Skip to content

fix incompatible fast-xml-parser#1731

Merged
gugu merged 1 commit into
mainfrom
rollback-pnpm-audit
Apr 23, 2026
Merged

fix incompatible fast-xml-parser#1731
gugu merged 1 commit into
mainfrom
rollback-pnpm-audit

Conversation

@gugu
Copy link
Copy Markdown
Contributor

@gugu gugu commented Apr 23, 2026

Summary by CodeRabbit

  • Chores
    • Removed version constraint override for fast-xml-parser to enable more flexible dependency resolution.

Copilot AI review requested due to automatic review settings April 23, 2026 14:25
@gugu gugu enabled auto-merge (squash) April 23, 2026 14:25
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Apr 23, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0baa7733-c7b6-4085-abd7-d0598816702a

📥 Commits

Reviewing files that changed from the base of the PR and between f42cea1 and 7383dcd.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (1)
  • package.json
💤 Files with no reviewable changes (1)
  • package.json

📝 Walkthrough

Walkthrough

The pnpm.overrides constraint in package.json that forced fast-xml-parser versions below 5.7.0 to resolve to >=5.7.0 has been removed, allowing standard dependency resolution without this override.

Changes

Cohort / File(s) Summary
Dependency Configuration
package.json
Removed pnpm.overrides constraint for fast-xml-parser, eliminating forced version resolution above 5.7.0.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

A rabbit hops with glee so bright,
One line removed—a config's flight!
Fast XML flows at its own pace,
No override holds back this race! 🐰✨

🚥 Pre-merge checks | ✅ 5 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Security Check ⚠️ Warning The PR removes a pnpm override for fast-xml-parser that was added to address known security advisories, allowing potentially vulnerable versions to remain in the dependency tree. Retain the fast-xml-parser override enforcing versions >=5.7.0, or update it to a newer safe version if incompatibility exists.
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the main change: removing a pnpm override constraint on fast-xml-parser to resolve incompatibility.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch rollback-pnpm-audit

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Removes an overrides entry related to fast-xml-parser, presumably to address a compatibility issue caused by the previously forced version range.

Changes:

  • Removed the fast-xml-parser@<5.7.0 override mapping to >=5.7.0 from package.json.
Files not reviewed (1)
  • pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread package.json
Comment on lines 29 to 32
"lodash@>=4.0.0 <=4.17.23": ">=4.18.0",
"lodash@<=4.17.23": ">=4.18.0",
"@nestjs/core@<=11.1.17": ">=11.1.18",
"fast-xml-parser@<5.7.0": ">=5.7.0",
"uuid@<14.0.0": ">=14.0.0"
Copy link

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Given the PR title ('fix incompatible fast-xml-parser'), removing the override entirely may make installs drift over time (depending on transitive dependency resolution) and can allow reintroducing the previously-problematic version range. Consider pinning fast-xml-parser to a known-compatible range (either via overrides or an explicit direct dependency where it's used) and/or document in the PR description which versions are incompatible and why.

Copilot uses AI. Check for mistakes.
Comment thread package.json
Comment on lines 29 to 32
"lodash@>=4.0.0 <=4.17.23": ">=4.18.0",
"lodash@<=4.17.23": ">=4.18.0",
"@nestjs/core@<=11.1.17": ">=11.1.18",
"fast-xml-parser@<5.7.0": ">=5.7.0",
"uuid@<14.0.0": ">=14.0.0"
Copy link

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If this repository uses a lockfile (e.g., package-lock.json, pnpm-lock.yaml, or yarn.lock), this change should be accompanied by a lockfile update so CI and local installs are reproducible and the override removal actually takes effect consistently.

Copilot uses AI. Check for mistakes.
@gugu gugu disabled auto-merge April 23, 2026 14:38
@gugu gugu merged commit 253bc82 into main Apr 23, 2026
35 of 40 checks passed
@gugu gugu deleted the rollback-pnpm-audit branch April 23, 2026 14:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants