chore(deps): raise stale transitive dependency floors - #4629
Conversation
|
WalkthroughUpdated pnpm dependency overrides in Merge Risk: 🟡 Moderate · up to The dependency overrides currently force several packages outside the compatible ranges declared by their parents, which can produce an invalid or incompatible install tree; these selectors should be scoped or corrected before merge. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| "brace-expansion@<1.1.18": "1.1.18", | ||
| "brace-expansion@>=2 <2.1.4": "2.1.4", | ||
| "brace-expansion@>=5 <5.0.9": "5.0.9", |
There was a problem hiding this comment.
🔍 Behavioural defaults changed by js-yaml 4.2 and brace-expansion 2.1 were only partially verifiable here
I confirmed the js-yaml claim: no YAML file in the repo contains underscore-separated numeric scalars (grep for : <digits>_<digit> across all *.yml/*.yaml outside node_modules returns nothing), and the 4.x consumers are @kubernetes/client-node, cosmiconfig, autoevals and remark-mdx-frontmatter, none of which parse user-authored YAML on a hot path. The brace-expansion expansion-size cap could not be verified from the repo (no installed node_modules to inspect the new default limit or how minimatch surfaces an exceeded cap), so that part of the claim rests on the author's testing.
Was this helpful? React with 👍 or 👎 to provide feedback.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 2e80d949-5939-4071-a9a2-533023fa2e30
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
package.json
📜 Review details
⏰ Context from checks skipped due to timeout. (23)
- GitHub Check: e2e / 🧪 CLI v3 tests (warp-ubuntu-latest-x64-4x - pnpm)
- GitHub Check: sdk-compat / Node.js 26.4 (warp-ubuntu-latest-x64-4x)
- GitHub Check: packages / 🧪 Unit Tests: Packages (3, 3)
- GitHub Check: typecheck / typecheck
- GitHub Check: sdk-compat / Node.js 22.23 (warp-ubuntu-latest-x64-4x)
- GitHub Check: sdk-compat / Bun Runtime
- GitHub Check: packages / 🧪 Unit Tests: Packages (1, 3)
- GitHub Check: packages / 🧪 Unit Tests: Packages (2, 3)
- GitHub Check: sdk-compat / Node.js 24.18 (warp-ubuntu-latest-x64-4x)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (9, 12)
- GitHub Check: e2e / 🧪 CLI v3 tests (warp-ubuntu-latest-x64-4x - npm)
- GitHub Check: sdk-compat / Cloudflare Workers
- GitHub Check: sdk-compat / Deno Runtime
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (2, 12)
- GitHub Check: sdk-compat / Node.js 20.20 (warp-ubuntu-latest-x64-4x)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (5, 12)
- GitHub Check: fk-cascade-guard / fk-cascade-guard
- GitHub Check: code-quality / code-quality
- GitHub Check: audit
- GitHub Check: audit
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: Analyze (actions)
- GitHub Check: Build and publish previews
🧰 Additional context used
📓 Path-based instructions (1)
**/package.json
📄 CodeRabbit inference engine (AGENTS.md)
When adding Zod, use the exact repository-wide pinned version
3.25.76, never a different version or range.
Files:
package.json
🔇 Additional comments (2)
package.json (2)
103-104: LGTM!Also applies to: 106-120, 122-137, 140-144
103-144: 🗄️ Data Integrity & IntegrationKeep the pnpm configuration in
package.json. The repository pins pnpm 10.33.2, which supports this location.> Likely an incorrect or invalid review comment.
| "express@^4>body-parser": "^1.20.6", | ||
| "@remix-run/dev@2.17.5>tar-fs": "2.1.4", | ||
| "tar": "7.5.19", | ||
| "tar": "7.5.21", |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
fd -t f -a -g 'package.json' -g 'pnpm-lock.yaml' \
-x rg -n -C 2 \
'("?(tar|jws|vite|js-cookie|tmp)"?([@:])|/(tar|jws|vite|js-cookie|tmp)@)' {}Repository: triggerdotdev/trigger.dev
Length of output: 265
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- relevant files ---'
fd -t f -a 'package.json|pnpm-lock.yaml|pnpm-workspace.yaml|packageManager|.npmrc' | head -80
printf '%s\n' '--- root package configuration ---'
if [ -f package.json ]; then
sed -n '90,150p' package.json
rg -n -C 2 '"(packageManager|pnpm|overrides|tar|jws|vite|js-cookie|tmp)"' package.json
fi
printf '%s\n' '--- toolchain and override declarations ---'
rg -n -C 3 'packageManager|pnpm@|overrides:|(^|[ /])(?:tar|jws|vite|js-cookie|tmp)(@|:)' \
--glob 'package.json' --glob 'pnpm-workspace.yaml' --glob '.npmrc' --glob 'pnpm-lock.yaml' .Repository: triggerdotdev/trigger.dev
Length of output: 31121
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- relevant files ---'
fd -t f -a 'package.json|pnpm-lock.yaml|pnpm-workspace.yaml|packageManager|.npmrc' | head -80
printf '%s\n' '--- root package configuration ---'
if [ -f package.json ]; then
sed -n '90,150p' package.json
rg -n -C 2 '"(packageManager|pnpm|overrides|tar|jws|vite|js-cookie|tmp)"' package.json
fi
printf '%s\n' '--- toolchain and override declarations ---'
rg -n -C 3 'packageManager|pnpm@|overrides:|(^|[ /])(?:tar|jws|vite|js-cookie|tmp)(@|:)' \
--glob 'package.json' --glob 'pnpm-workspace.yaml' --glob '.npmrc' --glob 'pnpm-lock.yaml' \
.Repository: triggerdotdev/trigger.dev
Length of output: 31121
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
import json
from pathlib import Path
targets = {"tar", "jws", "vite", "js-cookie", "tmp"}
root = Path(".")
