chore(deps): major dependency upgrades and security fixes#50
Merged
Conversation
Update npm dependencies across the stack to resolve Dependabot alerts (61 → 0 reported vulnerabilities). Key upgrades include SvelteKit 2.61, adapter-vercel 6, Prisma 7.8, Vite 8, Vitest 4, Stripe 22, and nodemailer 8. - Add npm overrides for cookie and @hono/node-server - Migrate lucide-svelte to @lucide/svelte - Remove vite-plugin-devtools-json (no Vite 8 peer support yet) - Configure Vitest 4 browser mode with @vitest/browser-playwright - Fix API case-create tests to validate Input before invoking handlers Co-authored-by: Ben Spurlock <BenDaSpur@users.noreply.github.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (7)
💤 Files with no reviewable changes (1)
WalkthroughBumps many dependencies, migrates icon imports from lucide-svelte to ChangesDependency and Build Infrastructure
Icon Library Migration
Tests and Runtime Adjustments
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Warning Tools execution failed with the following error: Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error) Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Co-authored-by: Ben Spurlock <BenDaSpur@users.noreply.github.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/lib/components/AttachmentViewer.svelte (1)
171-174:⚠️ Potential issue | 🟡 Minor | ⚡ Quick win♻️ Replace deprecated
<svelte:component>with a capitalized dynamic component variable (Svelte 5 runes)
<svelte:component this={...} />is deprecated in Svelte 5 runes mode; render thegetAttachmentIcon(attachment.mimeType)result as a capitalized component variable instead to avoid the deprecation warning.♻️ Render the dynamic icon directly
<div class="text-surface-600-300"> - <svelte:component - this={getAttachmentIcon(attachment.mimeType)} - class="h-5 w-5" - /> + {`@const` AttachmentIcon = getAttachmentIcon(attachment.mimeType)} + <AttachmentIcon class="h-5 w-5" /> </div>🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/components/AttachmentViewer.svelte` around lines 171 - 174, The current use of <svelte:component this={getAttachmentIcon(attachment.mimeType)} /> is deprecated in runes mode; change it to capture the result of getAttachmentIcon(attachment.mimeType) into a capitalized component variable (e.g., Icon) and render that variable as a normal component (ensure the identifier is capitalized so Svelte treats it as a component) with the same class props; update the code paths that call getAttachmentIcon and the rendering site in AttachmentViewer.svelte accordingly and guard for a falsy return (render nothing or a fallback) if getAttachmentIcon returns null/undefined.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/__tests__/api/projects/cases/create/server.test.ts`:
- Around line 11-14: The current test uses an unsafe "as any" cast for
POST_ENDPOINT when creating endpointHandler; replace this by importing the
endpoint module's default export directly (use "import POST_ENDPOINT from
'.../POST'") and then type the handler explicitly using the known handler
signature (associate POST_ENDPOINT/default with the function type that takes
z.infer<typeof Input> & z.infer<typeof Param> and returns Promise<PostResult>)
so you remove the "as any" assertion on endpointHandler; update references to
POST_ENDPOINT and endpointHandler accordingly to keep typesafe tests.
In `@src/routes/`+error.svelte:
- Line 3: The import line in +error.svelte imports unused icons AlertTriangle,
Frown, and ServerCrash; remove those three symbols from the import statement so
only the used icons (e.g., Bug, Home, ArrowLeft) are imported to reduce bundle
size and eliminate unused imports in the file.
In `@src/routes/admin/teams/`+page.svelte:
- Line 2: The import statement bringing in Building2, Users, Mail, Phone,
Calendar, and Shield from '`@lucide/svelte`' is unused and should be removed;
delete the line that imports these symbols (Building2, Users, Mail, Phone,
Calendar, Shield) from your +page.svelte module so ESLint warnings are resolved
and bundle size is reduced, or if any icon is later needed, reintroduce only the
specific named export(s) where they are actually used in the markup.
In `@src/routes/contact/`+page.svelte:
- Line 2: The import replaced the Github icon with CodeXml (see import line
using Mail, CodeXml, MessageCircle) but the "Report Issues" card still links to
GitHub; if you want the GitHub logo back, restore the Github symbol in the
import list (replace CodeXml with Github) and update the card markup to use
Github instead of CodeXml; if the change was intentional to avoid brand icons,
leave CodeXml but confirm the "Report Issues" card text/aria-label still clearly
indicates GitHub so users aren’t confused.
In `@src/routes/Header.svelte`:
- Line 6: The import statement in Header.svelte pulls in an unused symbol "User"
from '`@lucide/svelte`'; remove "User" from the named imports in the import line
(leaving X, Menu, LogOut) so the component only imports icons that are actually
used (verify there are no references to the User symbol elsewhere in
Header.svelte before removing).
In `@src/routes/teams/`[teamId]/payment-required/+page.svelte:
- Line 2: The import list in the component includes an unused symbol CheckCircle
from '`@lucide/svelte`'; remove CheckCircle from the import statement (leaving
CreditCard and AlertTriangle) to eliminate the unused import and associated
linter warning in the +page.svelte component.
