Upgrade dependencies

[rygine]

This PR just upgrades dependencies. There will be no release.

[changeset-bot]

⚠️ No Changeset found

Latest commit: e18a08a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[neekolas]

We should add a .dependabot.yaml file to this repo and automate this process. It has enough test coverage and is well-typed enough to catch issues if they were to come up.

[rygine]

We should add a .dependabot.yaml file to this repo and automate this process. It has enough test coverage and is well-typed enough to catch issues if they were to come up.

i have reservations about dependabot.

1. IME, it will directly update lock files for dependencies of dependencies instead of changing the version in package.json. this can break dependencies that are not expecting that version, especially if an author misuses semver.
2. PR spam
3. some upgrades will just break things, even if they're patch updates, as is the case currently

bottom line, i simply don't trust dependabot and would rather do this process manually. perhaps things have changed since i last used it, but in the past it was just another system to manage that caused headaches.

[neekolas]

PR spam is real. I just have it do the check once a week for bot kit pro, so it's a Monday morning chore to review them all. You can then review in a batch and have dependabot merge them in sequence and rebase/retest each PR before it automerges.

You're right that it directly updates lock files, which can break deps.

If there are reasonable tests for the code, 1 and 3 should get caught in CI and stop there.

You're the primary maintainer of this repo. It's your call. As long as deps regularly get updated, I'm happy.

[neekolas]

I think I turned on Dependabot for all repos for critical security updates only. Those are rare but obviously beneficial.