print("--- workspace dependency declarations ---")
for path in sorted(root.rglob("package.json")):
if any(part in {".git", "node_modules", "dist", "build"} for part in path.parts):
continue
try:
data = json.loads(path.read_text())
except Exception:
continue
for section in ("dependencies", "devDependencies", "optionalDependencies", "peerDependencies"):
for name, spec in data.get(section, {}).items():
if name in targets:
print(f"{path}:{section}:{name}: {spec}")
print("--- root lockfile metadata and affected importer lines ---")
lock = Path("pnpm-lock.yaml").read_text().splitlines()
for i, line in enumerate(lock):
if i < 65 or any(
f"{name}:" in line for name in sorted(targets)
):
if i < 65 or any(
line.lstrip().startswith(f"{name}:") for name in sorted(targets)
):
print(f"{i+1}:{line}")
PY
printf '%s\n' '--- affected lockfile dependency edges ---'
rg -n -C 2 \
'^[[:space:]]+(tar|jws|vite|js-cookie|tmp):|^[[:space:]]+[^[:space:]].*:$' \
pnpm-lock.yaml | rg -B 2 -A 2 \
'(^|[[:space:]])(tar|jws|vite|js-cookie|tmp):'Repository: triggerdotdev/trigger.dev
Length of output: 9058
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
import json
from pathlib import Path
targets = {"tar", "jws", "vite", "js-cookie", "tmp"}
print("--- workspace dependency declarations ---")
for path in sorted(Path(".").rglob("package.json")):
if any(part in {".git", "node_modules", "dist", "build"} for part in path.parts):
continue
try:
data = json.loads(path.read_text())
except Exception:
continue
for section in ("dependencies", "devDependencies", "optionalDependencies", "peerDependencies"):
for name, spec in data.get(section, {}).items():
if name in targets:
print(f"{path}:{section}:{name}: {spec}")
print("--- root lockfile metadata and affected importer lines ---")
lines = Path("pnpm-lock.yaml").read_text().splitlines()
for i, line in enumerate(lines):
if i < 65 or any(line.lstrip().startswith(f"{name}:") for name in targets):
print(f"{i + 1}:{line}")
PY
printf '%s\n' '--- affected lockfile dependency edges ---'
rg -n -C 2 \
'^[[:space:]]+(tar|jws|vite|js-cookie|tmp):|^[[:space:]]+[^[:space:]].*:$' \
pnpm-lock.yaml |
rg -B 2 -A 2 '(^|[[:space:]])(tar|jws|vite|js-cookie|tmp):'Repository: triggerdotdev/trigger.dev
Length of output: 9058
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
import re
from pathlib import Path
targets = {"tar", "jws", "vite", "js-cookie", "tmp"}
lines = Path("pnpm-lock.yaml").read_text().splitlines()
print("--- package snapshot parents for affected edges ---")
parent = None
for i, line in enumerate(lines, 1):
m = re.match(r"^ (\S[^:]*):$", line)
if m:
parent = m.group(1)
if re.match(r"^ (tar|jws|vite|js-cookie|tmp):", line):
print(f"{i}: {parent} -> {line.strip()}")
for context in lines[i-1:min(i+2, len(lines))]:
print(f" {context}")
print("--- importer sections containing direct affected dependencies ---")
in_importers = False
current = None
for i, line in enumerate(lines, 1):
if line == "importers:":
in_importers = True
continue
if in_importers and re.match(r"^[^ ]", line):
break
if in_importers:
m = re.match(r"^ (\S[^:]*):$", line)
if m:
current = m.group(1)
if re.match(r"^ (tar|vite|jws|js-cookie|tmp):", line):
print(f"{i}: {current} -> {line.strip()}")
for context in lines[i-1:min(i+3, len(lines))]:
print(f" {context}")
PYRepository: triggerdotdev/trigger.dev
Length of output: 7106
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
import json
import urllib.request
packages = [
("cacache", "17.1.4"),
("giget", "1.2.3"),
("`@kubernetes/client-node`", "1.0.0"),
("external-editor", "3.1.0"),
("testcontainers", "11.14.0"),
("tmp-promise", "3.0.3"),
("jsonwebtoken", "9.0.2"),
("js-beautify", "1.15.1"),
("react-use", "17.5.1"),
("`@vanilla-extract/integration`", "6.2.1"),
]
for name, version in packages:
url = f"https://registry.npmjs.org/{name.replace('/', '%2f')}/{version}"
try:
with urllib.request.urlopen(url, timeout=10) as response:
data = json.load(response)
manifest = data.get("dependencies", {})
peers = data.get("peerDependencies", {})
affected = {
key: value
for key, value in {**manifest, **peers}.items()
if key in {"tar", "jws", "vite", "js-cookie", "tmp"}
}
print(f"{name}@{version}: {json.dumps(affected, sort_keys=True)}")
except Exception as exc:
print(f"{name}@{version}: ERROR {exc}")
PYRepository: triggerdotdev/trigger.dev
Length of output: 1793
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
import json
import urllib.request
packages = [
("cacache", "17.1.4"),
("giget", "1.2.3"),
("`@kubernetes/client-node`", "1.0.0"),
("external-editor", "3.1.0"),
("testcontainers", "11.14.0"),
("tmp-promise", "3.0.3"),
("jsonwebtoken", "9.0.2"),
("js-beautify", "1.15.1"),
("react-use", "17.5.1"),
("`@vanilla-extract/integration`", "6.2.1"),
]
for name, version in packages:
url = f"https://registry.npmjs.org/{name.replace('/', '%2f')}/{version}"
try:
with urllib.request.urlopen(url, timeout=10) as response:
data = json.load(response)
deps = {**data.get("dependencies", {}), **data.get("peerDependencies", {})}
affected = {
key: value for key, value in deps.items()
if key in {"tar", "jws", "vite", "js-cookie", "tmp"}
}
print(f"{name}@{version}: {json.dumps(affected, sort_keys=True)}")
except Exception as exc:
print(f"{name}@{version}: ERROR {exc}")
PYRepository: triggerdotdev/trigger.dev
Length of output: 1793
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
import json
import subprocess
import urllib.parse
packages = [
("cacache", "17.1.4"),
("giget", "1.2.3"),
("`@kubernetes/client-node`", "1.0.0"),
("external-editor", "3.1.0"),
("testcontainers", "11.14.0"),
("tmp-promise", "3.0.3"),
("jsonwebtoken", "9.0.2"),
("js-beautify", "1.15.1"),
("react-use", "17.5.1"),
("`@vanilla-extract/integration`", "6.2.1"),
]
for name, version in packages:
url = f"https://registry.npmjs.org/{urllib.parse.quote(name, safe='`@/`')}/{version}"
try:
raw = subprocess.check_output(
["curl", "-ksSfL", "--max-time", "15", url],
text=True,
)
data = json.loads(raw)
deps = {**data.get("dependencies", {}), **data.get("peerDependencies", {})}
affected = {
key: value for key, value in deps.items()
if key in {"tar", "jws", "vite", "js-cookie", "tmp"}
}
print(f"{name}@{version}: {json.dumps(affected, sort_keys=True)}")
except Exception as exc:
print(f"{name}@{version}: ERROR {exc}")
PYRepository: triggerdotdev/trigger.dev
Length of output: 578
Scope overrides by compatible dependency range.
The unscoped tar override replaces cacache@17.1.4’s ^6.1.11 and giget@1.2.3’s ^6.2.0 with 7.5.21. The tmp override replaces external-editor@3.1.0’s ^0.0.33 with 0.2.7. The js-cookie override replaces react-use@17.5.1’s ^2.2.1 with 3.0.8. These replacements cross incompatible package lines. Split the overrides by compatible major or scope them to compatible parent packages.
Source: MCP tools
1 participant
Summary
A number of
pnpm.overridesentries had drifted behind the releases they were written against. An override fixes the resolved version outright, so in every one of these cases the tree was pinned to the floor value rather than picking up later releases in the same line. This raises each floor to a current release, and widens the selectors that were scoped to an exact upper bound so they keep matching.body-parser(underexpress@^4)1.20.3^1.20.6tar7.5.197.5.21hono4.12.254.12.34undici(6.x)6.27.06.28.0undici(7.x)7.28.07.29.0js-yaml(3.x)3.14.23.15.1js-yaml(4.x)4.1.14.3.1dompurify^3.4.1^3.4.13vite^6.4.2^6.4.3protobufjs^7.5.6^7.6.5socket.io-parser^4.2.6^4.2.7postcss^8.5.10^8.5.23fast-uri^3.1.2^3.1.5brace-expansion(1.x)1.1.131.1.18brace-expansion(2.x)2.0.32.1.4brace-expansion(5.x)5.0.65.0.9ip-address(under@jsonhero/json-infer-types)^10.2.0^10.3.1Every parent's declared range still accepts the new resolution, so nothing is forced outside its stated bounds by this change.
Two of these changed a default rather than just moving version.
js-yaml4.2.0 stopped resolving underscore-separated scalars such as1_000as numbers, which is the YAML 1.2 behaviour, and there are none in any YAML in this repo.brace-expansion2.1.x now caps expansion size by default, well above anything a real glob produces, andminimatchcalls it with no options. Neither is reachable from how we use them.undici@5.29.0andvite@4.4.9are left alone: their parents cap below the newer lines, so moving either would mean taking the parent across a major.Verified with a clean install, and
pnpm run typecheckpasses.