chore(deps): minimatch and rollup package vulnerabilities#8675
chore(deps): minimatch and rollup package vulnerabilities#8675sriramveeraghanta merged 6 commits intopreviewfrom
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughRemoved Sentry instrumentation and related packages across multiple apps, bumped Turbo and Storybook versions, added node/ packageManager fields and expanded pnpm.overrides in the root manifest, and updated TURBO_VERSION ARGs and turbo.json schema reference. Changes
Sequence Diagram(s)mermaid Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Updates dependency resolutions to address reported vulnerabilities (notably around minimatch and rollup) by adding/pinning pnpm.overrides, refreshing the lockfile, and bumping Storybook patch versions in workspace packages.
Changes:
- Add multiple
pnpm.overridespins (Ajv, markdown-it, minimatch, rollup, serialize-javascript) and update the repopackageManagerpnpm version. - Bump
storybookfrom9.1.17→9.1.19inpackages/uiandpackages/propel. - Regenerate
pnpm-lock.yamlto reflect the new overrides and updated transitive dependency graph.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| pnpm-lock.yaml | Lockfile refresh reflecting new override pins (minimatch/rollup and additional transitive updates). |
| packages/ui/package.json | Bumps Storybook patch version. |
| packages/propel/package.json | Bumps Storybook patch version. |
| package.json | Adds new pnpm.overrides pins and updates the pinned pnpm packageManager version. |
package.json
Outdated
| "lodash": "4.17.23" | ||
| "lodash": "4.17.23", | ||
| "ajv@6": "6.14.0", | ||
| "ajv@7": "8.18.0", |
There was a problem hiding this comment.
The pnpm override "ajv@7": "8.18.0" maps an Ajv v7 selector to an Ajv v8 version. If any dependency (now or later) actually requires Ajv 7.x, this override can cause peer-dependency conflicts or runtime incompatibilities. Consider removing this override (since the lockfile currently only includes Ajv 6 and 8), or pinning ajv@7 to an actual 7.x release if needed.
| "ajv@7": "8.18.0", | |
| "ajv@7": "7.2.4", |
package.json
Outdated
| "ajv@6": "6.14.0", | ||
| "ajv@7": "8.18.0", | ||
| "ajv@8": "8.18.0", | ||
| "markdown-it": "14.1.1", | ||
| "minimatch@3": "3.1.4", | ||
| "minimatch@9": "9.0.7", | ||
| "minimatch@10": "10.2.3", | ||
| "rollup": "4.59.0", | ||
| "serialize-javascript": "7.0.3" |
There was a problem hiding this comment.
PR title/description mentions minimatch/rollup vulnerabilities, but this change set also introduces additional overrides (Ajv, markdown-it, serialize-javascript) and bumps Storybook + the pnpm version. Either narrow the PR scope (drop unrelated upgrades) or update the PR title/description to reflect the full set of dependency/security changes so reviewers know what’s being risk-assessed.
| "diff": "5.2.2", | ||
| "webpack": "5.104.1", | ||
| "lodash-es": "catalog:", | ||
| "@isaacs/brace-expansion": "5.0.1", |
There was a problem hiding this comment.
@isaacs/brace-expansion is still listed in pnpm overrides, but it no longer appears anywhere in the lockfile dependency graph. Keeping unused overrides makes it harder to understand which pins are actually required for security/compatibility; consider removing this override if nothing depends on it anymore.
| "@isaacs/brace-expansion": "5.0.1", |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
packages/ui/package.json (1)
62-71:⚠️ Potential issue | 🟠 MajorAlign Storybook to catalog-managed version and fix major version mismatch.
Line 81 pins
storybookto9.1.19directly; per coding guidelines, external dependencies should usecatalog:. More critically,storybook@9.1.19is incompatible with the@storybook/*@8.1.1packages (lines 62-71)—a major version gap that will cause breakage. Additionally,storybookis missing from the catalog inpnpm-workspace.yaml.Resolve by: (1) adding
storybookto the catalog inpnpm-workspace.yamlaligned with@storybook/*major version, and (2) updating line 81 to usecatalog:instead of the direct pin.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/ui/package.json` around lines 62 - 71, The Storybook dependency is incorrectly pinned to storybook@9.1.19 and not sourced from the catalog, creating a major version mismatch with existing `@storybook/`*@8.1.1 entries; change the package.json entry for "storybook" to use catalog: and match the major version 8 (so it resolves alongside `@storybook/`*@8.1.1), and add a corresponding "storybook" entry to the catalog section of pnpm-workspace.yaml so the catalog reference resolves correctly.packages/propel/package.json (1)
88-89:⚠️ Potential issue | 🟠 MajorAdd all Storybook packages to catalog and align major versions.
