chore(deps): bump swiper, sha.js, and cipher-base#40320
Conversation
|
Looks like this PR is not ready to merge, because of the following issues:
Please fix the issues and try again If you have any trouble, please check the PR guidelines |
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
📜 Recent review details⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
WalkthroughRemoved Storybook webpack aliases for Swiper CSS, upgraded Swiper from 11.1.14 to 12.1.3, added package resolutions pinning several cipher-related sub-dependencies, and added TypeScript path aliases mapping specific Swiper module imports to their .d.ts declarations. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested labels
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Warning Review ran into problems🔥 ProblemsErrors were encountered while retrieving linked issues. Errors (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
package.json (1)
89-92: Resolutions look correct — pins address the cipher-base advisory effectively.
cipher-base@1.0.7is the current latest release and patched version for GHSA-cpq7-6gpm-g9rc (missing input type checks in ≤1.0.4). The four parent-scoped pins force all consumers through1.0.7, and verification confirms all dependency paths resolve correctly to this version.A few optional considerations:
- PR scope: This commit bundles swiper and cipher-base bumps. Per the repo's dependency management preferences, consider splitting unrelated dependency updates into separate chore commits/PRs for easier bisecting and reverting.
- Documentation: A brief comment in this resolutions block (or in the commit message) noting the GHSA reference would help future maintainers understand why these pins exist and when they can be removed (once all parents publish releases with semver ranges ≥1.0.5).
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@package.json` around lines 89 - 92, Add a short explanatory comment in package.json's resolutions block (adjacent to the entries "browserify-aes/cipher-base", "browserify-des/cipher-base", "create-hash/cipher-base", "create-hmac/cipher-base") referencing GHSA-cpq7-6gpm-g9rc and noting these pins force cipher-base@1.0.7 to mitigate the advisory (and when they can be removed once parents publish semver ranges ≥1.0.5); alternatively, if preferred, split this chore into two commits/PRs so the swiper bump and the cipher-base resolutions are separate for easier bisecting and reverting.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@apps/meteor/package.json`:
- Line 296: Update ImageGallery.tsx to use Swiper v12 stable export paths:
replace any imports from 'swiper/modules/index.mjs' with 'swiper/modules', and
switch 'swiper/swiper-react' or 'swiper/swiper-react.mjs' imports to
'swiper/react'; also replace 'swiper/modules/zoom.css' with 'swiper/css/zoom'.
In the Swiper initialization (look for the Swiper component and props like
navigation, nextEl, prevEl in ImageGallery.tsx) prevent duplicate arrows by
either providing empty elements for nextEl/prevEl or disabling Swiper's default
SVG arrows (e.g., supply custom navigation elements or set the appropriate
navigation parameter), and confirm any prior yarn patch related to swiper is no
longer required. Ensure all references (imports and the navigation props wired
to .rcx-swiper-next-button / .rcx-swiper-prev-button) are updated accordingly.
---
Nitpick comments:
In `@package.json`:
- Around line 89-92: Add a short explanatory comment in package.json's
resolutions block (adjacent to the entries "browserify-aes/cipher-base",
"browserify-des/cipher-base", "create-hash/cipher-base",
"create-hmac/cipher-base") referencing GHSA-cpq7-6gpm-g9rc and noting these pins
force cipher-base@1.0.7 to mitigate the advisory (and when they can be removed
once parents publish semver ranges ≥1.0.5); alternatively, if preferred, split
this chore into two commits/PRs so the swiper bump and the cipher-base
resolutions are separate for easier bisecting and reverting.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: d8b15be6-ec3c-47ff-a131-540759900348
⛔ Files ignored due to path filters (2)
.yarn/patches/swiper-npm-11.1.14-8126fa478a.patchis excluded by!**/.yarn/**yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (3)
apps/meteor/.storybook/main.tsapps/meteor/package.jsonpackage.json
💤 Files with no reviewable changes (1)
- apps/meteor/.storybook/main.ts
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: 📦 Build Packages
- GitHub Check: CodeQL-Build
- GitHub Check: CodeQL-Build
🧰 Additional context used
🧠 Learnings (1)
📓 Common learnings
Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 0
File: :0-0
Timestamp: 2026-02-24T19:05:56.710Z
Learning: In Rocket.Chat PRs, keep feature PRs free of unrelated lockfile-only dependency bumps; prefer reverting lockfile drift or isolating such bumps into a separate "chore" commit/PR, and always use yarn install --immutable with the Yarn version pinned in package.json via Corepack.
Learnt from: smirk-dev
Repo: RocketChat/Rocket.Chat PR: 39625
File: apps/meteor/app/api/server/v1/push.ts:85-97
Timestamp: 2026-03-14T14:58:58.834Z
Learning: In RocketChat/Rocket.Chat, the `push.token` POST/DELETE endpoints in `apps/meteor/app/api/server/v1/push.ts` were already migrated to the chained router API pattern on `develop` prior to PR `#39625`. `cleanTokenResult` (which strips `authToken` and returns `PushTokenResult`) and `isPushTokenPOSTProps`/`isPushTokenDELETEProps` validators already exist on `develop`. PR `#39625` only migrates `push.get` and `push.info` to the chained pattern. Do not flag `cleanTokenResult` or `PushTokenResult` as newly introduced behavior-breaking changes when reviewing this PR.
Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 0
File: :0-0
Timestamp: 2026-02-24T19:05:56.710Z
Learning: Rocket.Chat repo context: When a workspace manifest on develop already pins a dependency version (e.g., packages/web-ui-registration → "rocket.chat/ui-contexts": "27.0.1"), a lockfile change in a feature PR that upgrades only that dependency’s resolution is considered a manifest-driven sync and can be kept, preferably as a small "chore: sync yarn.lock with manifests" commit.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #40320 +/- ##
===========================================
+ Coverage 69.81% 69.83% +0.01%
===========================================
Files 3296 3296
Lines 119173 119173
Branches 21479 21503 +24
===========================================
+ Hits 83197 83219 +22
+ Misses 32668 32644 -24
- Partials 3308 3310 +2
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
julio-rocketchat
changed the title
|
✅ Layne — scan passed No security issues found on latest push. |
|
/layne exception-approve LAYNE-fdac70e4e7045771 LAYNE-ba8c270db027b128 LAYNE-fcafeb9d4e0e34c0 reason: false positives |
|
✅ Exception recorded for LAYNE-fdac70e4e7045771, LAYNE-ba8c270db027b128, LAYNE-fcafeb9d4e0e34c0 by @julio-rocketchat: "false positives". Re-running scan... |
|
/backport 8.4.1 |
|
Sorry, I couldn't do that backport because of conflicts. Could you please solve them? you can do so by running the following commands: after that just run |
|
/backport 8.4.1 |
|
Pull request #40373 added to Project: "Patch 8.4.1" |
|
/backport 8.3.3 |
|
Sorry, I couldn't do that backport because of conflicts. Could you please solve them? you can do so by running the following commands: after that just run |
|
/backport 8.3.3 |
|
Pull request #40396 added to Project: "Patch 8.3.3" |
|
/backport 8.2.3 |
|
Sorry, I couldn't do that backport because of conflicts. Could you please solve them? you can do so by running the following commands: after that just run |
|
/backport 8.2.3 |
|
Pull request #40454 added to Project: "Patch 8.2.3" |
2 participants
Proposed changes (including videos or screenshots)
Bump dependencies to solve CVEs.
Issue(s)
https://rocketchat.atlassian.net/browse/SB-987
Steps to test or reproduce
N/A
Further comments
N/A
Summary by CodeRabbit