chore: upgrade jsdom from 28 to 29 by Aureliolo · Pull Request #499 · Aureliolo/synthorg

Aureliolo · 2026-03-16T20:41:50Z

Summary

Upgrade jsdom devDependency from ^28 (28.1.0) to ^29 (29.0.0) in the web dashboard
Extracted from grouped Dependabot PR chore: bump the major group across 1 directory with 3 updates #481 (which also bumps tailwindcss insiders → stable, intentionally left on nightly)

Changelog Review (28.1.0 → 29.0.0)

Breaking: Node.js v22.13.0+ minimum for v22 users (was v22.12.0+) — does not affect us (CI uses Node 20)

Improvements:

Overhauled CSSOM implementation (replaced @acemir/cssom + cssstyle with internal css-tree-based impl)
Document initialization performance (~0.5ms saved per Document via lazy CSS selector engine init)
Fixed memory leak when stylesheets removed from document
Fixed potential hang in synchronous XMLHttpRequest (race condition)
Added bad port blocking per fetch spec

Test plan

npm --prefix web run test — 541 tests pass (62 files)
npm --prefix web run lint — 0 errors (17 pre-existing warnings)
npm --prefix web run type-check — clean
Pre-commit hooks pass

Major version bump for test environment dependency. Only breaking change is Node.js v22.13.0+ minimum (was v22.12.0+), which doesn't affect us (CI uses Node 20). Key improvements: overhauled CSSOM implementation, Document init performance (~0.5ms/doc), memory leak fix, XHR hang fix. All 541 Vitest tests pass, lint and type-check clean.

github-actions · 2026-03-16T20:42:04Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package

Version

Score

Details

npm/@asamuzakjp/dom-selector

7.0.3

Unknown

npm/@csstools/css-syntax-patches-for-csstree

1.1.1

🟢 7

Details

Check	Score	Reason
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ 0	Found 0/27 approved changesets -- score normalized to 0
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 9	dependency not pinned by hash detected -- score normalized to 9
Binary-Artifacts	🟢 10	no binaries found in the repo
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 10	SAST tool is run on all commits

npm/jsdom

29.0.0

🟢 6.6

Details

Check	Score	Reason
Code-Review	⚠️ 2	Found 6/27 approved changesets -- score normalized to 2
Maintained	🟢 10	30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy	🟢 10	security policy file detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/undici

7.24.4

🟢 7.8

Details

Check	Score	Reason
Dependency-Update-Tool	🟢 10	update tool detected
Code-Review	🟢 4	Found 13/28 approved changesets -- score normalized to 4
Security-Policy	🟢 9	security policy file detected
Maintained	🟢 10	30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 8	binaries present in source code
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
SAST	🟢 9	SAST tool detected but not run on all commits
Signed-Releases	⚠️ -1	no releases found
Packaging	🟢 10	packaging workflow detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
CI-Tests	🟢 10	15 out of 15 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 81 contributing companies or organizations

Scanned Files

web/package-lock.json

gemini-code-assist · 2026-03-16T20:42:08Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request focuses on a significant upgrade of the jsdom development dependency to its latest major version, v29. This update is crucial for incorporating the latest performance enhancements, bug fixes, and architectural improvements, particularly in how CSSOM is handled. The change also streamlines jsdom's internal dependency tree, contributing to a more robust and efficient testing environment for the web dashboard.

Highlights

Dependency Upgrade: Upgraded the jsdom development dependency in the web dashboard from version 28 to 29.
CSSOM Implementation: The jsdom upgrade includes an overhauled CSSOM implementation, replacing external libraries (@acemir/cssom, cssstyle) with an internal css-tree-based solution.
Performance Improvements: Document initialization performance in jsdom has been improved, saving approximately 0.5ms per Document via lazy CSS selector engine initialization.
Bug Fixes: Addressed a memory leak when stylesheets were removed from a document and fixed a potential hang in synchronous XMLHttpRequest due to a race condition within jsdom.
Dependency Streamlining: Several transitive dependencies such as agent-base, http-proxy-agent, and https-proxy-agent were removed as they are no longer direct dependencies of jsdom.