Per the coding guidelines, use
catalog:for external dependencies. Additionally,@storybook/addon-designs(10.0.2) is at a major version ahead of the other Storybook packages (9.1.10–9.1.19). While peer dependencies are satisfied, consider aligning to the same major version for consistency. Add all Storybook packages topnpm-workspace.yamlcatalog:catalog: + "@storybook/addon-designs": "9.0.1" + "@storybook/addon-docs": "9.1.10" + "@storybook/react-vite": "9.1.10" + "storybook": "9.1.19"Then update packages/propel/package.json to use
catalog::- "@storybook/addon-designs": "10.0.2", - "@storybook/addon-docs": "9.1.10", - "@storybook/react-vite": "9.1.10", - "storybook": "9.1.19", + "@storybook/addon-designs": "catalog:", + "@storybook/addon-docs": "catalog:", + "@storybook/react-vite": "catalog:", + "storybook": "catalog:",🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/propel/package.json` around lines 88 - 89, Update the Storybook dependency management: add every Storybook package (e.g., "@storybook/addon-docs", "@storybook/react-vite", "@storybook/addon-designs", etc.) to the pnpm-workspace.yaml "catalog" section so they can be referenced via catalog:, then change the Storybook entries in packages/propel/package.json to use catalog: references instead of exact versions; also align major versions across Storybook packages by either downgrading "@storybook/addon-designs" to the 9.x line or upgrading the 9.x packages to 10.x so all Storybook packages share the same major version.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@package.json`:
- Around line 79-81: The package.json override "ajv@7" currently pins to
"8.18.0" which performs a major-version jump; confirm whether this is
intentional and either (a) revert the "ajv@7" override to a compatible v7
version (e.g., a 7.x semver) if dependents require AJV v7 API, or (b) keep the
override but update project docs/tests and run integration tests to ensure all
packages depending on "ajv@7" tolerate AJV v8; locate the "ajv@7" override entry
in package.json to make the change and update related dependency constraints or
add a comment explaining the deliberate break.
---
Outside diff comments:
In `@packages/propel/package.json`:
- Around line 88-89: Update the Storybook dependency management: add every
Storybook package (e.g., "@storybook/addon-docs", "@storybook/react-vite",
"@storybook/addon-designs", etc.) to the pnpm-workspace.yaml "catalog" section
so they can be referenced via catalog:, then change the Storybook entries in
packages/propel/package.json to use catalog: references instead of exact
versions; also align major versions across Storybook packages by either
downgrading "@storybook/addon-designs" to the 9.x line or upgrading the 9.x
packages to 10.x so all Storybook packages share the same major version.
In `@packages/ui/package.json`:
- Around line 62-71: The Storybook dependency is incorrectly pinned to
storybook@9.1.19 and not sourced from the catalog, creating a major version
mismatch with existing `@storybook/`*@8.1.1 entries; change the package.json entry
for "storybook" to use catalog: and match the major version 8 (so it resolves
alongside `@storybook/`*@8.1.1), and add a corresponding "storybook" entry to the
catalog section of pnpm-workspace.yaml so the catalog reference resolves
correctly.
