Update dependencies - #67
Open
brionmario wants to merge 1 commit into
Open
Conversation
- Removed temporary minimum release age exclusions for eslint-plugin and prettier-config. - Added various overrides to address security vulnerabilities in dependencies including body-parser, brace-expansion, js-yaml, nanoid, postcss, sharp, shell-quote, svgo, and tar. - Updated catalog dependencies for @thunderid/eslint-plugin and @thunderid/prettier-config to version 1.0.0. - Updated @vitest/browser-playwright to version 4.1.10, dompurify to 3.4.13, react-router to 7.18.2, and vitest to 4.1.10. - Added minimum release age exclusion for all @ThunderID packages. chore: upgrade Next.js in nextjs quickstart sample - Updated Next.js dependency from ^15.3.3 to ^15.5.23 in samples/nextjs/quickstart/package.json. chore: upgrade Nuxt in nuxt quickstart sample - Updated Nuxt dependency from ^4.4.8 to ^4.5.2 in samples/nuxt/quickstart/package.json. chore: upgrade react-router in react quickstart sample - Updated react-router dependency from ^7.6.2 to ^7.18.2 in samples/react/quickstart/package.json.
📝 WalkthroughWalkthroughThe PR adds a pull-request security audit, updates workspace dependency policies and package versions, adds browser test tooling, updates quickstart dependencies, and resets document head state before Vue style tests. ChangesDependency maintenance
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr-builder.yml:
- Around line 17-23: Update the audit job to restrict its GITHUB_TOKEN with
job-level permissions allowing only contents read access, and configure the
actions/checkout step to disable credential persistence via persist-credentials:
false.
- Around line 30-34: Update the pnpm setup step using pnpm/action-setup to set
version to the declared 11.9.0 value, matching package.json’s
devEngines.packageManager.version, and replace the floating latest setting.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: a9702735-e9d7-4461-b6d4-1049ff8709bc
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (9)
.github/workflows/pr-builder.ymlpackages/nextjs/package.jsonpackages/nuxt/package.jsonpackages/tanstack-router/package.jsonpackages/vue/src/styles/__tests__/injectStyles.test.tspnpm-workspace.yamlsamples/nextjs/quickstart/package.jsonsamples/nuxt/quickstart/package.jsonsamples/react/quickstart/package.json
Comment on lines
+17
to
+23
| audit: | ||
| name: 🔍 Security Audit | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 5 | ||
| steps: | ||
| - name: 📥 Checkout Code | ||
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Restrict the audit job token and disable credential persistence.
This job uses default GITHUB_TOKEN permissions. actions/checkout also persists the token by default. pnpm audit only needs repository read access. Set permissions: contents: read for this job and set persist-credentials: false on checkout.
Proposed fix
audit:
name: 🔍 Security Audit
+ permissions:
+ contents: read
runs-on: ubuntu-latest
@@
- name: 📥 Checkout Code
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| audit: | |
| name: 🔍 Security Audit | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: 📥 Checkout Code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| audit: | |
| name: 🔍 Security Audit | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: 📥 Checkout Code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 22-23: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 17-37: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr-builder.yml around lines 17 - 23, Update the audit job
to restrict its GITHUB_TOKEN with job-level permissions allowing only contents
read access, and configure the actions/checkout step to disable credential
persistence via persist-credentials: false.
Source: Linters/SAST tools
Comment on lines
+30
to
+34
| - name: 📦 Set up pnpm | ||
| uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 | ||
| with: | ||
| version: latest | ||
| run_install: false |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n -C 2 '"packageManager"|"pnpm"|PNPM_VERSION' \
package.json pnpm-workspace.yaml .github/workflows/pr-builder.yml .github/workflows/release.yml 2>/dev/null || trueRepository: thunder-id/javascript-sdks
Length of output: 361
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/pr-builder.yml | sed -n '1,80p'
printf '%s\n' '--- declared version ---'
python3 - <<'PY'
import json
from pathlib import Path
package = json.loads(Path("package.json").read_text())
declared = package.get("devEngines", {}).get("packageManager", {})
print(declared)
PY
printf '%s\n' '--- version consistency ---'
python3 - <<'PY'
import json
from pathlib import Path
workflow = Path(".github/workflows/pr-builder.yml").read_text()
package = json.loads(Path("package.json").read_text())
declared = package["devEngines"]["packageManager"]["version"]
print(f'workflow_uses_latest={\'version: latest\' in workflow}')
print(f'declared_pnpm_version={declared}')
PYRepository: thunder-id/javascript-sdks
Length of output: 3441
Use the declared pnpm version
Set version: 11.9.0 to match package.json → devEngines.packageManager.version instead of using the floating latest version.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr-builder.yml around lines 30 - 34, Update the pnpm setup
step using pnpm/action-setup to set version to the declared 11.9.0 value,
matching package.json’s devEngines.packageManager.version, and replace the
floating latest setting.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Approach
$subject
Related Issues
Related PRs
Checklist
breaking changelabel added.Security checks
Summary by CodeRabbit
Security
Dependency Updates
Tests