chore: pnpm update and audit fixes by RobbieTheWagner · Pull Request #3463 · shipshapecode/shepherd

RobbieTheWagner · 2026-08-10T02:22:42Z

What

pnpm update -r — updates all workspace dependencies within their existing semver ranges
Adds pnpm.overrides in pnpm-workspace.yaml for vulnerable transitive deps flagged by pnpm audit: tar, sharp, minimatch, esbuild, svelte, sigstore, diff, @tootallnate/once
Applies a prettier formatting change to shepherd.js/src/tour.ts picked up by the updated toolchain
Gitignores landing/.vercel/ build output

What's left

pnpm audit still reports 9 findings (2 high), all in astro 5.x / @astrojs/vercel, used only by the docs and landing sites at build time — the published packages are unaffected. Fixing those requires the astro 7 major upgrade (pnpm audit --fix tried to force it via overrides, which breaks @astrojs/mdx and @astrojs/vercel), so that's left for a dedicated follow-up.

Verification

pnpm build (all packages) ✅
landing and docs-src astro builds ✅
pnpm test:unit:ci + react-shepherd tests ✅
pnpm lint ✅

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Updated development, documentation, and landing page tooling to newer versions.
- Upgraded the project’s supported Node.js and pnpm versions.
- Added safeguards for minimum safe versions of select supporting packages.
- Excluded Vercel-generated files from landing page version control.
- Updated the publishing environment to use Node.js 24.
Style
- Reformatted an internal type declaration without changing behavior.

Updates all workspace dependencies within their semver ranges and adds pnpm overrides for vulnerable transitive dependencies (tar, sharp, minimatch, esbuild, svelte, sigstore, diff, @tootallnate/once). The remaining audit findings are all in astro 5.x, which only affects the docs/landing sites at build time; fixing those requires an astro 7 major upgrade, left for a follow-up. Also gitignores landing/.vercel build output. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

vercel · 2026-08-10T02:22:48Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
shepherd-docs	Ready	Preview	Aug 10, 2026 2:51am
shepherd-landing	Ready	Preview	Aug 10, 2026 2:51am

coderabbitai · 2026-08-10T02:23:03Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a21df9c1-a009-4068-9809-170b97946572

📥 Commits

Reviewing files that changed from the base of the PR and between 56e6add and a8e43d7.

📒 Files selected for processing (1)

pnpm-workspace.yaml

📝 Walkthrough

Walkthrough

The pull request updates dependency versions across documentation, landing, root, React, and Shepherd packages. It standardizes Node.js and pnpm versions, adds workspace build permissions and dependency overrides, ignores .vercel/, and reformats one exported union type.

Changes

Dependency and tooling updates

Layer / File(s)	Summary
Runtime and package manager alignment `.tool-versions`, `.github/workflows/publish.yml`	Updates Node.js to 24.14.1 and pnpm to 11.21.0. The publish workflow uses Node.js 24.
Package dependency upgrades `docs-src/package.json`, `landing/package.json`, `package.json`, `packages/react/package.json`, `shepherd.js/package.json`	Updates documentation, Astro, Tailwind, React, testing, linting, build, and Shepherd dependency versions.
Workspace safeguards and source formatting `pnpm-workspace.yaml`, `landing/.gitignore`, `shepherd.js/src/tour.ts`	Adds build permissions and minimum-version overrides, ignores `.vercel/`, and reformats `TourConfirmCancel` without changing its public contract.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

shipshapecode/shepherd#3324: Updates dependency versions in the same package manifests.
shipshapecode/shepherd#3444: Updates overlapping root development dependencies.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: workspace dependency updates and security-related override fixes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch pnpm-update-audit

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

qltysh · 2026-08-10T02:24:46Z

Coverage Impact

This PR will not change total coverage.

🚦 See full report on Qlty Cloud »

🛟 Help

Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.
Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.
File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)
- Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

coderabbitai

🧹 Nitpick comments (1)

docs-src/package.json (1)
15-15: 🔒 Security & Privacy | 🔵 Trivial

Verify the remaining Astro audit exception before release.