---
Outside diff comments:
In `@src/lib/components/AttachmentViewer.svelte`:
- Around line 171-174: The current use of <svelte:component
this={getAttachmentIcon(attachment.mimeType)} /> is deprecated in runes mode;
change it to capture the result of getAttachmentIcon(attachment.mimeType) into a
capitalized component variable (e.g., Icon) and render that variable as a normal
component (ensure the identifier is capitalized so Svelte treats it as a
component) with the same class props; update the code paths that call
getAttachmentIcon and the rendering site in AttachmentViewer.svelte accordingly
and guard for a falsy return (render nothing or a fallback) if getAttachmentIcon
returns null/undefined.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 8233f2af-b3d0-4acc-9b1c-6d72e88ef3aa
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json,!**/package-lock.json
📒 Files selected for processing (56)
package.jsonsrc/__tests__/api/projects/cases/create/server.test.tssrc/lib/components/AttachmentViewer.sveltesrc/lib/components/DraggableTestCase.sveltesrc/lib/components/ErrorDisplay.sveltesrc/lib/components/JiraIssueModal.sveltesrc/lib/components/LoadMoreButton.sveltesrc/lib/components/NestedSuiteTestCases.sveltesrc/lib/components/NestedTestSuite.sveltesrc/lib/components/PasswordRequirements.sveltesrc/lib/components/ProjectSelector.sveltesrc/lib/components/TestCaseDropZone.sveltesrc/lib/components/TestStepsViewer.sveltesrc/lib/components/ThemeToggle.sveltesrc/lib/server/oidc/jwt.tssrc/lib/server/redis.test.tssrc/lib/server/stripe.tssrc/routes/+error.sveltesrc/routes/+page.sveltesrc/routes/Header.sveltesrc/routes/about/+page.sveltesrc/routes/admin/teams/+page.sveltesrc/routes/authenticators/+page.sveltesrc/routes/blog/+page.sveltesrc/routes/blog/[slug]/+page.sveltesrc/routes/contact-sales/+page.sveltesrc/routes/contact/+page.sveltesrc/routes/dashboard/+page.sveltesrc/routes/features/+page.sveltesrc/routes/invitations/[token]/+page.sveltesrc/routes/onboarding/+page.sveltesrc/routes/pricing/+page.sveltesrc/routes/privacy/+page.sveltesrc/routes/projects/+page.sveltesrc/routes/projects/[projectId]/+page.sveltesrc/routes/projects/[projectId]/cases/+page.sveltesrc/routes/projects/[projectId]/cases/[testCaseId]/+page.sveltesrc/routes/projects/[projectId]/healing/+page.sveltesrc/routes/projects/[projectId]/runs/+page.sveltesrc/routes/projects/[projectId]/runs/[runId]/+page.sveltesrc/routes/projects/new/+page.sveltesrc/routes/reports/+page.sveltesrc/routes/settings/+page.sveltesrc/routes/settings/api-keys/+page.sveltesrc/routes/settings/integrations/jira/+page.sveltesrc/routes/settings/integrations/twilio/+page.sveltesrc/routes/sms/+page.sveltesrc/routes/teams/[teamId]/+page.sveltesrc/routes/teams/[teamId]/invite/+page.sveltesrc/routes/teams/[teamId]/over-limit/+error.sveltesrc/routes/teams/[teamId]/over-limit/+page.sveltesrc/routes/teams/[teamId]/payment-required/+error.sveltesrc/routes/teams/[teamId]/payment-required/+page.sveltesrc/routes/teams/new/+page.sveltesrc/routes/terms/+page.sveltevite.config.ts
| @@ -1,5 +1,5 @@ | |||
| <script lang="ts"> | |||
| import { Mail, Github, MessageCircle } from 'lucide-svelte'; | |||
| import { Mail, CodeXml, MessageCircle } from '@lucide/svelte'; | |||
There was a problem hiding this comment.
🧹 Nitpick | 🔵 Trivial | 💤 Low value
Consider if the icon change from Github to CodeXml is intentional.
The "Report Issues" card links to GitHub Issues, but now uses the generic CodeXml icon instead of the Github icon. While this works, the GitHub logo icon was more semantically appropriate and immediately recognizable for users. If the goal was to avoid brand-specific icons, this is fine; otherwise, consider reverting to Github for better visual clarity.
Also applies to: 52-52
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/routes/contact/`+page.svelte at line 2, The import replaced the Github
icon with CodeXml (see import line using Mail, CodeXml, MessageCircle) but the
"Report Issues" card still links to GitHub; if you want the GitHub logo back,
restore the Github symbol in the import list (replace CodeXml with Github) and
update the card markup to use Github instead of CodeXml; if the change was
intentional to avoid brand icons, leave CodeXml but confirm the "Report Issues"
card text/aria-label still clearly indicates GitHub so users aren’t confused.
Remove unused Lucide imports, replace deprecated svelte:component in AttachmentViewer, type case-create tests via POST_ENDPOINT.default, and add GitHub aria-label on contact page (Github icon unavailable in @lucide/svelte). Co-authored-by: Ben Spurlock <BenDaSpur@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves the bulk of Dependabot/npm audit findings by upgrading dependencies to current major versions and adding targeted npm overrides where upstream packages lag behind.
Audit: 61 vulnerabilities → 0 (
npm audit)Major upgrades
lucide-svelte→@lucide/svelteNotable changes
cookie(^0.7) and@hono/node-server(Prisma dev tooling) until SvelteKit/Prisma ship fixed transitive depsvite-plugin-devtools-json— no Vite 8 peer support yet (dev-only Chrome DevTools JSON; safe to drop)@vitest/browser-playwrightwith the new provider factory API2026-05-27.dahliaInput/ParamZod validation before invoking handlers (matches productionsveltekit-apibehavior)Verification
npm run check— pass (0 errors)npm run test:unit -- --run— 677 passednpm run build— passGET /returns 200Follow-ups (optional)
config.kit.csrf.checkOrigin→csrf.trustedOrigins(SvelteKit deprecation warning)Summary by CodeRabbit