chore: update dependencies and configurations - #315
Conversation
- Updated `eslint` to version 10.2.1 and related linting packages. - Upgraded testing libraries `vitest` and `@vitest/coverage-v8` to 4.1.4. - Bumped monorepo tools including `@changesets/cli`, `tsdown`, `turbo`, and `typescript`. - Updated `astro` to version 6.1.8 and related packages in the `www` catalog. - Adjusted TypeScript configurations to target `ES2024` and modified paths for `lesetid` and `remark-lesetid`. - Refined `astro.config.ts` by removing unnecessary `platformProxy` settings.
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 53 minutes and 44 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (6)
WalkthroughUpdates monorepo tooling, TypeScript configs, and CI/release workflows; centralizes path aliases; adjusts package build/typecheck scripts; replaces runtime icon dependency with Vite icon plugin; enables prerendering for several Astro pages; and adds a changeset and release script. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
lesetid | 29d527d | Apr 25 2026, 08:30 AM |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (4)
tooling/tsconfig/base.build.json (1)
26-26:jsx: "react-jsx"is unused by the packages that consume this build config.Both
packages/lesetidandpackages/remark-lesetid(the only consumers oftsconfig.build.json) have no JSX/TSX sources and no React in their dependency graph. Settingreact-jsxhere pulls a runtime expectation (react/jsx-runtime) that does not exist in those packages. This is harmless today (no.tsxfiles compile through this), but it’s a foot-gun the moment someone adds a.tsxfile undersrc/. Consider leaving it aspreserve(or omitting it) in this base, and overriding only where React is actually present.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@tooling/tsconfig/base.build.json` at line 26, The "jsx" compiler option in the shared tsconfig ("jsx": "react-jsx") is unnecessary for non-React packages and creates an implicit runtime dependency; change the base build config to either remove the "jsx" key or set it to "preserve" instead, and only set "react-jsx" in package-specific tsconfig overrides where React/TSX is actually used (search for the "jsx" property in tooling/tsconfig/base.build.json and adjust it, and add explicit overrides in any React packages' tsconfig if needed).package.json (1)
39-39:release: "changeset"only opens the interactive “add a changeset” prompt — it does not release.The bare
changesetcommand is an alias forchangeset add(creates a new changeset entry). Naming that scriptreleaseis misleading: anyone runningpnpm releaseexpecting a publish/version bump will instead get the interactive “what kind of change is this?” wizard. The conventional mapping in the changesets ecosystem is:"changeset": "changeset", "version": "changeset version", "release": "changeset publish"If publishing is delegated to
changesets/actionin CI, drop thereleasescript (or repurpose the slot forchangeset publish); otherwise rename it to e.g.changesetto match its actual behavior.♻️ Suggested fix
- "release": "changeset", + "release": "changeset publish",🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@package.json` at line 39, The "release" npm script currently runs the alias "changeset" which only opens the interactive changeset add prompt; rename or repurpose it so script names reflect actual behavior: add a "changeset" script that runs "changeset", add a "version" script that runs "changeset version", and either change "release" to run "changeset publish" if you want a local publish step or remove "release" entirely if publishing is handled in CI by changesets/action; update the package.json "scripts" entries (look for the existing "release" key and the "changeset" command) accordingly.packages/remark-lesetid/package.json (1)
49-52:typecheckagainsttsconfig.build.jsonno longer covers test files.
