🐛 Fixed dependency-inspector to use pnpm instead of yarn#27342
Conversation
The pnpm migration missed two things in this script: - `displayAuditSummary()` still called `yarn audit` — switched to `pnpm audit` and updated the JSON parsing (pnpm returns a single object with `metadata.vulnerabilities` instead of yarn's newline-delimited JSON) - `parsePnpmOutdatedOutput()` referenced `info.current` which pnpm's `outdated --json` does not include — switched to `info.wanted` which is the lockfile-resolved version
WalkthroughThe 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/scripts/dependency-inspector.js (1)
661-673: Harden vulnerability math against partial metadata.On Line 663, missing keys can produce
NaNtotals. Default each bucket to0before summing.Proposed hardening diff
if (data.metadata && data.metadata.vulnerabilities) { const v = data.metadata.vulnerabilities; - const total = v.info + v.low + v.moderate + v.high + v.critical; + const info = Number(v.info ?? 0); + const low = Number(v.low ?? 0); + const moderate = Number(v.moderate ?? 0); + const high = Number(v.high ?? 0); + const critical = Number(v.critical ?? 0); + const total = info + low + moderate + high + critical; console.log(` Total vulnerabilities: ${total}`); - console.log(` 🔴 Critical: ${v.critical}`); - console.log(` 🟠 High: ${v.high}`); - console.log(` 🟡 Moderate: ${v.moderate}`); - console.log(` 🟢 Low: ${v.low}`); - if (v.info > 0) { - console.log(` ℹ️ Info: ${v.info}`); + console.log(` 🔴 Critical: ${critical}`); + console.log(` 🟠 High: ${high}`); + console.log(` 🟡 Moderate: ${moderate}`); + console.log(` 🟢 Low: ${low}`); + if (info > 0) { + console.log(` ℹ️ Info: ${info}`); }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/scripts/dependency-inspector.js around lines 661 - 673, The vulnerability math can produce NaN when some buckets are missing; in the block using data.metadata.vulnerabilities (variable v and total), default each vulnerability bucket to 0 before summing and before printing. Locate the declaration "const v = data.metadata.vulnerabilities" and replace usage with a version that extracts or normalizes each bucket (critical, high, moderate, low, info) to a numeric default (e.g., via destructuring with =0 or Number(...)||0), compute total from those normalized values, and use those normalized variables in the console.log lines so missing keys do not produce NaN.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/scripts/dependency-inspector.js:
- Around line 661-673: The vulnerability math can produce NaN when some buckets
are missing; in the block using data.metadata.vulnerabilities (variable v and
total), default each vulnerability bucket to 0 before summing and before
printing. Locate the declaration "const v = data.metadata.vulnerabilities" and
replace usage with a version that extracts or normalizes each bucket (critical,
high, moderate, low, info) to a numeric default (e.g., via destructuring with =0
or Number(...)||0), compute total from those normalized values, and use those
normalized variables in the console.log lines so missing keys do not produce
NaN.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 9741d4c0-3a16-47c2-bd7c-8532099dad91
📒 Files selected for processing (1)
.github/scripts/dependency-inspector.js
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #27342 +/- ##
=======================================
Coverage 73.46% 73.46%
=======================================
Files 1545 1545
Lines 123724 123724
Branches 14970 14971 +1
=======================================
Hits 90893 90893
- Misses 31808 31829 +21
+ Partials 1023 1002 -21
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
ref TryGhost@f186b6a - Switched `displayAuditSummary()` from `yarn audit` to `pnpm audit` and updated the JSON parsing — pnpm returns a single object with `metadata.vulnerabilities` instead of yarn's newline-delimited JSON - Fixed `parsePnpmOutdatedOutput()` to use `info.wanted` instead of `info.current`, which pnpm's `outdated --json` does not include These were missed during the pnpm migration in TryGhost#27017.
1 participant
Summary
displayAuditSummary()fromyarn audittopnpm auditand updated the JSON parsing — pnpm returns a single object withmetadata.vulnerabilitiesinstead of yarn's newline-delimited JSONparsePnpmOutdatedOutput()to useinfo.wantedinstead ofinfo.current, which pnpm'soutdated --jsondoes not includeThese were missed during the pnpm migration in #27017.