chore(deps): pnpm 11 + Vite+/void toolchain bump and full dependency sweep#71
Merged
Conversation
Upgrade the package manager (pnpm 10.33 -> 11.16) and core toolchain (vite-plus/void/vitest), reconcile the local patch set against fixes that shipped in void 0.10.10, and sweep every remaining outdated direct dependency (including majors) to latest. Notable knock-on changes: better-auth aligned to 1.6.24 to dedupe with void; lucide-react v1 icon renames + a shared GithubIcon component (v1 dropped brand icons), also adopted in login.tsx; react-email v6 consolidation onto the top-level package; and GitHub Actions major bumps. Also send an Origin header on the MCP OAuth consent POSTs in the e2e suite: better-auth 1.6.24 now rejects consent POSTs missing an Origin (MISSING_OR_NULL_ORIGIN), which a real browser button already sends. Verified: pnpm check (0 errors), pnpm test (dashboard/workers/reporter), and the full pnpm test:e2e harness (29/29) all pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughChangesThe pull request updates workspace dependencies and pnpm configuration, refreshes dashboard icons and React Email imports, adjusts Cloudflare and Void patches, adds OAuth request origins, and upgrades GitHub Actions used by CI and release workflows. Toolchain and workspace
Dashboard UI and email integration
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Checkov (3.3.8).github/workflows/ci.ymlTraceback (most recent call last): Comment |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
wrightful | c4f666b | Jul 23 2026, 03:28 PM |
✅ Wrightful — 51 passed
View run report → · Compare to base → Commit: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)
25-25: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winDisable checkout credential persistence in CI jobs.
These jobs run repository-controlled install/test/build commands and do not push changes. Add
persist-credentials: falseto each CI checkout step; this also addresses thezizmorwarnings. Keep the release workflow separate because its Changesets step may require write credentials.Proposed change
- uses: actions/checkout@v7 + with: + persist-credentials: falseAlso applies to: 77-77, 112-112, 176-176, 200-200, 254-254, 299-299, 362-362
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml at line 25, Add persist-credentials: false to every checkout step in the CI workflow, including all referenced checkout occurrences, while leaving the separate release workflow unchanged so its Changesets step retains required write credentials.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/ci.yml:
- Line 25: Add persist-credentials: false to every checkout step in the CI
workflow, including all referenced checkout occurrences, while leaving the
separate release workflow unchanged so its Changesets step retains required
write credentials.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 3bd031b7-56f6-4837-90f3-2daa78263855
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (27)
.github/workflows/ci.yml.github/workflows/release.ymlapps/dashboard/package.jsonapps/dashboard/pages/login.tsxapps/dashboard/pages/settings/profile.tsxapps/dashboard/pages/settings/teams/[teamSlug]/general.tsxapps/dashboard/pages/t/[teamSlug]/p/[projectSlug]/insights/slowest-tests.tsxapps/dashboard/src/__tests__/render-email.test.tsxapps/dashboard/src/components/github-icon.tsxapps/dashboard/src/components/trace-viewer-dialog.tsxapps/dashboard/src/components/ui/breadcrumb.tsxapps/dashboard/src/components/ui/spinner.tsxapps/dashboard/src/components/visual-diff-dialog.tsxapps/dashboard/src/emails/components.tsxapps/dashboard/src/emails/layout.tsxapps/dashboard/src/emails/monitor-alert.tsxapps/dashboard/src/lib/render-email.tsxdocs/worklog/2026-04-17-local-setup-script.mddocs/worklog/2026-06-17-postgres-dialect-fixes.mddocs/worklog/2026-07-23-toolchain-and-void-dependency-bump.mdpackage.jsonpackages/e2e/src/e2e.test.tspackages/reporter/package.jsonpatches/@cloudflare__vite-plugin@1.46.0.patchpatches/@void__react@0.10.4.patchpatches/void@0.10.10.patchpnpm-workspace.yaml
💤 Files with no reviewable changes (1)
- patches/@void__react@0.10.4.patch
These jobs only install/test/build and never push, so the checkout token doesn't need to persist. Addresses the CodeRabbit/zizmor nitpick. release.yml is left untouched because its Changesets step needs write credentials. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upgrades the package manager (pnpm 10.33 → 11.16, with
onlyBuiltDependencies/patchedDependenciesmoved intopnpm-workspace.yaml) and the core Vite+/void/vitest toolchain, then reconciles the local patch set against fixes shipped in void 0.10.10 and sweeps every remaining outdated direct dependency — including majors — up to latest (details indocs/worklog/2026-07-23-toolchain-and-void-dependency-bump.md).Knock-on source changes required by the bumps:
better-authaligned to 1.6.24 to dedupe with void; lucide-react v1 icon renames plus a new sharedGithubIconcomponent (v1 removed brand icons), also adopted inlogin.tsx; react-email v6 consolidation onto the top-levelreact-emailpackage; andactions/*/pnpm/action-setupmajor bumps in CI.It also sends an
Originheader on the two MCP OAuth consent POSTs in the e2e suite, because better-auth 1.6.24 now rejects consent POSTs missing an Origin (MISSING_OR_NULL_ORIGIN) — the header a real browser button already sends.Verified locally:
pnpm check(0 errors),pnpm test(dashboard/workers/reporter), and the fullpnpm test:e2eharness (29/29) all pass.🤖 Generated with Claude Code
Summary by CodeRabbit