This manifest keeps astro at ^5.18.2. The PR reports two high-severity audit findings in the Astro 5.x and @astrojs/vercel dependency path. The same Astro line is used by landing/package.json Lines 15-17. landing/astro.config.mjs Lines 9-19 select the Vercel adapter, and landing/src/pages/api/checkout.ts contains a checkout route. Confirm that the affected behavior is limited to the build process. Otherwise, record a time-bound exception, mitigation, owner, and Astro 7 upgrade issue before release.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs-src/package.json` at line 15, Verify the Astro audit findings associated
with the "astro" dependency in the package manifest, including the Vercel
adapter and checkout route configuration. Confirm whether the affected behavior
is limited to the build process; if not, document a time-bound exception with
mitigation and owner, and create an Astro 7 upgrade issue before release.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@docs-src/package.json`:
- Line 15: Verify the Astro audit findings associated with the "astro"
dependency in the package manifest, including the Vercel adapter and checkout
route configuration. Confirm whether the affected behavior is limited to the
build process; if not, document a time-bound exception with mitigation and
owner, and create an Astro 7 upgrade issue before release.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 61cc0287-2bda-439e-8b57-9bf3b5adc573

📥 Commits

Reviewing files that changed from the base of the PR and between b43261b and f1ef007.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (8)

docs-src/package.json
landing/.gitignore
landing/package.json
package.json
packages/react/package.json
pnpm-workspace.yaml
shepherd.js/package.json
shepherd.js/src/tour.ts

coderabbitai

🧹 Nitpick comments (1)

.github/workflows/publish.yml (1)
33-33: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Pin the publish job to the exact Node.js version.

Line 33 uses the floating 24 range, while .tool-versions pins nodejs 24.14.1. A future Node.js 24 patch release can make publishing use a different runtime from local tooling. Set node-version to 24.14.1 to keep the runtime contract consistent.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/publish.yml at line 33, Update the publish workflow’s
node-version setting from the floating 24 range to the exact 24.14.1 version,
matching the repository’s pinned Node.js runtime in .tool-versions.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/publish.yml:
- Line 33: Update the publish workflow’s node-version setting from the floating
24 range to the exact 24.14.1 version, matching the repository’s pinned Node.js
runtime in .tool-versions.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 61962a60-2e07-4fb8-97f2-47da4b632b4c

📥 Commits

Reviewing files that changed from the base of the PR and between f1ef007 and 56e6add.

📒 Files selected for processing (6)

.github/workflows/publish.yml
.tool-versions
docs-src/package.json
landing/package.json
package.json
shepherd.js/package.json

🚧 Files skipped from review as they are similar to previous changes (3)

landing/package.json
docs-src/package.json
package.json

RobbieTheWagner added the internal label Aug 10, 2026

coderabbitai Bot reviewed Aug 10, 2026

View reviewed changes

Bump pnpm and node

56e6add

vercel Bot had a problem deploying to Preview – shepherd-landing August 10, 2026 02:33 Failure

vercel Bot had a problem deploying to Preview – shepherd-docs August 10, 2026 02:33 Failure

coderabbitai Bot reviewed Aug 10, 2026

View reviewed changes

Update pnpm-workspace.yaml

a8e43d7

vercel Bot deployed to Preview – shepherd-landing August 10, 2026 02:46 View deployment

vercel Bot deployed to Preview – shepherd-docs August 10, 2026 02:46 View deployment

RobbieTheWagner merged commit 5fdd24c into main Aug 10, 2026
8 checks passed

RobbieTheWagner deleted the pnpm-update-audit branch August 10, 2026 02:51

github-actions Bot mentioned this pull request Aug 10, 2026

Prepare Release #3378

Merged

Navigation Menu

Uh oh!

Uh oh!

chore: pnpm update and audit fixes - #3463

chore: pnpm update and audit fixes#3463
RobbieTheWagner merged 3 commits into
mainfrom
pnpm-update-audit

RobbieTheWagner commented Aug 10, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 10, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

qltysh Bot commented Aug 10, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

RobbieTheWagner commented Aug 10, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

What's left

Verification

Summary by CodeRabbit

Uh oh!

vercel Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

qltysh Bot commented Aug 10, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

RobbieTheWagner commented Aug 10, 2026 •

edited by coderabbitai Bot

Loading

vercel Bot commented Aug 10, 2026 •

edited

Loading

coderabbitai Bot commented Aug 10, 2026 •

edited

Loading