Update vue-i18n package version (#934)#935
Conversation
WalkthroughThe version of the "vue-i18n" dependency in the Changes
Assessment against linked issues
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
webroot/package.json (1)
37-37: Confirm lock-file regeneration & optionally force‐pin viaresolutionsThe dependency bump to
vue-i18n@10.0.8is the right move for the CVE, but make sure:
yarn.lockwas deleted/re-generated and committed after the change; otherwise CI may still install the vulnerable 10.0.6.- No other direct or transitive packages re-introduce 10.0.6. To guarantee this you can add a top-level resolution:
"resolutions": { + "vue-i18n": "10.0.8", "stylelint-config-rational-order/**/trim": "^0.0.3",
- Verify that
@intlify/unplugin-vue-i18n@0.6.2declares compatibility with 10.0.8 (it usually does, but worth a quick peer-dep check).Please rerun
yarn install && yarn audit:dependencies && yarn test:unit:alllocally and ensure the lockfile diff is included before merging.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
webroot/yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (1)
webroot/package.json(1 hunks)
🧰 Additional context used
🧠 Learnings (2)
📓 Common learnings
Learnt from: jsandoval81
PR: csg-org/CompactConnect#873
File: webroot/src/styles.common/_inputs.less:115-118
Timestamp: 2025-06-24T00:17:31.188Z
Learning: The team intentionally uses broad CSS selectors like `.dp__input_wrap div { position: static; }` to fix styling issues with the Vue Date-Picker library. They have experience with these styles working well, keep the library version pinned in yarn.lock, and have established processes to re-test everything when updating the library version. This approach is acceptable given their testing discipline and version control.
webroot/package.json (1)
Learnt from: jsandoval81
PR: csg-org/CompactConnect#873
File: webroot/src/styles.common/_inputs.less:115-118
Timestamp: 2025-06-24T00:17:31.188Z
Learning: The team intentionally uses broad CSS selectors like `.dp__input_wrap div { position: static; }` to fix styling issues with the Vue Date-Picker library. They have experience with these styles working well, keep the library version pinned in yarn.lock, and have established processes to re-test everything when updating the library version. This approach is acceptable given their testing discipline and version control.
|
@jlkravitz This is ready for your review. FYI: This is a dependency vulnerability fix that may block other frontend PRs from being merged until this is merged. |
jlkravitz
left a comment
jlkravitz
left a comment
There was a problem hiding this comment.
@isabeleliassen good to merge
|
@carlsims Would you have time to merge this today? It's a blocker to some other PRs we'd like to merge. |
4 participants
Requirements List
webroot/node_modulesyarn install --ignore-enginesDescription List
Testing List
yarn test:unit:allshould run without errors or warningsyarn serveshould run without errors or warningsyarn buildshould run without errors or warningsCloses #934
Summary by CodeRabbit