fix(frontend): resolve dependencies vulnerabilities #1082

yassinedorbozgithub · 2025-06-02T08:32:58Z

Motivation

The primary goal is to address vulnerabilities related to UI dependencies.

Fixes #754

Summary by CodeRabbit

Chores
- Upgraded multiple dependencies for improved stability and performance across the frontend and widget packages.
- Updated the development script to enable Turbopack for faster builds.
- Adjusted TypeScript configuration to target ES2017 and set module resolution base.
- Enhanced development experience by repositioning development mode indicators.
- Removed unused development dependencies from the widget package.

coderabbitai · 2025-06-02T08:33:05Z

Walkthrough

The updates include dependency upgrades for both the frontend and widget projects, with major version bumps for next, axios, and related development tools. The frontend's Next.js configuration is adjusted for dev indicators, and TypeScript target settings are updated. The widget's dev dependencies are streamlined and upgraded.

Changes

Files/Paths	Change Summary
frontend/package.json, widget/package.json	Upgraded dependencies (next, axios, typescript, eslint, vite, etc.); removed some widget dev dependencies.
frontend/next.config.mjs	Added `devIndicators` option to set indicator position to bottom-right.
frontend/tsconfig.json	Added `"baseUrl": "."` and `"target": "ES2017"` compiler options.

Sequence Diagram(s)

sequenceDiagram
    participant Developer
    participant NextConfig
    participant DevServer

    Developer->>NextConfig: Updates devIndicators position
    Developer->>DevServer: Runs dev script (now with --turbopack)
    DevServer->>NextConfig: Loads updated config
    DevServer->>Developer: Starts with new dev indicators and Turbopack

Assessment against linked issues

Objective	Addressed	Explanation
Upgrade nextjs package, axios, and eslint (from #754)	✅

Assessment against linked issues: Out-of-scope changes

Code Change	Explanation
Addition of `devIndicators` option in Next.js config (frontend/next.config.mjs)	Not directly related to dependency vulnerability upgrades; config tweak is out of scope.
Addition of `"baseUrl": "."` and `"target": "ES2017"` in tsconfig (frontend/tsconfig.json)	TypeScript config changes are unrelated to the dependency vulnerability issue.

Suggested labels

enhancement, needs-review

Suggested reviewers

medchedli
marrouchi

Poem

A hop, a skip, new versions in tow,
Next and Axios, upgraded we go!
Eslint shines, the warnings fade,
Turbopack speeds up every trade.
With configs tidy and targets set,
This bunny’s work is the best one yet! 🐇✨

📜 Recent review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 617cfa9 and 38d8871.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (3)

frontend/package.json (3 hunks)
frontend/tsconfig.json (1 hunks)
widget/package.json (1 hunks)

🚧 Files skipped from review as they are similar to previous changes (3)

frontend/tsconfig.json
frontend/package.json
widget/package.json

⏰ Context from checks skipped due to timeout of 90000ms (3)

GitHub Check: API-Tests
GitHub Check: Frontend Tests
GitHub Check: Analyze (javascript-typescript)

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Explain this complex logic.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai explain this code block.
- @coderabbitai modularize this function.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and explain its main purpose.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
- @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai generate docstrings to generate docstrings for this PR.
@coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

coderabbitai

Actionable comments posted: 4

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 61b5765 and 617cfa9.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (4)

frontend/next.config.mjs (1 hunks)
frontend/package.json (3 hunks)
frontend/tsconfig.json (3 hunks)
widget/package.json (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms (3)

GitHub Check: Frontend Tests
GitHub Check: API-Tests
GitHub Check: Analyze (javascript-typescript)

🔇 Additional comments (6)

frontend/next.config.mjs (1)

29-31: Approve devIndicators configuration addition

The new devIndicators option correctly positions the Next.js development-mode indicator in the bottom-right corner and aligns with Next.js v15’s configuration schema. No further changes needed here.

frontend/tsconfig.json (2)

4-8: Approve multi-line lib formatting

Reformatting the lib array into multiple lines improves readability and maintainability without altering behavior.