ℹ️ Review info
Configuration used: defaults
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (3)
package.jsonpackages/propel/package.jsonpackages/ui/package.json
sriramveeraghanta
force-pushed
the
fix-vulnerabilities-minimatch
branch
from
20802fd to
70a4a1a
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (2)
apps/space/Dockerfile.space (1)
16-16: UseARG TURBO_VERSIONhere as well for consistency.At Line 16, this is the same hardcoded Turbo pinning pattern that can drift over time; align with an ARG-based version pin.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@apps/space/Dockerfile.space` at line 16, Replace the hardcoded turbo version in the RUN pnpm add -g turbo@2.8.12 line with the ARG-based variable: introduce or use the existing ARG TURBO_VERSION and change the command to reference turbo@$TURBO_VERSION (and ensure ARG TURBO_VERSION has a sensible default if not already declared) so the Dockerfile uses the same pinning mechanism as other images.apps/admin/Dockerfile.admin (1)
16-16: Parameterize Turbo version to align with existing Dockerfile patterns.At Line 16, use
ARG TURBO_VERSIONinstead of hardcoding the version. This pattern is already established inapps/web/Dockerfile.webandapps/live/Dockerfile.live, making version bumps centralized and reducing drift.Proposed diff
FROM base AS builder +ARG TURBO_VERSION=2.8.12 -RUN pnpm add -g turbo@2.8.12 +RUN pnpm add -g turbo@${TURBO_VERSION}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@apps/admin/Dockerfile.admin` at line 16, Replace the hardcoded Turbo install in the Dockerfile.admin with a build argument: add an ARG named TURBO_VERSION near the top if not present, then change the RUN that executes pnpm add -g turbo@2.8.12 to use turbo@${TURBO_VERSION}; ensure the ARG name matches the pattern used in apps/web/Dockerfile.web and apps/live/Dockerfile.live so version bumps are centralized and consistent.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@apps/admin/Dockerfile.admin`:
- Line 16: Replace the hardcoded Turbo install in the Dockerfile.admin with a
build argument: add an ARG named TURBO_VERSION near the top if not present, then
change the RUN that executes pnpm add -g turbo@2.8.12 to use
turbo@${TURBO_VERSION}; ensure the ARG name matches the pattern used in
apps/web/Dockerfile.web and apps/live/Dockerfile.live so version bumps are
centralized and consistent.
In `@apps/space/Dockerfile.space`:
- Line 16: Replace the hardcoded turbo version in the RUN pnpm add -g
turbo@2.8.12 line with the ARG-based variable: introduce or use the existing ARG
TURBO_VERSION and change the command to reference turbo@$TURBO_VERSION (and
ensure ARG TURBO_VERSION has a sensible default if not already declared) so the
Dockerfile uses the same pinning mechanism as other images.
ℹ️ Review info
Configuration used: defaults
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (6)
apps/admin/Dockerfile.adminapps/live/Dockerfile.liveapps/space/Dockerfile.spaceapps/web/Dockerfile.webpackage.jsonturbo.json
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@apps/space/package.json`:
- Line 13: The lint script's threshold was increased in the "check:lint" npm
script (the "check:lint" entry in package.json) which weakens the lint gate;
revert the "--max-warnings=676" change back to the original "--max-warnings=675"
in the "check:lint" script and then locate and fix the newly introduced lint
warning(s) reported by oxlint (run the restored script locally to see the
failing rule and amend the code to satisfy the linter instead of raising the
threshold).
ℹ️ Review info
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
apps/admin/app/entry.client.tsxapps/admin/package.jsonapps/space/package.json
💤 Files with no reviewable changes (1)
- apps/admin/app/entry.client.tsx
🚧 Files skipped from review as they are similar to previous changes (1)
- apps/admin/package.json
| "start": "PORT=3002 react-router-serve ./build/server/index.js", | ||
| "clean": "rm -rf .turbo && rm -rf .next && rm -rf .react-router && rm -rf node_modules && rm -rf dist && rm -rf build", | ||
| "check:lint": "oxlint --max-warnings=675 .", | ||
| "check:lint": "oxlint --max-warnings=676 .", |
There was a problem hiding this comment.
Avoid raising lint-warning budget to absorb new warnings
Bumping --max-warnings from 675 to 676 weakens the lint gate and can hide a regression. Please keep the previous threshold and fix the newly introduced warning instead.
Suggested change
- "check:lint": "oxlint --max-warnings=676 .",
+ "check:lint": "oxlint --max-warnings=675 .",📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "check:lint": "oxlint --max-warnings=676 .", | |
| "check:lint": "oxlint --max-warnings=675 .", |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@apps/space/package.json` at line 13, The lint script's threshold was
increased in the "check:lint" npm script (the "check:lint" entry in
package.json) which weakens the lint gate; revert the "--max-warnings=676"
change back to the original "--max-warnings=675" in the "check:lint" script and
then locate and fix the newly introduced lint warning(s) reported by oxlint (run
the restored script locally to see the failing rule and amend the code to
satisfy the linter instead of raising the threshold).
Type of Change
Summary by CodeRabbit