Skip to content

Update dependencies #67

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
brionmario wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update dependencies #67

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions .github/workflows/pr-builder.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,28 @@ env:
NODE_VERSION: "lts/*"

jobs:
audit:
name: 🔍 Security Audit
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- name: 📥 Checkout Code
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
Comment on lines +17 to +23

@coderabbitai coderabbitai Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Restrict the audit job token and disable credential persistence.

This job uses default GITHUB_TOKEN permissions. actions/checkout also persists the token by default. pnpm audit only needs repository read access. Set permissions: contents: read for this job and set persist-credentials: false on checkout.

Proposed fix 
   audit:
     name: 🔍 Security Audit
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
@@
       - name: 📥 Checkout Code
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
audit:
name: 🔍 Security Audit
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- name: 📥 Checkout Code
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
audit:
name: 🔍 Security Audit
permissions:
contents: read
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- name: 📥 Checkout Code
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
persist-credentials: false
🧰 Tools
🪛 zizmor (1.29.0)

[warning] 22-23: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[warning] 17-37: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block

(excessive-permissions)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pr-builder.yml around lines 17 - 23, Update the audit job
to restrict its GITHUB_TOKEN with job-level permissions allowing only contents
read access, and configure the actions/checkout step to disable credential
persistence via persist-credentials: false.

Source: Linters/SAST tools


- name: ⚙️ Set up Node.js
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: ${{ env.NODE_VERSION }}

- name: 📦 Set up pnpm
uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
with:
version: latest
run_install: false
Comment on lines +30 to +34

@coderabbitai coderabbitai Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n -C 2 '"packageManager"|"pnpm"|PNPM_VERSION' \
  package.json pnpm-workspace.yaml .github/workflows/pr-builder.yml .github/workflows/release.yml 2>/dev/null || true

Repository: thunder-id/javascript-sdks

Length of output: 361

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- workflow ---'
cat -n .github/workflows/pr-builder.yml | sed -n '1,80p'

printf '%s\n' '--- declared version ---'
python3 - <<'PY'
import json
from pathlib import Path

package = json.loads(Path("package.json").read_text())
declared = package.get("devEngines", {}).get("packageManager", {})
print(declared)
PY

printf '%s\n' '--- version consistency ---'
python3 - <<'PY'
import json
from pathlib import Path

workflow = Path(".github/workflows/pr-builder.yml").read_text()
package = json.loads(Path("package.json").read_text())
declared = package["devEngines"]["packageManager"]["version"]
print(f'workflow_uses_latest={\'version: latest\' in workflow}')
print(f'declared_pnpm_version={declared}')
PY

Repository: thunder-id/javascript-sdks

Length of output: 3441

Use the declared pnpm version

Set version: 11.9.0 to match package.json → devEngines.packageManager.version instead of using the floating latest version.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pr-builder.yml around lines 30 - 34, Update the pnpm setup
step using pnpm/action-setup to set version to the declared 11.9.0 value,
matching package.json’s devEngines.packageManager.version, and replace the
floating latest setting.


- name: 🔍 Run pnpm audit
run: pnpm audit --audit-level=high

dependency-review:
name: 🔎 Dependency Review
if: ${{ github.event_name == 'pull_request' }}
Expand Down
2 changes: 1 addition & 1 deletion packages/nextjs/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@
"@thunderid/prettier-config": "catalog:",
"@types/node": "catalog:",
"eslint": "catalog:",
"next": "15.5.18",
"next": "15.5.23",
"prettier": "catalog:",
"react": "catalog:",
"rimraf": "catalog:",
Expand Down
8 changes: 4 additions & 4 deletions packages/nuxt/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,24 +73,24 @@
"typecheck": "nuxt module-build prepare && vue-tsc --noEmit"
},
"dependencies": {
"@nuxt/kit": "3.21.7",
"@nuxt/kit": "3.21.11",
"@thunderid/browser": "workspace:^",
"@thunderid/node": "workspace:^",
"@thunderid/vue": "workspace:^",
"defu": "6.1.5",
"jose": "catalog:"
},
"devDependencies": {
"@nuxt/devtools": "2.6.4",
"@nuxt/devtools": "3.4.1",
"@nuxt/module-builder": "1.0.1",
"@nuxt/schema": "3.21.7",
"@nuxt/schema": "3.21.11",
"@nuxt/test-utils": "3.17.2",
"@thunderid/eslint-plugin": "catalog:",
"@thunderid/prettier-config": "catalog:",
"@types/node": "catalog:",
"eslint": "catalog:",
"h3": "1.15.11",
"nuxt": "3.21.7",
"nuxt": "3.21.11",
"typescript": "catalog:",
"vitest": "catalog:"
},
Expand Down
1 change: 1 addition & 0 deletions packages/tanstack-router/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@
"@thunderid/react": "workspace:^",
"@types/node": "catalog:",
"@types/react": "catalog:",
"@vitest/browser-playwright": "catalog:",
"eslint": "catalog:",
"prettier": "catalog:",
"react": "catalog:",
Expand Down
6 changes: 5 additions & 1 deletion packages/vue/src/styles/__tests__/injectStyles.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,14 @@
// Copyright 2025 The ThunderID Authors
// SPDX-License-Identifier: Apache-2.0

import {afterEach, describe, expect, it} from 'vitest';
import {afterEach, beforeEach, describe, expect, it} from 'vitest';
import {injectStyles} from '../injectStyles';

describe('injectStyles', () => {
beforeEach(() => {
document.head.innerHTML = '';
});

afterEach(() => {
document.head.innerHTML = '';
});
Expand Down
Loading
Loading