40-42: Approve exclusion formatting

Converting the exclude setting into a multi-line array is purely stylistic and maintains the same behavior.

frontend/package.json (3)

9-9: Approve dev script update

Enabling Turbopack via --turbopack in the dev script leverages Next.js v15’s new bundler. This change is valid and enhances startup performance in development.

32-32: Approve axios version bump

Upgrading axios to ^1.8.1 addresses known vulnerabilities and introduces minor improvements.

56-62: Approve devDependencies upgrades & verify compatibility

Updating @typescript-eslint/eslint-plugin, eslint-import-resolver-typescript, and typescript aligns with your upgraded toolchain.

Please run your full lint and typecheck suite to ensure nothing is broken:

npm run lint
npm run typecheck

frontend/tsconfig.json

frontend/package.json

widget/package.json

…s-issue

frontend/package.json

fix(frontend): dependencies vulnerabilities

617cfa9

yassinedorbozgithub requested review from marrouchi and medchedli June 2, 2025 08:32

yassinedorbozgithub self-assigned this Jun 2, 2025

yassinedorbozgithub linked an issue Jun 2, 2025 that may be closed by this pull request

🤔 [ISSUE] - Frontend Packages vulnerabilities issue #754

Closed

3 tasks

yassinedorbozgithub added the security Vulnerabilities, exploits, sensitive data label Jun 2, 2025

coderabbitai bot reviewed Jun 2, 2025

View reviewed changes

frontend/tsconfig.json Outdated Show resolved Hide resolved

frontend/package.json Show resolved Hide resolved

widget/package.json Show resolved Hide resolved

widget/package.json Show resolved Hide resolved

yassinedorbozgithub changed the title ~~fix(frontend): dependencies vulnerabilities~~ fix(frontend): resolve dependencies vulnerabilities Jun 2, 2025

yassinedorbozgithub marked this pull request as draft June 2, 2025 08:43

yassinedorbozgithub added 2 commits June 12, 2025 18:38

Merge branch 'main' into 754-issue---frontend-packages-vulnerabilitie…

9d46af1

…s-issue

fix: apply feedback

38d8871

yassinedorbozgithub marked this pull request as ready for review June 12, 2025 17:39

yassinedorbozgithub added the needs-review label Jun 12, 2025

yassinedorbozgithub requested a review from MohamedAliBouhaouala June 12, 2025 17:45

Merge branch 'main' into 754-issue---frontend-packages-vulnerabilitie…

40c0af1

…s-issue

marrouchi added the urgent label Jun 25, 2025

medchedli approved these changes Jun 30, 2025

View reviewed changes

marrouchi requested changes Jul 1, 2025

View reviewed changes

frontend/package.json Show resolved Hide resolved

marrouchi approved these changes Jul 1, 2025

View reviewed changes

marrouchi merged commit fcdd746 into main Jul 1, 2025
6 checks passed

marrouchi linked an issue Jul 11, 2025 that may be closed by this pull request

🐛 [BUG] - Nextjs version is outdated #661

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(frontend): resolve dependencies vulnerabilities #1082

fix(frontend): resolve dependencies vulnerabilities #1082

Uh oh!

yassinedorbozgithub commented Jun 2, 2025 •

edited by coderabbitai bot

Loading

Uh oh!

coderabbitai bot commented Jun 2, 2025 •

edited

Loading

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (`.coderabbit.yaml`)

Documentation and Community

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

fix(frontend): resolve dependencies vulnerabilities #1082

fix(frontend): resolve dependencies vulnerabilities #1082

Uh oh!

Conversation

yassinedorbozgithub commented Jun 2, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Jun 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Assessment against linked issues

Assessment against linked issues: Out-of-scope changes

Suggested labels

Suggested reviewers

Poem

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (.coderabbit.yaml)

Documentation and Community

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

yassinedorbozgithub commented Jun 2, 2025 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Jun 2, 2025 •

edited

Loading

CodeRabbit Configuration File (`.coderabbit.yaml`)