Repository navigation
build(deps): bump monaco-editor from 0.56.0 to 0.57.0 - #2068
Conversation
Bumps [monaco-editor](https://github.com/microsoft/monaco-editor) from 0.56.0 to 0.57.0. - [Release notes](https://github.com/microsoft/monaco-editor/releases) - [Changelog](https://github.com/microsoft/monaco-editor/blob/main/CHANGELOG.md) - [Commits](microsoft/monaco-editor@v0.56.0...v0.57.0) --- updated-dependencies: - dependency-name: monaco-editor dependency-version: 0.57.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
I reviewed this PR and didn't find any bugs. Before merging, someone should still check one runtime detail I couldn't confirm from the diff: 0.57 moves Monaco's editor core to a newer VS Code commit, so the Trusted Types policy names it creates may have changed.
What was reviewed:
- The package.json range and the yarn.lock entries match. The workspace entry and the monaco-editor resolution both moved to 0.57.0, and marked stays at 14.0.0.
- The dompurify change to 3.4.15 is only the declared range. The root
resolutionsstill forces dompurify 3.4.17, so the installed version doesn't change. 0.56 was set up the same way. - I couldn't compare the policy allowlist in
packages/app/src/main/csp.tswith the 0.57 bundle because I wasn't able to fetch the package tarball here. If 0.57 adds or renames a policy, the CSP will block it at runtime. Opening the editor, a diff view and a hover/suggest popup, or running the e2e suite, would show that.
Extended reasoning...
The change touches only packages/app/package.json and yarn.lock. It bumps monaco-editor from 0.56.0 to 0.57.0, and the lockfile updates are consistent. No app source changes. The one sensitive area is indirect: the app's CSP allowlists Trusted Types policies by name, and a new Monaco core could create a policy that isn't on the list. I couldn't verify that here. CODEOWNERS assigns every path to the ecosystem working group, so this goes to a human rather than being approved automatically.
Bumps monaco-editor from 0.56.0 to 0.57.0.
Release notes
Sourced from monaco-editor's releases.
... (truncated)
Changelog
Sourced from monaco-editor's changelog.
Commits
d618242Merge pull request #5487 from microsoft/hediet/b/release-0.57.0ef061ffPrepare Monaco Editor 0.57.0 release8e9b0f7Keep editor release version stable across task retries3f31304Prepare VS Code native headers before installing dependenciesebd1312Use authenticated Foundry Local installer for core builds176408bAlign release build Node version with VS Code 1.13997d81caBump uuid and webpack-dev-server in /website (#5415)f7c7f4cBump baseline-browser-mapping from 2.9.19 to 2.11.21 in /website (#5476)36f4fe6Bump svgo from 2.8.3 to 2.8.4 in /samples/browser-esm-parcel (#5474)f24cd7fBump actions/deploy-pages in the github-actions group (#5479)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)