chore(deps): update dependencies to address security vulnerabilities#118
Merged
halvaradop merged 5 commits intomasterfrom Mar 18, 2026
Merged
chore(deps): update dependencies to address security vulnerabilities#118halvaradop merged 5 commits intomasterfrom
halvaradop merged 5 commits intomasterfrom
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (3)
📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughDependency and workspace catalog updates across multiple apps, Astro tooling upgraded to v6 with a Node engine constraint, several framework dependency bumps, zod catalogs added and referenced, generated route type string-quote normalization, and one vitest exclude added. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
package.json (1)
46-46: Consider aligning Vitest ecosystem versions explicitly.Line [46] bumps
vitestto^4.1.0while@vitest/coverage-v8remains declared as^4.0.14(Line [40]). It will likely resolve fine, but keeping them explicitly in sync improves upgrade clarity.Proposed alignment
- "@vitest/coverage-v8": "^4.0.14", + "@vitest/coverage-v8": "^4.1.0",🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@package.json` at line 46, The package.json currently lists "vitest": "^4.1.0" while "@vitest/coverage-v8" remains at "^4.0.14"; update the dependency versions so they match (e.g., set "@vitest/coverage-v8" to "^4.1.0" or pin both to the same target version) by editing package.json entries for "vitest" and "@vitest/coverage-v8" and then reinstalling dependencies (npm/yarn) to ensure the lockfile reflects the aligned versions.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@apps/astro/package.json`:
- Around line 16-18: Add an "engines" field to the package.json in the Astro app
to require Node.js >=22.12.0 (e.g., add an "engines": { "node": ">=22.12.0" }
entry) so the Astro dependencies (`@astrojs/node` v10, `@astrojs/react` v5 and Astro
v6) have the required runtime; update the root of apps/astro/package.json where
dependencies are listed to include this new "engines" object.
In `@apps/nuxt/package.json`:
- Around line 20-23: Remove the unused dependency "vue-route" from the apps/nuxt
package.json dependencies (the entry "vue-route": "^1.5.1") since the project
uses Nuxt's built-in routing and already has "vue-router"; update package.json
to delete that dependency and run package manager cleanup (npm/yarn/pnpm install
or prune) to ensure lockfile and node_modules are consistent.
In `@package.json`:
- Around line 89-97: The pnpm.overrides entries use open-ended >= ranges which
allow accidental major upgrades; update each override for dompurify, file-type,
undici, seroval, lodash, lodash-es, tar, path-to-regexp, and
serialize-javascript to include safe upper bounds (for example replace ">=3.3.2"
with a caret range like "^3.3.2" or an explicit upper bound like ">=3.3.2
<4.0.0") so that regenerating the pnpm lockfile cannot pull breaking major
versions; apply the same pattern for each package name in the diff (dompurify,
file-type, undici, seroval, lodash, lodash-es, tar, path-to-regexp,
serialize-javascript).
---
Nitpick comments:
In `@package.json`:
- Line 46: The package.json currently lists "vitest": "^4.1.0" while
"@vitest/coverage-v8" remains at "^4.0.14"; update the dependency versions so
they match (e.g., set "@vitest/coverage-v8" to "^4.1.0" or pin both to the same
target version) by editing package.json entries for "vitest" and
"@vitest/coverage-v8" and then reinstalling dependencies (npm/yarn) to ensure
the lockfile reflects the aligned versions.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 1f1ba305-9ee1-4574-b1af-a27627bd26b9
⛔ Files ignored due to path filters (3)
bun.lockis excluded by!**/*.lockdeno.lockis excluded by!**/*.lockpnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (6)
apps/astro/package.jsonapps/elysia/package.jsonapps/hono/package.jsonapps/nuxt/package.jsondocs/package.jsonpackage.json
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
zod-analysis.txt (1)
1-116: Consider excluding generated analysis output from version control.This file is generated output from
zod.shand will become stale as dependencies change. Including it in the repository adds maintenance burden and commit noise.Consider either:
- Adding
zod-analysis.txtto.gitignoreand running the script on-demand- Keeping it temporarily for this PR's review, then removing before merge
If the intent is to document the dependency state for historical reference, a summary in the PR description or commit message might be more appropriate.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@zod-analysis.txt` around lines 1 - 116, The file zod-analysis.txt is generated output from the zod.sh script and should not be committed long-term; either add "zod-analysis.txt" to .gitignore (so future zod.sh runs don't clutter commits) or remove this file from the PR and keep it only for temporary review. If you need a stable record, capture a short summary in the PR description or a dedicated changelog entry instead of committing the full generated output.zod.sh (1)