Changelog

web/package-lock.json
- Upgraded jsdom from 28.1.0 to 29.0.0.
- Removed @acemir/cssom and cssstyle packages.
- Updated @asamuzakjp/dom-selector from 6.8.1 to 7.0.3.
- Updated @csstools/css-syntax-patches-for-csstree from 1.1.0 to 1.1.1.
- Removed agent-base, http-proxy-agent, and https-proxy-agent packages.
- Updated undici from 7.24.2 to 7.24.4.
- Adjusted Node.js engine requirement for jsdom to ^20.19.0 || ^22.13.0 || >=24.0.0.
- Updated various transitive dependencies including css-tree, lru-cache, @exodus/bytes, tough-cookie, and whatwg-url.
web/package.json
- Updated jsdom devDependency from ^28 to ^29.

Activity

All 541 web tests (npm --prefix web run test) passed successfully.
Web linting (npm --prefix web run lint) completed with 0 errors.
Web type-checking (npm --prefix web run type-check) reported no issues.
All pre-commit hooks passed.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

coderabbitai · 2026-03-16T20:42:10Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 90dc2531-e98a-4761-b23d-3fac7a7f5845

📥 Commits

Reviewing files that changed from the base of the PR and between 4bd99f7 and 635c4b8.

⛔ Files ignored due to path filters (1)

web/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

web/package.json

📜 Recent review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)

GitHub Check: Build Sandbox
GitHub Check: Build Backend
GitHub Check: Build Web
GitHub Check: Analyze (python)

🧰 Additional context used

📓 Path-based instructions (1)

web/package.json

📄 CodeRabbit inference engine (CLAUDE.md)

Web dashboard: Node.js 20+, dependencies in web/package.json (Vue 3, PrimeVue, Tailwind CSS, Pinia, VueFlow, ECharts, Axios, vue-draggable-plus, Vitest, fast-check, ESLint, vue-tsc)

Files:

web/package.json

🧠 Learnings (3)

📓 Common learnings

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-16T20:29:28.807Z
Learning: Applies to web/package.json : Web dashboard: Node.js 20+, dependencies in `web/package.json` (Vue 3, PrimeVue, Tailwind CSS, Pinia, VueFlow, ECharts, Axios, vue-draggable-plus, Vitest, fast-check, ESLint, vue-tsc)

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-15T11:48:14.867Z
Learning: Applies to web/** : Web dashboard: Node.js 20+, dependencies in web/package.json (Vue 3, PrimeVue, Tailwind CSS, Pinia, VueFlow, ECharts, Axios, vue-draggable-plus, Vitest, fast-check, ESLint, vue-tsc).

📚 Learning: 2026-03-16T20:29:28.807Z

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-16T20:29:28.807Z
Learning: Applies to web/package.json : Web dashboard: Node.js 20+, dependencies in `web/package.json` (Vue 3, PrimeVue, Tailwind CSS, Pinia, VueFlow, ECharts, Axios, vue-draggable-plus, Vitest, fast-check, ESLint, vue-tsc)

Applied to files:

web/package.json

📚 Learning: 2026-03-15T11:48:14.867Z

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-15T11:48:14.867Z
Learning: Applies to web/** : Web dashboard: Node.js 20+, dependencies in web/package.json (Vue 3, PrimeVue, Tailwind CSS, Pinia, VueFlow, ECharts, Axios, vue-draggable-plus, Vitest, fast-check, ESLint, vue-tsc).

Applied to files:

web/package.json

🔇 Additional comments (1)

web/package.json (1)

43-43: Dependency bump is clean and the lockfile is correctly resolved.

No blockers on Line 43. The jsdom upgrade (29.0.0) is isolated to devDependencies and is compatible with the repository's Node.js 22 baseline used in CI. The test, lint, and type-check runs confirm safe adoption in this PR.

📝 Walkthrough

Summary by CodeRabbit

Chores
- Updated development dependency for testing framework compatibility.

Walkthrough

Updated the jsdom devDependency version in web/package.json from ^28 to ^29. This is a straightforward dependency version bump with no functional code changes.

