chore: pnpm update and audit fixes - #3463
Conversation
Updates all workspace dependencies within their semver ranges and adds pnpm overrides for vulnerable transitive dependencies (tar, sharp, minimatch, esbuild, svelte, sigstore, diff, @tootallnate/once). The remaining audit findings are all in astro 5.x, which only affects the docs/landing sites at build time; fixing those requires an astro 7 major upgrade, left for a follow-up. Also gitignores landing/.vercel build output. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe pull request updates dependency versions across documentation, landing, root, React, and Shepherd packages. It standardizes Node.js and pnpm versions, adds workspace build permissions and dependency overrides, ignores ChangesDependency and tooling updates
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Coverage Impact This PR will not change total coverage. 🚦 See full report on Qlty Cloud »🛟 Help
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
docs-src/package.json (1)
15-15: 🔒 Security & Privacy | 🔵 TrivialVerify the remaining Astro audit exception before release.
This manifest keeps
astroat^5.18.2. The PR reports two high-severity audit findings in the Astro 5.x and@astrojs/verceldependency path. The same Astro line is used bylanding/package.jsonLines 15-17.landing/astro.config.mjsLines 9-19 select the Vercel adapter, andlanding/src/pages/api/checkout.tscontains a checkout route. Confirm that the affected behavior is limited to the build process. Otherwise, record a time-bound exception, mitigation, owner, and Astro 7 upgrade issue before release.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs-src/package.json` at line 15, Verify the Astro audit findings associated with the "astro" dependency in the package manifest, including the Vercel adapter and checkout route configuration. Confirm whether the affected behavior is limited to the build process; if not, document a time-bound exception with mitigation and owner, and create an Astro 7 upgrade issue before release.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@docs-src/package.json`:
- Line 15: Verify the Astro audit findings associated with the "astro"
dependency in the package manifest, including the Vercel adapter and checkout
route configuration. Confirm whether the affected behavior is limited to the
build process; if not, document a time-bound exception with mitigation and
owner, and create an Astro 7 upgrade issue before release.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 61cc0287-2bda-439e-8b57-9bf3b5adc573
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (8)
docs-src/package.jsonlanding/.gitignorelanding/package.jsonpackage.jsonpackages/react/package.jsonpnpm-workspace.yamlshepherd.js/package.jsonshepherd.js/src/tour.ts
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/publish.yml (1)
33-33: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winPin the publish job to the exact Node.js version.
Line 33 uses the floating
24range, while.tool-versionspinsnodejs 24.14.1. A future Node.js 24 patch release can make publishing use a different runtime from local tooling. Setnode-versionto24.14.1to keep the runtime contract consistent.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/publish.yml at line 33, Update the publish workflow’s node-version setting from the floating 24 range to the exact 24.14.1 version, matching the repository’s pinned Node.js runtime in .tool-versions.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/publish.yml:
- Line 33: Update the publish workflow’s node-version setting from the floating
24 range to the exact 24.14.1 version, matching the repository’s pinned Node.js
runtime in .tool-versions.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 61962a60-2e07-4fb8-97f2-47da4b632b4c
📒 Files selected for processing (6)
.github/workflows/publish.yml.tool-versionsdocs-src/package.jsonlanding/package.jsonpackage.jsonshepherd.js/package.json
🚧 Files skipped from review as they are similar to previous changes (3)
- landing/package.json
- docs-src/package.json
- package.json
1 participant
What
pnpm update -r— updates all workspace dependencies within their existing semver rangespnpm.overridesinpnpm-workspace.yamlfor vulnerable transitive deps flagged bypnpm audit: tar, sharp, minimatch, esbuild, svelte, sigstore, diff, @tootallnate/onceshepherd.js/src/tour.tspicked up by the updated toolchainlanding/.vercel/build outputWhat's left
pnpm auditstill reports 9 findings (2 high), all in astro 5.x /@astrojs/vercel, used only by the docs and landing sites at build time — the published packages are unaffected. Fixing those requires the astro 7 major upgrade (pnpm audit --fixtried to force it via overrides, which breaks@astrojs/mdxand@astrojs/vercel), so that's left for a dedicated follow-up.Verification
pnpm build(all packages) ✅landinganddocs-srcastro builds ✅pnpm test:unit:ci+ react-shepherd tests ✅pnpm lint✅🤖 Generated with Claude Code
Summary by CodeRabbit
Chores
Style