fix: audit

[fbosch]

Summary by CodeRabbit

• Chores
  • Updated package dependency version overrides to ensure project stability and compatibility.

[coderabbitai]

Warning

Rate limit exceeded

@fbosch has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 19 minutes and 37 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 717578d6-add0-458a-a9ed-45728eaf43e2

📥 Commits

Reviewing files that changed from the base of the PR and between 77d0726 and d5feb27.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• package.json

📝 Walkthrough

Walkthrough

Three dependency version override rules are added to pnpm-workspace.yaml to enforce minimum versions for minimatch, rollup, and svgo packages across the workspace, preventing use of versions below specified thresholds.

Changes

Cohort / File(s)	Summary
Dependency Version Overrides pnpm-workspace.yaml	Added three new override rules to enforce minimum versions: minimatch@>=10.2.3, rollup@>=4.59.0, and svgo@>=4.0.1, restricting previously allowed lower version ranges.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~7 minutes

Poem

🐰 Three overrides hopping in with care,
Minimatch, rollup, svgo—a trio fair!
No more old versions causing strife,
Just minimum bounds for workspace life! ✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title 'fix: audit' is vague and does not clearly convey what the specific changes are, using generic terminology that lacks meaningful detail about the changeset.	Replace with a more descriptive title that specifies what audit issues were fixed, such as 'fix: upgrade minimatch, rollup, and svgo dependencies to address audit vulnerabilities'.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/audit

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR adds pnpm dependency version overrides to address known security vulnerabilities found during an audit for minimatch, rollup, and svgo.

Changes:

• Adds new version overrides for minimatch, rollup, and svgo to force resolution to patched versions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[pkg-pr-new]

Open in StackBlitz

npx https://pkg.pr.new/docs-cache@31

commit: d5feb27

[coderabbitai]

🧹 Nitpick comments (1)

pnpm-workspace.yaml (1)

3-5: Bound override targets and avoid overlap-dependent resolution.

Line 3 overlaps with Line 2 for minimatch (both match versions in range [10.0.0, 10.2.1)), and all three new targets use open-ended >= selectors. While pnpm resolves overlapping overrides deterministically, the overlap makes behavior less transparent and dependent on pnpm's tiebreaker logic. Additionally, open-ended targets can unintentionally allow future major version upgrades. Prefer non-overlapping selectors and bounded targets (for example ^x.y.z) for better maintainability and predictability.

Proposed cleanup

 overrides:
-  minimatch@<10.2.1: '>=10.2.1'
-  minimatch@>=10.0.0 <10.2.3: '>=10.2.3'
-  rollup@>=4.0.0 <4.59.0: '>=4.59.0'
-  svgo@=4.0.0: '>=4.0.1'
+  minimatch@<10.2.3: '^10.2.3'
+  rollup@>=4.0.0 <4.59.0: '^4.59.0'
+  svgo@=4.0.0: '^4.0.1'

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pnpm-workspace.yaml` around lines 3 - 5, The override entries in
pnpm-workspace.yaml (symbols: minimatch, rollup, svgo) use open-ended ">=…"
selectors and create an overlap between the two minimatch entries; change them
to non-overlapping, bounded selectors (e.g., use exact/pinned or caret ranges
like ^x.y.z or explicit upper bounds) so each override targets a single, clear
semver range and doesn’t rely on pnpm tiebreaking; update or remove the
duplicate minimatch entry so the two minimatch lines no longer intersect and
ensure rollup and svgo overrides are similarly bounded to avoid unintentionally
accepting future major versions.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@pnpm-workspace.yaml`:
- Around line 3-5: The override entries in pnpm-workspace.yaml (symbols:
minimatch, rollup, svgo) use open-ended ">=…" selectors and create an overlap
between the two minimatch entries; change them to non-overlapping, bounded
selectors (e.g., use exact/pinned or caret ranges like ^x.y.z or explicit upper
bounds) so each override targets a single, clear semver range and doesn’t rely
on pnpm tiebreaking; update or remove the duplicate minimatch entry so the two
minimatch lines no longer intersect and ensure rollup and svgo overrides are
similarly bounded to avoid unintentionally accepting future major versions.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 94a6ea3b-48f0-4578-b17a-1fc64bb96867

📥 Commits

Reviewing files that changed from the base of the PR and between c3f6bc6 and 77d0726.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• pnpm-workspace.yaml