Update dependencies to address security vulnerabilities - #428
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughThe PR updates dependency constraints, normalizes documentation prerender routes, and adds staged diagnostics to production documentation checks. The workflow preserves exit statuses and reports server state when validation fails. ChangesDocumentation build and validation
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant DocsWorkflow
participant DocumentationServer
participant ValidationChecks
DocsWorkflow->>DocumentationServer: start production server
DocumentationServer-->>DocsWorkflow: report readiness or early exit
DocsWorkflow->>ValidationChecks: run route, title, accessibility, and log checks
ValidationChecks-->>DocsWorkflow: return validation status
DocsWorkflow->>DocumentationServer: collect logs and HTTP diagnostics on failure
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Greptile SummaryThis PR updates Python and JavaScript dependencies to address security advisories while improving production documentation prerendering and CI diagnostics.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| .github/workflows/docs.yml | Adds failure-stage tracking and best-effort diagnostic output while preserving the production server’s original exit status. |
| docs/app/xy_docs/prerender.py | Normalizes generated documentation and redirect prerender paths by removing trailing slashes while preserving the root route. |
| docs/app/tests/test_prerender.py | Updates prerender configuration expectations to cover normalized nested documentation routes. |
| package.json | Updates JavaScript build tooling and adds a PostCSS override, with resolved versions recorded in the lockfile. |
| docs/app/reflex.lock/package.json | Refreshes generated Reflex frontend dependencies and pins the remediated PostCSS version. |
| package-lock.json | Regenerates the root npm dependency graph for the updated security and tooling versions. |
| uv.lock | Refreshes the root Python dependency lockfile with remediated package versions. |
| docs/app/uv.lock | Refreshes the documentation application’s Python dependency resolution. |
Reviews (5): Last reviewed commit: "address PR feedback" | Re-trigger Greptile
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 4 files
Tip: cubic used a learning from your PR history. Let your coding agent read cubic learnings directly with the cubic MCP.
Fix all with cubic | Re-trigger cubic
Merging this PR will not alter performance
Comparing 
Footnotes
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/docs.yml:
- Around line 190-193: Update the nested documentation request in the curl
invocation to replace --fail with --fail-with-body and use --silent together
with --show-error. Preserve the existing timeout, URL, and output settings so
HTTP failure response bodies and curl error details remain available.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 2901d400-b8cd-4e2f-8054-9b1fdb57bb79
📒 Files selected for processing (1)
.github/workflows/docs.yml
There was a problem hiding this comment.
All reported issues were addressed across 1 file (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Fix all with cubic | Re-trigger cubic
React-router 7.18.x does not strip trailing slash from configured prerender routes, so we do that ourselves now to keep pre-rendering functional.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/app/xy_docs/prerender.py`:
- Around line 74-78: Update the route construction in the prerender flow to
apply trailing-slash normalization only to routes returned by discover_docs,
while appending DOCS_REDIRECTS unchanged. Preserve the root route "/" rather
than allowing rstrip("/") to produce an empty string, and retain the expected
original redirect paths and normalized documentation paths.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: e93bf453-46fb-43ad-8cf6-0fe89b943a6d
📒 Files selected for processing (1)
docs/app/xy_docs/prerender.py
There was a problem hiding this comment.
All reported issues were addressed across 1 file (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Fix all with cubic | Re-trigger cubic
The dependency bumps in #428 landed from a branch that was behind main, so these ten diagnostics never appeared on that PR and now trip every branch built on top of it. reflex_xy/component.py: spell the event-trigger annotations as `Annotated[rx.EventHandler, <args spec>]` instead of the shorthand `rx.EventHandler[<args spec>]`. The two are the same object — reflex's `EventHandler.__class_getitem__` returns exactly this Annotated form and its trigger discovery reads the spec back out of `__metadata__` — but only the shorthand is a runtime-only DSL: `EventHandler` is not a generic class, so subscripting it is invalid in a type expression. All seven triggers still resolve with the same arg-spec parameter names. xy/_validate.py: sort the rendered form of unrecognized `mark_fill` keys. `value` is user input whose keys need not be mutually comparable, so `mark_fill({1: ..., "mode": ...})` raised a bare `TypeError` out of `sorted` instead of naming the unknown key. Closed grammars are specified to raise `ValueError` (spec/api/styling.md), so this makes the implementation match. xy/pyplot/_axes.py: drop the now-redundant `cast` around `np.ma.asarray`, which the newer numpy stubs already type as `MaskedArray`. Verified against the interpreter CI resolves (3.12 / numpy 2.5.1): `ty check python tests/typing_pep561_consumer.py` is clean.
2 participants
Summary by CodeRabbit
Chores
Bug Fixes