chore(deps): upgrade dependencies to fix security vulnerabilities#188
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
More reviews will be available in 37 minutes and 49 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more credits in the billing tab to continue. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (5)
📝 WalkthroughWalkthroughThis PR updates dependency versions across the workspace and individual apps. Workspace-level catalogs and overrides in ChangesDependency Version Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
pnpm-workspace.yaml (1)
29-29: ⚡ Quick winConfirm intentional pinning of react-router version.
The
react-routercatalog uses7.15.0without a caret prefix, creating an exact pin rather than a semver range. Most other catalogs use caret ranges (e.g.,^16.2.6for next,^7.3.2for vite). Verify this exact pin is intentional.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pnpm-workspace.yaml` at line 29, The catalog entry "react-router: 7.15.0" is an exact pin while other catalogs use caret ranges; confirm whether this exact pin is intentional and either change it to a semver range (e.g., update "react-router: 7.15.0" to "react-router: ^7.15.0") or add a short comment/PR description explaining why the exact pin must be used so future maintainers understand the rationale.package.json (1)
93-93: ⚡ Quick winConfirm intentional exact pinning in workspaces.catalogs.
Both
hono(line 93) andreact-router(line 103) use exact version pins (4.12.21and7.15.0) without caret prefixes, unlike other catalog entries. This matchespnpm-workspace.yaml, but verify this strict pinning is intentional rather than an oversight.Also applies to: 103-103
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@package.json` at line 93, Confirm whether the exact version pins for workspaces.catalogs entries "hono" and "react-router" are intentional; if they should be flexible, update the entries in workspaces.catalogs to use caret-range notation (e.g., add a leading ^) for "hono" and "react-router", otherwise keep the exact pins but add a brief justification either as a package.json comment or in the PR description indicating why strict pinning is required so reviewers understand the intent.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/astro/package.json`:
- Around line 17-21: Update the migration/version validation to target Astro
v6.0.0 as the breaking baseline (not v6.1.10) and ensure the app meets Node
>=22.12.0 in package.json; specifically, adjust any code that checks the
installed astro version or migration gates to compare against "6.0.0" and
confirm engines.node is ">=22.12.0", and when validating deps note that
`@astrojs/node` requires astro ^6.0.0 while `@astrojs/react` has no astro peerDep so
no additional checks are needed for it.
In `@package.json`:
- Line 68: Update the catalog entries in package.json's workspaces.catalogs to
match the versions declared in pnpm-workspace.yaml: change the "`@types/node`"
entry to "^24.13.2" and the "typescript" entry to "^5.9.3" so both files declare
identical catalog versions; locate and edit the workspaces.catalogs block in
package.json (the entries for "`@types/node`" and "typescript") and update their
version strings to exactly match pnpm-workspace.yaml.
---
Nitpick comments:
In `@package.json`:
- Line 93: Confirm whether the exact version pins for workspaces.catalogs
entries "hono" and "react-router" are intentional; if they should be flexible,
update the entries in workspaces.catalogs to use caret-range notation (e.g., add
a leading ^) for "hono" and "react-router", otherwise keep the exact pins but
add a brief justification either as a package.json comment or in the PR
description indicating why strict pinning is required so reviewers understand
the intent.
In `@pnpm-workspace.yaml`:
- Line 29: The catalog entry "react-router: 7.15.0" is an exact pin while other
catalogs use caret ranges; confirm whether this exact pin is intentional and
either change it to a semver range (e.g., update "react-router: 7.15.0" to
"react-router: ^7.15.0") or add a short comment/PR description explaining why
the exact pin must be used so future maintainers understand the rationale.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 9fbd87e7-b7f2-46f9-8dfc-cefb4e79f6a6
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (7)
apps/astro/package.jsonapps/nuxt/package.jsonapps/tanstack-start/package.jsondocs/package.jsonpackage.jsonpackages/express/package.jsonpnpm-workspace.yaml
1 participant
Description
This pull request upgrades dependencies to address security vulnerabilities reported by GitHub Dependabot and the
pnpm auditcommand.The changes include direct dependency upgrades where compatible fixes are available. In cases where vulnerabilities originate from transitive dependencies, package overrides have been added to
package.jsonandpnpm-workspace.yamlto enforce secure versions across the workspace.Note
These changes are focused on security remediation and dependency maintenance. No functional changes to the application code are intended.