chore: bump engine runner version

[MasterPtato]

No description provided.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
rivetkit-serverless	Error			Oct 2, 2025 7:11pm

[claude]

Claude finished @MasterPtato's task —— View job

---

Code Review for Engine Runner Version Bump

Reviewing the changes in this PR:

Todo List:

• Read and analyze changed files
• Check code quality and best practices
• Look for potential bugs or issues
• Evaluate performance considerations
• Check for security concerns
• Assess test coverage needs
• Provide comprehensive feedback

Changes Summary:

This PR updates the @rivetkit/engine-runner dependency from commit 03e3532 to 16cf6cc and removes a hardcoded localhost URL from the React example.

Files Changed:

1. packages/rivetkit/package.json:166 - Updated engine-runner dependency hash
2. examples/react/src/frontend/App.tsx:5 - Removed hardcoded http://localhost:8080 from createClient call

---

Review Feedback

✅ Code Quality & Best Practices

• Good: Removing the hardcoded localhost URL in the React example improves flexibility and follows best practices
• Good: Using commit-specific dependency URLs provides reproducible builds
• Minor: The package.json loses its trailing newline (line 215), which could cause formatting inconsistencies

✅ Potential Bugs or Issues

• Low Risk: The React example change from createClient<typeof registry>('http://localhost:8080') to createClient<typeof registry>() suggests the client now uses a default URL or environment-based configuration. This should be verified to ensure the example still works correctly.

✅ Performance Considerations

• Neutral: The engine-runner version bump could contain performance improvements, but without a changelog or commit details, this can't be evaluated
• Good: No performance regressions introduced by the client URL change

✅ Security Concerns

• Good: Removing hardcoded URLs reduces the risk of accidentally connecting to unintended endpoints
• Good: Using commit-specific dependency hashes provides supply chain security

⚠️ Recommendations & Questions

1. Missing Context: The PR description is empty. For dependency bumps, it would be helpful to include:

   • What changes are in the new engine-runner version (bug fixes, features, breaking changes)
   • Why this specific commit (16cf6cc) was chosen
   • Whether this addresses any specific issues

2. React Example Behavior: The removal of the hardcoded URL suggests the createClient function now has different default behavior. Consider:

   • Documenting what the default URL is (environment variable? relative path?)
   • Ensuring the example README explains how to run the example correctly

3. Testing: Consider running the React example to ensure it still works with the engine-runner update and client URL change

4. Formatting: The trailing newline removal in package.json should be retained for consistency

✅ Test Coverage

• Acceptable: For a dependency bump, the existing test suite should catch any breaking changes
• Suggestion: Run the React example manually to verify it works with both changes

---

Overall Assessment: This is a straightforward maintenance PR that appears safe to merge. The changes improve code quality by removing hardcoded values, but would benefit from better documentation about what changed and why.

[MasterPtato]

• chore: bump engine runner version #1330 👈 (View in Graphite)
• main

---

How to use the Graphite Merge Queue

Add either label to this PR to merge it via the merge queue:

• merge queue - adds this PR to the back of the merge queue
• hotfix - for urgent hot fixes, skip the queue and merge this PR next

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

This stack of pull requests is managed by Graphite. Learn more about stacking.

[claude]

Claude finished @MasterPtato's task —— View job

---

Code Review Analysis

Analyzing the PR changes and providing comprehensive review feedback.

Todo List:

• Read and analyze changed files
• Evaluate code quality and best practices
• Check for potential bugs or issues
• Assess performance considerations
• Review security concerns
• Evaluate test coverage needs
• Provide final review summary

---

Review Summary

This PR makes two specific changes:

1. Engine Runner Update: Bumps @rivetkit/engine-runner dependency from commit 03e3532 to 16cf6cc (packages/rivetkit/package.json:166)
2. Client Configuration Improvement: Removes hardcoded http://localhost:8080 from the React example client creation (examples/react/src/frontend/App.tsx:5)

Code Quality & Best Practices ✅

Positive Changes:

• Removing hardcoded URLs: The React example change from createClient<typeof registry>('http://localhost:8080') to createClient<typeof registry>() follows best practices by eliminating hardcoded configuration values
• Environment-based configuration: Based on the client config schema, the createClient() function now properly uses environment variables (RIVET_ENGINE) or defaults to 127.0.0.1:6420 for local development
• Dependency management: Using commit-specific dependency URLs provides reproducible builds

Areas for improvement:

• Missing PR description: The PR lacks context about what changed in the engine-runner update and why this specific commit was chosen
• Documentation gap: Other examples in the codebase still use hardcoded URLs - this inconsistency should be addressed project-wide

Potential Bugs & Issues ⚠️

Low Risk Concerns:

1. Example functionality: The React example now relies on default configuration (api.host: "127.0.0.1", api.port: 6420) instead of the previous localhost:8080. This could break the example if:

   • The backend server runs on port 8080 instead of 6420
   • Users expect the documented behavior to match the old hardcoded URL

2. Inconsistent examples: Other examples still use hardcoded URLs (found 20+ instances across examples), creating inconsistent behavior across the project

Recommendations:

• Verify that the React example's backend configuration matches the new default port (6420)
• Consider updating all examples consistently or documenting the expected server configuration

Performance Considerations ✅

Neutral Impact:

• The engine-runner dependency update could contain performance improvements, but without a changelog, this cannot be evaluated
• The client configuration change has no performance impact - it simply changes where the configuration is sourced from

Security Concerns ✅

Positive Security Impact:

• Eliminates hardcoded endpoints: Reduces risk of accidentally connecting to unintended servers in production
• Environment-based configuration: Allows proper configuration management in different deployment environments
• Supply chain security: Using commit-specific dependency hashes provides better supply chain security than version ranges

Test Coverage Assessment ⚠️

Current State:

• The changes are low-risk and should be covered by existing integration tests
• However, the React example specifically should be manually tested to ensure it still works correctly

Recommendations:

• Run the React example to verify it connects properly with the new default configuration
• Consider adding automated tests that verify examples work correctly
• Test the engine-runner update against the existing test suite

Additional Observations

Consistency Issues Found:
Found 20+ other examples still using hardcoded localhost URLs:

• examples/crdt/src/frontend/App.tsx:7 - uses "http://localhost:8080"
• examples/rate/src/frontend/App.tsx:5 - uses "http://localhost:8080"
• examples/hono-react/src/frontend/App.tsx:5 - uses "http://localhost:8080"
• And many others...

Repository Guidelines Compliance:

• Follows the CLAUDE.md guidelines for dependency management
• Aligns with the project's preference for environment-based configuration

Overall Assessment: ✅ Approve with Recommendations

This is a solid maintenance PR that improves configuration management and updates dependencies. The changes are low-risk and follow best practices.

Before merging:

1. Test the React example to ensure it works with default configuration
2. Consider creating a follow-up issue to update all examples consistently
3. Document the engine-runner changes for better traceability

Post-merge suggestions:

1. Update remaining examples to use environment-based configuration
2. Document the default server configuration in example READMEs
3. Consider adding automated testing for examples

---

[graphite-app]

Merge activity

• Oct 2, 9:03 PM UTC: NathanFlurry added this pull request to the Graphite merge queue.
• Oct 2, 9:03 PM UTC: CI is running for this pull request on a draft pull request (#1334) due to your merge queue CI optimization settings.
• Oct 2, 9:04 PM UTC: Merged by the Graphite merge queue via draft PR: #1334.