomatchdependency to^4.0.4.Also normalizes several platform-specific optional dependency entries by removing
libcmetadata (e.g.,sharp/libvips,rolldownbindings,lightningcss) without changing their versions.Reviewed by Cursor Bugbot for commit 78bde54. Bugbot is set up for automated code reviews on this repo. Configure here.