chore(deps): upgrade flagged dependencies to patched versions - #5
Conversation
- Go: grpc 1.83.1 (critical+high), websocket 1.5.3, excelize 2.11.0, quic-go 0.59.1, gomarkdown 759bbc3e3207 - Frontend: next 16.2.11, eslint-config-next 16.2.11, markdown-it 14.2.0, @tiptap 3.30.4, plus range-scoped pnpm overrides pinning flagged transitive packages to their patched versions - pnpm-workspace.yaml: replace the scaffold allowBuilds placeholders with real booleans (fixes ERR_PNPM_IGNORED_BUILDS on pnpm 12) and add the overrides block there (pnpm 12 reads settings from pnpm-workspace.yaml; CI pnpm 10 reads package.json)
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_c540b58c-7c0d-4d92-aac3-1890a1ff56c1) |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (3)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThis change updates Go and web dependency versions. It adds pnpm overrides for transitive packages and explicit workspace build policies. ChangesDependency maintenance
Priority: ➖ Normal Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to The dependency and workspace policy updates are mergeable with no identified blocking risk. Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates several Go and frontend dependencies in go.mod and web/package.json, and adds a pnpm overrides block to web/package.json to manage nested dependency versions. It also configures build permissions in web/pnpm-workspace.yaml. Feedback is provided regarding the redundant and unsupported overrides block added to web/pnpm-workspace.yaml, which should be removed.
| overrides: | ||
| fast-uri@>=3.0.0 <3.1.6: 3.1.6 | ||
| nanoid@>=3.0.0 <3.3.18: 3.3.18 | ||
| js-yaml@>=4.0.0 <4.3.1: 4.3.1 | ||
| brace-expansion@<1.1.18: 1.1.18 | ||
| brace-expansion@>=3.0.0 <5.0.9: 5.0.9 | ||
| postcss@<8.5.23: 8.5.23 | ||
| browserslist@<4.28.7: 4.28.7 | ||
| ws@>=8.0.0 <8.21.0: 8.21.0 | ||
| undici@>=6.0.0 <6.28.0: 6.28.0 | ||
| sharp@<0.35.0: 0.35.0 | ||
| hono@>=4.0.0 <4.12.34: 4.12.34 | ||
| '@hono/node-server@<1.19.15': 1.19.15 | ||
| path-to-regexp@>=8.0.0 <8.4.0: 8.4.0 | ||
| picomatch@>=2.0.0 <2.3.2: 2.3.2 | ||
| picomatch@>=4.0.0 <4.0.4: 4.0.4 | ||
| lodash@>=4.0.0 <4.18.0: 4.18.0 | ||
| langsmith@<0.6.0: 0.6.0 | ||
| uuid@<11.1.1: 11.1.1 | ||
| linkify-it@>=5.0.0 <5.0.2: 5.0.2 | ||
| immutable@>=5.0.0 <5.1.8: 5.1.8 | ||
| esbuild@>=0.24.0 <0.25.0: 0.25.0 | ||
| flatted@>=3.0.0 <3.4.2: 3.4.2 | ||
| qs@>=6.0.0 <6.16.0: 6.16.0 | ||
| '@humanfs/node@<0.16.8': 0.16.8 | ||
| ip-address@<10.3.1: 10.3.1 | ||
| body-parser@>=2.0.0 <2.3.0: 2.3.0 | ||
| postcss-selector-parser@>=7.0.0 <7.1.3: 7.1.3 | ||
| '@babel/core@<7.29.6': 7.29.6 |
There was a problem hiding this comment.
The overrides field is not a supported configuration option in pnpm-workspace.yaml by pnpm. All dependency overrides must be defined in the root package.json under the pnpm.overrides field (which you have already correctly configured in web/package.json). Keeping this block here is redundant, ignored by pnpm, and introduces a maintenance overhead as future changes would need to be duplicated. Please remove this block.
1 participant
chore(deps): upgrade flagged dependencies to patched versions
Summary
Upgrades every dependency flagged by Dependabot on this repository to its patched version, plus a fix for the scaffold
pnpm-workspace.yamlplaceholders that hard-fail on pnpm 12 (ERR_PNPM_IGNORED_BUILDS).This PR contains only dependency fixes against
main(db1fe7bb). Merging it clears all 162 Dependabot alerts GitHub reports on the default branch (162/162 — verified against the current alert list).Go (go.mod / go.sum)
Frontend (web/package.json / web/pnpm-lock.yaml / web/pnpm-workspace.yaml)
Direct upgrades:
Transitive packages that cannot be bumped directly are pinned to their patched versions via range-scoped pnpm overrides (
next@>=16.0.0 <16.3.18: 16.3.18style), so future minor releases stay eligible.pnpm-workspace.yaml fix
The scaffold shipped
allowBuildsstring placeholders (sharp: falseetc.) that hard-fail on pnpm 12 withERR_PNPM_IGNORED_BUILDS. Replaced with real booleans and moved the overrides block there — pnpm 12 reads settings frompnpm-workspace.yaml; CI pnpm 10 keeps readingpackage.json(both now carry the same overrides).Test plan
go build/go test— exit 0pnpm install— exit 0, lockfile passes supply-chain policiespnpm audit— No known vulnerabilities found (zero; overrides applied)pnpm typecheck/pnpm test— exit 0pnpm-workspace.yamlis the single source of truth for overrides on pnpm 12Full analysis:
.qwen/dependency-upgrade-report.mdin the repository (not part of this PR).Note
Medium Risk
Patch-only dependency churn touches networking stacks (
grpc,websocket,quic-go) and the Next.js build/runtime; no logic changes, but regressions would show up in realtime WS, Excel export, and the web app.Overview
Bumps flagged/vulnerable dependencies across the Go backend and
webdashboard without changing application code.Go (
go.mod/go.sum): Direct pins move to patched releases—gorilla/websocket1.5.3,xuri/excelize/v22.11.0,gomarkdown/markdown(newer pseudo-version), plus indirect refreshes includinggoogle.golang.org/grpc1.83.1,quic-go0.59.1, and related transitive modules (e.g.mscfb,genproto, OpenTelemetry artifacts in the lockfile).Frontend (
web/package.json): Direct upgrades—Next.js andeslint-config-next16.2.11, markdown-it 14.2.0, and all @tiptap/ packages 3.30.4. Adds apnpm.overridesblock to force patched versions of vulnerable transitive packages (e.g.ws,undici,sharp,hono,lodash) while keeping semver ranges flexible.Reviewed by Cursor Bugbot for commit b50a69c. Configure here.
Summary by CodeRabbit