Conversation
- Raise overrides for ip-address and npm; nest postcss overrides for next/vite. - Align Next.js test fixtures (postcss/vite) and refresh lockfiles. - Extend postinstall patch to sync ip-address into npm bundled deps.
- Run npm run reinstall under each tests/* package with a package.json. - Add prereinstall:all (build) and reinstall:all npm scripts.
PP-3374 🔐 Clear npm audit across workspace; add reinstall:all for test fixtures
## [0.18.2-beta.1](v0.18.1...v0.18.2-beta.1) (2026-05-06) ### Bug Fixes * **deps:** resolve npm audit findings across workspace ([d13ffad](d13ffad))
📝 WalkthroughWalkthroughThis PR addresses npm audit findings across the workspace by bumping the version to 0.18.2-beta.1, expanding package.json overrides to pin PostCSS and patch bundled dependencies, adding new maintenance scripts, and creating a reinstall-all utility to coordinate dependency reinstallation across test packages. ChangesNpm Audit & Dependency Patching
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
scripts/reinstall-all.mjs (1)
56-59: ⚡ Quick winSpawn errors are silently swallowed; signal-killed processes are misreported as success.
Two issues on line 57:
When
spawnSyncfails to start the process (e.g.npmnot onPATH),spawned.erroris set but never printed. Becausestdio: 'inherit'was never connected to a live process, the error message is lost — the user only seesfailed (exit 1)with no diagnosis.When a process is killed by a signal (e.g. SIGKILL from OOM),
spawned.statusisnullandspawned.errorisundefined, so the expression evaluates to0— a silent false-positive success.🔧 Proposed fix
- const spawned = runNpmReinstall(cwd); - const code = spawned.status ?? (spawned.error ? 1 : 0); + const spawned = runNpmReinstall(cwd); + if (spawned.error) { + console.error(` Spawn error: ${spawned.error.message}`); + } else if (spawned.signal) { + console.error(` Process killed by signal: ${spawned.signal}`); + } + const code = spawned.status ?? ((spawned.error || spawned.signal) ? 1 : 0);🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/reinstall-all.mjs` around lines 56 - 59, The current status calculation silently swallows spawn errors and treats signal-terminated processes as success; update the logic around runNpmReinstall()'s returned spawned object to (1) if spawned.error is set, set code to non-zero (e.g. 1) and print the error (message/stack) to stderr so missing binaries or spawn failures are visible, and (2) if spawned.status is null but spawned.signal is set, treat this as failure (e.g. map to a non-zero code or 128+signal) and log which signal killed the process; then push results.push({ label, code }) with that computed code. Reference runNpmReinstall, spawned, spawned.error, spawned.status, spawned.signal, and results.push when making the change.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Around line 79-87: Replace the invalid npm override keys "next@*" and "vite@*"
with valid npm semver specifiers: update the override object keys (currently
"next@*" and "vite@*") to use a proper semver range such as "next@" for any
version or a concrete range like "next@^12.0.0" / "vite@^4.0.0" (or whichever
range you intend), so npm will recognize and apply the overrides; keep the
nested object (e.g., the "postcss": "8.5.10" entries) unchanged.
---
Nitpick comments:
In `@scripts/reinstall-all.mjs`:
- Around line 56-59: The current status calculation silently swallows spawn
errors and treats signal-terminated processes as success; update the logic
around runNpmReinstall()'s returned spawned object to (1) if spawned.error is
set, set code to non-zero (e.g. 1) and print the error (message/stack) to stderr
so missing binaries or spawn failures are visible, and (2) if spawned.status is
null but spawned.signal is set, treat this as failure (e.g. map to a non-zero
code or 128+signal) and log which signal killed the process; then push
results.push({ label, code }) with that computed code. Reference
runNpmReinstall, spawned, spawned.error, spawned.status, spawned.signal, and
results.push when making the change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 9a897253-e6d6-444e-898a-abf23232e5a3
⛔ Files ignored due to path filters (4)
package-lock.jsonis excluded by!**/package-lock.jsontests/test-commonjs/package-lock.jsonis excluded by!**/package-lock.jsontests/test-nextjs-cjs/package-lock.jsonis excluded by!**/package-lock.jsontests/test-nextjs/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (7)
CHANGELOG.mdpackage.jsonscripts/patch-npm-bundled-vulnerabilities.mjsscripts/reinstall-all.mjstests/test-commonjs/package.jsontests/test-nextjs-cjs/package.jsontests/test-nextjs/package.json
| "next@*": { | ||
| "postcss": "8.5.10" | ||
| }, | ||
| "npm": ">=11.13.0", | ||
| "serialize-javascript": ">=7.0.5", | ||
| "undici": ">=6.24.0" | ||
| "undici": ">=6.24.0", | ||
| "vite@*": { | ||
| "postcss": "8.5.10" | ||
| } |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Does npm overrides support the "pkg@version": {} object key syntax for nested overrides, and specifically the @* wildcard form?
