chore(deps): raise stale transitive dependency floors - #4629
Conversation
|
WalkthroughUpdated pnpm dependency overrides in Merge Risk: 🟡 Moderate · up to The dependency overrides currently force several packages outside the compatible ranges declared by their parents, which can produce an invalid or incompatible install tree; these selectors should be scoped or corrected before merge. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 2e80d949-5939-4071-a9a2-533023fa2e30
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
package.json
📜 Review details
⏰ Context from checks skipped due to timeout. (23)
- GitHub Check: e2e / 🧪 CLI v3 tests (warp-ubuntu-latest-x64-4x - pnpm)
- GitHub Check: sdk-compat / Node.js 26.4 (warp-ubuntu-latest-x64-4x)
- GitHub Check: packages / 🧪 Unit Tests: Packages (3, 3)
- GitHub Check: typecheck / typecheck
- GitHub Check: sdk-compat / Node.js 22.23 (warp-ubuntu-latest-x64-4x)
- GitHub Check: sdk-compat / Bun Runtime
- GitHub Check: packages / 🧪 Unit Tests: Packages (1, 3)
- GitHub Check: packages / 🧪 Unit Tests: Packages (2, 3)
- GitHub Check: sdk-compat / Node.js 24.18 (warp-ubuntu-latest-x64-4x)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (9, 12)
- GitHub Check: e2e / 🧪 CLI v3 tests (warp-ubuntu-latest-x64-4x - npm)
- GitHub Check: sdk-compat / Cloudflare Workers
- GitHub Check: sdk-compat / Deno Runtime
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (2, 12)
- GitHub Check: sdk-compat / Node.js 20.20 (warp-ubuntu-latest-x64-4x)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (5, 12)
- GitHub Check: fk-cascade-guard / fk-cascade-guard
- GitHub Check: code-quality / code-quality
- GitHub Check: audit
- GitHub Check: audit
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: Analyze (actions)
- GitHub Check: Build and publish previews
🧰 Additional context used
📓 Path-based instructions (1)
**/package.json
📄 CodeRabbit inference engine (AGENTS.md)
When adding Zod, use the exact repository-wide pinned version
3.25.76, never a different version or range.
Files:
package.json
🔇 Additional comments (2)
package.json (2)
103-104: LGTM!Also applies to: 106-120, 122-137, 140-144
103-144: 🗄️ Data Integrity & IntegrationKeep the pnpm configuration in
package.json. The repository pins pnpm 10.33.2, which supports this location.> Likely an incorrect or invalid review comment.
Summary
A number of
pnpm.overridesentries had drifted behind the releases they were written against. An override fixes the resolved version outright, so in every one of these cases the tree was pinned to the floor value rather than picking up later releases in the same line. This raises each floor to a current release, and widens the selectors that were scoped to an exact upper bound so they keep matching.body-parser(underexpress@^4)1.20.3^1.20.6tar7.5.197.5.21hono4.12.254.12.34undici(6.x)6.27.06.28.0undici(7.x)7.28.07.29.0js-yaml(3.x)3.14.23.15.1js-yaml(4.x)4.1.14.3.1dompurify^3.4.1^3.4.13vite^6.4.2^6.4.3protobufjs^7.5.6^7.6.5socket.io-parser^4.2.6^4.2.7postcss^8.5.10^8.5.23fast-uri^3.1.2^3.1.5brace-expansion(1.x)1.1.131.1.18brace-expansion(2.x)2.0.32.1.4brace-expansion(5.x)5.0.65.0.9ip-address(under@jsonhero/json-infer-types)^10.2.0^10.3.1Every parent's declared range still accepts the new resolution, so nothing is forced outside its stated bounds by this change.
Two of these changed a default rather than just moving version.
js-yaml4.2.0 stopped resolving underscore-separated scalars such as1_000as numbers, which is the YAML 1.2 behaviour, and there are none in any YAML in this repo.brace-expansion2.1.x now caps expansion size by default, well above anything a real glob produces, andminimatchcalls it with no options. Neither is reachable from how we use them.undici@5.29.0andvite@4.4.9are left alone: their parents cap below the newer lines, so moving either would mean taking the parent across a major.Verified with a clean install, and
pnpm run typecheckpasses.