Changes

Cohort / File(s)	Summary
Dependency Update `web/package.json`	Updated `jsdom` devDependency version from `^28` to `^29`.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: upgrading jsdom from version 28 to 29 in the web package.
Description check	✅ Passed	The description is comprehensive and directly related to the changeset, explaining the upgrade rationale, changelog highlights, and thorough test verification.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch chore/upgrade-jsdom-29

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch chore/upgrade-jsdom-29

📝 Coding Plan

Generate coding plan for human review comments

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

socket-security · 2026-03-16T20:42:38Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/jsdom@28.1.0 ⏵ 29.0.0	⁺²⁶		⁺¹	^-3

View full report

gemini-code-assist

Code Review

This pull request upgrades the jsdom development dependency from version 28 to 29. The changes are confined to package.json and package-lock.json and are consistent with the upgrade. The pull request description includes a review of the jsdom changelog and a test plan showing that all checks pass. The changes appear correct and I have no further feedback.

🤖 I have created a release *beep* *boop* --- ## [0.3.1](v0.3.0...v0.3.1) (2026-03-17) ### Features * **api:** RFC 9457 Phase 2 — ProblemDetail and content negotiation ([#496](#496)) ([30f7c49](30f7c49)) * **cli:** verify container image signatures and SLSA provenance on pull ([#492](#492)) ([bef272d](bef272d)), closes [#491](#491) * **engine:** implement context budget management in execution loops ([#520](#520)) ([181eb8a](181eb8a)), closes [#416](#416) * implement settings persistence layer (DB-backed config) ([#495](#495)) ([4bd99f7](4bd99f7)), closes [#450](#450) * **memory:** implement dual-mode archival in memory consolidation ([#524](#524)) ([4603c9e](4603c9e)), closes [#418](#418) * migrate config consumers to read through SettingsService ([#510](#510)) ([32f553d](32f553d)) * **settings:** implement settings change subscriptions for service hot-reload ([#526](#526)) ([53f908e](53f908e)), closes [#503](#503) * **settings:** register API config in SettingsService with 2-phase init ([#518](#518)) ([29f7481](29f7481)) * **tools:** add SSRF prevention for git clone URLs ([#505](#505)) ([492dd0d](492dd0d)) * **tools:** wire RootConfig.git_clone to GitCloneTool instantiation ([#519](#519)) ([b7d8172](b7d8172)) ### Bug Fixes * **api:** replace JWT query parameter with one-time ticket for WebSocket auth ([#493](#493)) ([22a25f6](22a25f6)), closes [#343](#343) ### Documentation * add uv cache lock contention handling to worktree skill ([#500](#500)) ([bd85a8d](bd85a8d)) * document RFC 9457 dual response formats in OpenAPI schema ([#506](#506)) ([8dd2524](8dd2524)) ### Maintenance * upgrade jsdom from 28 to 29 ([#499](#499)) ([1ea2249](1ea2249)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

coderabbitai bot approved these changes Mar 16, 2026

View reviewed changes

Merge branch 'main' into chore/upgrade-jsdom-29

5ece0df

gemini-code-assist bot reviewed Mar 16, 2026

View reviewed changes

Aureliolo merged commit 1ea2249 into main Mar 16, 2026
28 checks passed

Aureliolo deleted the chore/upgrade-jsdom-29 branch March 16, 2026 20:50

Aureliolo mentioned this pull request Mar 16, 2026

chore(main): release 0.3.1 #498

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: upgrade jsdom from 28 to 29#499

chore: upgrade jsdom from 28 to 29#499
Aureliolo merged 2 commits intomainfrom
chore/upgrade-jsdom-29

Aureliolo commented Mar 16, 2026

Uh oh!

github-actions bot commented Mar 16, 2026 •

edited

Loading

Uh oh!

gemini-code-assist bot commented Mar 16, 2026

Uh oh!

coderabbitai bot commented Mar 16, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Changes

Estimated code review effort

Uh oh!

socket-security bot commented Mar 16, 2026 •

edited

Loading

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Aureliolo commented Mar 16, 2026

Summary

Changelog Review (28.1.0 → 29.0.0)

Test plan

Uh oh!

github-actions bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

gemini-code-assist bot commented Mar 16, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

coderabbitai bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Estimated code review effort

Uh oh!

socket-security bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions bot commented Mar 16, 2026 •

edited

Loading

coderabbitai bot commented Mar 16, 2026 •

edited

Loading

socket-security bot commented Mar 16, 2026 •

edited

Loading