💡 Result:
Yes, npm overrides supports the "pkg@version": {} object key syntax for nested overrides, where the key is a package specifier that can include a specific version like "bar@2.0.0": { "foo": "1.0.0" } [1][2]. This applies the nested overrides only when the package matches that version specifier [2]. No, there is no evidence or documentation for an "@" wildcard form specifically (e.g., "pkg@": {}); version matching uses semver ranges (e.g., "pkg@^1.0.0"), not shell-style wildcards like @* [1][2]. Searches for "@*" yielded no matching syntax or examples [all].
Citations:
- 1: https://docs.npmjs.com/cli/v8/configuring-npm/package-json/
- 2: https://github.com/npm/rfcs/blob/main/accepted/0036-overrides.md
The "pkg@*" syntax in overrides is not valid npm syntax.
npm overrides support the "pkg@version": {} object-key syntax, but only with semver ranges (e.g., "pkg@^1.0.0", "pkg@>=1.0.0"). The @* wildcard form is not recognized—npm does not support shell-style wildcards in override specifiers. The entries "next@*" and "vite@*" will not match intended versions and the overrides will not be applied. Use a proper semver range instead (e.g., "next@" for any version or a specific range like "next@^12" or "next@13.0.0").
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` around lines 79 - 87, Replace the invalid npm override keys
"next@*" and "vite@*" with valid npm semver specifiers: update the override
object keys (currently "next@*" and "vite@*") to use a proper semver range such
as "next@" for any version or a concrete range like "next@^12.0.0" /
"vite@^4.0.0" (or whichever range you intend), so npm will recognize and apply
the overrides; keep the nested object (e.g., the "postcss": "8.5.10" entries)
unchanged.
3 participants
🚀 Promote
developtomain(dependency hardening + tooling)Summary
Merge the current
origin/developline intoorigin/mainto ship npm audit remediation across the workspace and test fixtures, add thereinstall:allhelper for local tarball workflows, and include the associated release / changelog updates fromdevelop.Key changes
tests/*lockfiles andoverridesadjusted sonpm auditis clean (including nested PostCSS / Vite / Next trees and bundled npm patching via postinstall).scripts/patch-npm-bundled-vulnerabilities.mjsextended to sync patchedip-addressinto npm’s bundled tree.scripts/reinstall-all.mjsplusprereinstall:all/reinstall:allnpm scripts for refreshing fixture installs undertests/*.chore(release): 0.18.2-beta.1 [skip ci]and CHANGELOG delta ondevelop.Stats
(
git diff --stat origin/main...origin/develop)Included commits
(
git log origin/main..origin/develop --oneline)795b7b5— chore(release): 0.18.2-beta.1 [skip ci]f55795a— Merge pull request PP-3374 🔐 Clear npm audit across workspace; add reinstall:all for test fixtures #147 from mi-examples/pp-3374238f729— chore(scripts): add reinstall:all for test fixture packagesd13ffad— fix(deps): resolve npm audit findings across workspaceTesting / verification
npm ciat repo root succeedsnpm run audit:all— exits 0, 0 vulnerabilities (root + eachtests/*package with a lockfile)npm run buildsucceeds (matchesprereinstall:allprecondition)Summary by CodeRabbit
Bug Fixes
Chores