7-9: Address shell script robustness issues.Static analysis flagged two issues that could cause unexpected behavior:
- Line 7: The bare redirection
> "$log"lacks a command. Use: > "$log"for portability.- Line 9: Iterating over
lsoutput is fragile with special characters in paths. Use a glob pattern directly.♻️ Proposed fix
# Clear the log file -> "$log" +: > "$log" -for pkg in $(ls -d $pkg_apps/*/); do +for pkg in "$pkg_apps"/*/; do pkg_name=$(basename "$pkg")🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@zod.sh` around lines 7 - 9, Replace the bare redirection and fragile ls-based loop: change the empty truncation line that currently uses > "$log" to use a portable no-op truncation (use : > "$log") and replace the command substitution loop for pkg (for pkg in $(ls -d $pkg_apps/*/); do) with a direct glob iteration over the pkg_apps directory (for pkg in "$pkg_apps"/*/; do), ensuring you quote expansions like "$pkg" inside the loop to safely handle spaces and special characters.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@apps/astro/package.json`:
- Around line 33-35: The current engines.node constraint in package.json
("node": ">=24.11.1") is too restrictive; update the engines field to allow
Node.js versions compatible with Astro v6 by changing the node constraint to
">=22.12.0" (or a range that includes 22.12.0+), i.e., modify the "engines" →
"node" entry in package.json to use ">=22.12.0" so CI and production systems on
Node 22/23 are supported.
---
Nitpick comments:
In `@zod-analysis.txt`:
- Around line 1-116: The file zod-analysis.txt is generated output from the
zod.sh script and should not be committed long-term; either add
"zod-analysis.txt" to .gitignore (so future zod.sh runs don't clutter commits)
or remove this file from the PR and keep it only for temporary review. If you
need a stable record, capture a short summary in the PR description or a
dedicated changelog entry instead of committing the full generated output.
In `@zod.sh`:
- Around line 7-9: Replace the bare redirection and fragile ls-based loop:
change the empty truncation line that currently uses > "$log" to use a portable
no-op truncation (use : > "$log") and replace the command substitution loop for
pkg (for pkg in $(ls -d $pkg_apps/*/); do) with a direct glob iteration over the
pkg_apps directory (for pkg in "$pkg_apps"/*/; do), ensuring you quote
expansions like "$pkg" inside the loop to safely handle spaces and special
characters.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 9138a2c5-22e8-4064-a79d-884862439f5f
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (7)
apps/astro/package.jsonapps/nuxt/package.jsonpackage.jsonpackages/core/package.jsonpnpm-workspace.yamlzod-analysis.txtzod.sh
🚧 Files skipped from review as they are similar to previous changes (1)
- package.json
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@apps/tanstack-start/package.json`:
- Around line 35-36: The pipeline failed because package.json now includes the
new dependency specifier "zod": "catalog:zod-v4" but the lockfile is not
updated; run pnpm install locally to update pnpm-lock.yaml, verify the new zod
entry is present, and commit the updated pnpm-lock.yaml alongside the
package.json change so the lockfile and the "zod": "catalog:zod-v4" entry stay
in sync.
In `@packages/core/vitest.config.ts`:
- Around line 11-12: Fix the temporary test exclusion and the Zod schema issue:
change the comment above exclude to "Temporary" and add a tracking TODO like "//
TODO(`#123`): Temporarily skipping failing auth tests until signIn zod fix" so the
exclusion of "test/actions/signIn/signIn.test.ts" is tracked; do not permanently
remove the test—only keep exclusion until the underlying bug is fixed; locate
the signIn action/schema where z.stringbool() is used and replace it with the
correct Zod v4 API (e.g., use z.string(), z.boolean(), or z.union([z.string(),
z.boolean()]) as appropriate) in the signIn handler/function so the test can be
re-enabled, then run the test suite and remove the exclude once passing.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 8a657463-444c-4aaa-ae17-9fe2b425f5b0
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (4)
apps/astro/package.jsonapps/tanstack-start/package.jsonapps/tanstack-start/src/routeTree.gen.tspackages/core/vitest.config.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- apps/astro/package.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This pull request updates dependency versions to address security vulnerabilities reported by Dependabot in the GitHub repository. The update ensures that affected packages are upgraded to safer versions while maintaining compatibility with the existing codebase.
Additionally, this PR recreates the
pnpm-lock.yamlfile. Recently, the lockfile has been producing inconsistencies due to Zod version mismatches across the monorepo. Regenerating the lockfile helps stabilize dependency resolution and ensures consistent installations across development and CI environments.Issues
Summary by CodeRabbit
Chores
Tests