tsconfig.build.json(perpackages/lesetid/tsconfig.build.jsonand the parallel one here) excludestestand limitsincludetosrc/**/*.ts. After this change,pnpm typecheckwill skip type errors in your tests entirely — the only safety net for them isvitest/tscinvoked elsewhere. Consider running both (e.g., a separate roottsconfig.jsonthat includes tests) so test typings still gate CI.♻️ One option
- "typecheck": "tsc --noEmit -p tsconfig.build.json", + "typecheck": "tsc --noEmit -p tsconfig.build.json && tsc --noEmit",Also note
devstill uses baretsdown --watch(different config thanbuild), so the watch session may emit/typecheck a different file set than the released build.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/remark-lesetid/package.json` around lines 49 - 52, The package's "typecheck" script points at tsconfig.build.json which excludes tests, so test files aren't type-checked; update the "typecheck" script in package.json to run tsc --noEmit -p tsconfig.json (or run both configs, e.g., "typecheck": "tsc --noEmit -p tsconfig.build.json && tsc --noEmit -p tsconfig.json") so tests are included in CI/typechecks, and make the "dev" script consistent with the build config by changing "dev" from "tsdown --watch" to "tsdown --watch --tsconfig=tsconfig.build.json" (or the desired config name) to ensure the watched set matches the build.tooling/tsconfig/base.json (1)
6-20: Optional: collapse subpath aliases with a glob.The five entries can be expressed more compactly with wildcards, reducing duplication when new subpath exports are added:
♻️ Proposed refactor
"paths": { - "lesetid": [ - "../../packages/lesetid/src/index.ts" - ], - "lesetid/stream": [ - "../../packages/lesetid/src/stream.ts" - ], - "lesetid/utils": [ - "../../packages/lesetid/src/utils.ts" - ], - "remark-lesetid": [ - "../../packages/remark-lesetid/src/index.ts" - ], - "remark-lesetid/astro": [ - "../../packages/remark-lesetid/src/astro.ts" - ] + "lesetid": ["../../packages/lesetid/src/index.ts"], + "lesetid/*": ["../../packages/lesetid/src/*.ts"], + "remark-lesetid": ["../../packages/remark-lesetid/src/index.ts"], + "remark-lesetid/*": ["../../packages/remark-lesetid/src/*.ts"] }Skip if the explicit list is preferred for visibility into which subpaths are intentionally exported.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@tooling/tsconfig/base.json` around lines 6 - 20, Replace the explicit multiple path entries for the lesetid and remark-lesetid packages with collapsed glob subpath aliases to reduce duplication: consolidate "lesetid", "lesetid/stream", "lesetid/utils" into a single pattern like "lesetid/*" mapping to the package src glob (referencing the existing keys "lesetid" and the subpath entries), and do the same for "remark-lesetid" and "remark-lesetid/astro" (referencing those keys) so new subpath exports are picked up automatically; update the tsconfig paths accordingly while keeping at least the root alias (e.g., "lesetid") if you want to preserve direct imports.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.changeset/green-tigers-judge.md:
- Around line 1-6: The changeset incorrectly marks both packages
("remark-lesetid" and "lesetid") as minor bumps for a chore-only dependency
update; change the bump level to patch (or remove the changeset entirely if no
artifacts are being shipped) by editing the .changeset/green-tigers-judge.md
metadata from "minor" to "patch" for each package name so the published version
reflects only a patch-level change.
In `@pnpm-workspace.yaml`:
- Around line 16-33: The monorepo lists typescript: 6.0.3 which is incompatible
with `@astrojs/check`@0.9.8 (which declares typescript: ^5.0.0); either upgrade
`@astrojs/check` to a release that supports TypeScript ^6 (replace the dependency
version for "@astrojs/check" accordingly) or pin the monorepo typescript entry
back to a ^5.x range (update the monorepo "typescript" entry) so the peer
dependency constraint is satisfied—make the change to the package/version entry
that references "@astrojs/check" or the monorepo "typescript" entry so the
resolver no longer reports the conflict.
In `@www/tsconfig.json`:
- Around line 2-4: The www tsconfig currently only extends
"astro/tsconfigs/strict" so it doesn't inherit the path aliases defined in
tooling/tsconfig/base.json; update the "extends" array in www/tsconfig.json to
also include the tooling base (e.g., add "tooling/tsconfig/base.json" alongside
"astro/tsconfigs/strict") so the path aliases for lesetid / remark-lesetid
(lesetid, lesetid/stream, lesetid/utils, remark-lesetid, remark-lesetid/astro)
are available to the www project and source navigation/typechecking resolves to
src instead of built artifacts.
---
Nitpick comments:
In `@package.json`:
- Line 39: The "release" npm script currently runs the alias "changeset" which
only opens the interactive changeset add prompt; rename or repurpose it so
script names reflect actual behavior: add a "changeset" script that runs
"changeset", add a "version" script that runs "changeset version", and either
change "release" to run "changeset publish" if you want a local publish step or
remove "release" entirely if publishing is handled in CI by changesets/action;
update the package.json "scripts" entries (look for the existing "release" key
and the "changeset" command) accordingly.
