Dependabot PR Review — 2026-06-10

[macminisupport]

Dependabot PR Review — 2026-06-10

Automated triage of 6 open Dependabot PRs. Awaiting confirmation before merging.

Summary Table

#	Package	Version Change	Bump	CI	Merge State	Planned Action
#442	firebase-tools (dev)	15.18.0 → 15.19.1	patch	✅ green	needs approval	Auto-merge
#440	eslint-plugin-prettier (dev)	5.5.5 → 5.5.6	patch	✅ green	needs approval	Auto-merge
#438	ajv	8.18.0 → 8.20.0	minor	✅ green	needs approval	Auto-merge
#421	tslint (dev)	5.20.1 → 6.1.3	major	✅ green (old base)	needs rebase	Rebase then auto-merge
#441	ava (dev)	7.0.0 → 8.0.1	major	❌ Test fails	needs approval	Skip — CI failing + breaking changes
#424	typescript	5.9.3 → 6.0.3	major	❌ Build fails	needs rebase	Skip — CI failing + breaking changes

---

Changelog Analysis: Major Bumps

tslint 5.20.1 → 6.1.3 — CI ✅ → Recommend merge after rebase

This PR is behind develop (opened April 19, over 30 days ago — auto-rebase disabled by Dependabot). Needs a manual @dependabot rebase trigger.

Breaking changes in v6.0:

• Default formatter changed to stylish
• Formatting/whitespace rules removed from tslint:recommended config
• Pedantic rules removed from tslint:recommended config
• typedef rule arrow-call-signature option stricter

Assessment: tslint is a dev-only deprecated linter and CI passed on the older base. The removed rules only affect linting output, not the compiled extension. Safe to merge after rebase.

---

ava 7.0.0 → 8.0.1 — CI ❌ → Recommend skip (needs manual upgrade work)

Breaking changes in v8.0.0:

• Requires Node.js 22.20+ or 24.12+ (drops Node.js 20)
• AVA is now fully ESM internally — files loaded via import(), not require()
• CommonJS imports change: const test = require('ava') → const {default: test} = require('ava')
• @ava/typescript must be upgraded to v7
• Object form of extensions config removed; default extensions are now js/mjs only (no cjs)
• Transpilation must use Node.js customization hooks (not --require ts-node/register)

Assessment: This is a non-trivial migration. The project uses ts-node/register for transpilation (per CLAUDE.md) which is incompatible with AVA 8's ESM-first approach. Skipping — needs a dedicated upgrade effort.

---

typescript 5.9.3 → 6.0.3 — CI ❌ → Recommend skip (build broken)

Breaking changes in TypeScript 6.0:

• Stricter type narrowing and inference
• Several previously-allowed patterns now produce errors
• Requires tsconfig and potentially code updates

Assessment: Build is already failing on the old base. The project CLAUDE.md notes past tsconfig issues with TypeScript upgrades. Skipping — needs a dedicated migration effort.

---

Action Plan

1. Auto-merge chore(deps-dev): bump firebase-tools from 15.18.0 to 15.19.1 #442, chore(deps-dev): bump eslint-plugin-prettier from 5.5.5 to 5.5.6 in /functions #440, chore(deps): bump ajv from 8.18.0 to 8.20.0 in /functions #438 (patch/minor, CI green, no breaking changes)
2. Rebase then auto-merge chore(deps-dev): bump tslint from 5.20.1 to 6.1.3 in /functions #421 tslint — post @dependabot rebase, wait for CI, then merge
3. Skip chore(deps-dev): bump ava from 7.0.0 to 8.0.1 in /functions #441 ava, chore(deps): bump typescript from 5.9.3 to 6.0.3 in /functions #424 typescript — both need manual migration work; leaving open for now

Please comment to confirm (or override specific PRs) so I can proceed.

[macminisupport]

Duplicate of #443, which has been actioned and closed. All decisions and status updates are in #443.

---

Generated by Claude Code