JS: pin transitive deps with overrides #8009
Conversation
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
WalkthroughAdjusted pnpm overrides in Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Tip 👮 Agentic pre-merge checks are now available in preview!Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs. Warning Review ran into problems🔥 ProblemsErrors were encountered while retrieving linked issues. Errors (1)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 💡 Knowledge Base configuration:
You can enable these sources in your CodeRabbit configuration. ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
✨ Finishing Touches🧪 Generate unit tests
Comment |
How to use the Graphite Merge QueueAdd either label to this PR to merge it via the merge queue:
You must have a Graphite account in order to use the merge queue. Sign up using this link. An organization admin has enabled the Graphite Merge Queue in this repository. Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue. This stack of pull requests is managed by Graphite. Learn more about stacking. |
size-limit report 📦
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
package.json (1)
49-55: Add/verify bundle budgets (size-limit) per guidelines.Top-level package.json lacks a size-limit config. Please add budgets (or confirm they live in each workspace package).
Example (adjust paths to your entry points):
{ "size-limit": [ { "path": "packages/thirdweb/dist/index.js", "limit": "100 KB" }, { "path": "packages/insight/dist/index.js", "limit": "80 KB" } ], "scripts": { "size": "size-limit" }, "devDependencies": { "size-limit": "^11.0.0", "@size-limit/preset-small-lib": "^11.0.0" } }
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
package.json(1 hunks)
🧰 Additional context used
📓 Path-based instructions (2)
package.json
📄 CodeRabbit inference engine (CLAUDE.md)
Track bundle budgets via
package.json#size-limit
Files:
package.json
**/package.json
📄 CodeRabbit inference engine (AGENTS.md)
Track bundle budgets via
package.json#size-limit
Files:
package.json
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
- GitHub Check: Size
- GitHub Check: E2E Tests (pnpm, esbuild)
- GitHub Check: Build Packages
- GitHub Check: E2E Tests (pnpm, vite)
- GitHub Check: E2E Tests (pnpm, webpack)
- GitHub Check: Lint Packages
- GitHub Check: Unit Tests
- GitHub Check: Analyze (javascript)
🔇 Additional comments (3)
package.json (3)
48-48: LGTM: trailing comma to extend overrides list is correct.The xml2js override remains the same; the added comma is valid JSON and enables the following entries.
49-55: Confirm intent to hard-pin exact versions vs caret ranges.If the goal is security pinning, exact pins are fine; otherwise consider caret pins for patch uptake (for example, is-core-module latest is 2.16.1 as of ~5 months ago vs 2.13.1 here). (npmjs.com)
49-55: Verify CJS consumption of ESM-only overrides
- Search for any
require('chalk')orrequire('strip-ansi')calls across your workspace and its dependencies; if you find CJS consumers, either scope your pnpm overrides to only ESM-ready packages or pin CJS-compatible versions (e.g., chalk@4.1.2, strip-ansi@6.x).
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8009 +/- ##
==========================================
- Coverage 56.65% 56.63% -0.02%
==========================================
Files 904 904
Lines 58677 58677
Branches 4165 4161 -4
==========================================
- Hits 33241 33232 -9
- Misses 25330 25340 +10
+ Partials 106 105 -1
🚀 New features to boost your workflow:
|
MananTank
force-pushed
the
09-09-js_pin_transitive_deps_with_overrides
branch
from
bcb9769 to
b743636
Compare
PR-Codex overview
This PR focuses on updating dependencies in the
package.jsonandpnpm-lock.yamlfiles, including the addition of theerror-expackage and various updates to thechalkandis-core-modulepackages.Detailed summary
error-exdependency with version1.3.2.chalkfrom5.4.1to5.3.0, then to5.6.2.is-core-modulefrom2.16.1to2.13.1.xml2js.@aws-sdk/client-sso-oidcand@aws-sdk/credential-provider-node.Summary by CodeRabbit