In `@packages/remark-lesetid/package.json`:
- Around line 49-52: The package's "typecheck" script points at
tsconfig.build.json which excludes tests, so test files aren't type-checked;
update the "typecheck" script in package.json to run tsc --noEmit -p
tsconfig.json (or run both configs, e.g., "typecheck": "tsc --noEmit -p
tsconfig.build.json && tsc --noEmit -p tsconfig.json") so tests are included in
CI/typechecks, and make the "dev" script consistent with the build config by
changing "dev" from "tsdown --watch" to "tsdown --watch
--tsconfig=tsconfig.build.json" (or the desired config name) to ensure the
watched set matches the build.
In `@tooling/tsconfig/base.build.json`:
- Line 26: The "jsx" compiler option in the shared tsconfig ("jsx": "react-jsx")
is unnecessary for non-React packages and creates an implicit runtime
dependency; change the base build config to either remove the "jsx" key or set
it to "preserve" instead, and only set "react-jsx" in package-specific tsconfig
overrides where React/TSX is actually used (search for the "jsx" property in
tooling/tsconfig/base.build.json and adjust it, and add explicit overrides in
any React packages' tsconfig if needed).
In `@tooling/tsconfig/base.json`:
- Around line 6-20: Replace the explicit multiple path entries for the lesetid
and remark-lesetid packages with collapsed glob subpath aliases to reduce
duplication: consolidate "lesetid", "lesetid/stream", "lesetid/utils" into a
single pattern like "lesetid/*" mapping to the package src glob (referencing the
existing keys "lesetid" and the subpath entries), and do the same for
"remark-lesetid" and "remark-lesetid/astro" (referencing those keys) so new
subpath exports are picked up automatically; update the tsconfig paths
accordingly while keeping at least the root alias (e.g., "lesetid") if you want
to preserve direct imports.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 5a068885-7d5a-4dc9-b2b6-606c2120641b
⛔ Files ignored due to path filters (3)
packages/lesetid/.cache/tsbuildinfo.jsonis excluded by!**/.cache/**packages/remark-lesetid/.cache/tsbuildinfo.jsonis excluded by!**/.cache/**pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (10)
.changeset/green-tigers-judge.md.gitignorepackage.jsonpackages/lesetid/package.jsonpackages/remark-lesetid/package.jsonpnpm-workspace.yamltooling/tsconfig/base.build.jsontooling/tsconfig/base.jsonwww/astro.config.tswww/tsconfig.json
- Added `unplugin-icons` to the project for icon management. - Removed `astro-icon` and updated components to use new icon imports. - Updated `vite` configuration to include `unplugin-icons`. - Enhanced example and toolbar components to utilize new icons. - Adjusted schemas and added prerendering to several pages for improved performance.
Co-authored-by: Copilot <copilot@github.com>
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/release.yaml (1)
23-47:⚠️ Potential issue | 🔴 CriticalFix pinned SHAs: two actions reference commit hashes that do not correspond to their claimed version tags.
The SHA pins are a supply-chain risk:
pnpm/action-setupclaimed v5.0.0 but pinned SHAfc06bc1257f339d1d5d8b3a19a8cae5388b55320does not resolve to tag v5.0.0 (which points tob307475762933b98ed359c036b0e51f26b63b74b).changesets/actionclaimed v1.7.0 but pinned SHA6a0a831ff30acef54f2c6aa1cbbc1096b066edafdoes not resolve to tag v1.7.0 (which points toe87c8ed249971350e47fab7515075f44eb134e5b).Additionally,
pnpm/action-setupv5.0.0 contains a breaking change: the action now requires Node.js 24 instead of Node.js 20. This has caused reported issues (#210: "Update to node 24 - breaking pipelines with old GitHub runners") and may fail on GitHub runners without Node.js 24 support. Verify your runner images support Node.js 24 before merging, or downgrade to v4.The
packageManagerfield inpackage.jsonis correctly set topnpm@10.33.0, so v5's version resolution will work.changesets/actionv1.7.0 has no breaking changes.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/release.yaml around lines 23 - 47, The workflow pins for the GitHub Actions are inconsistent and one is a breaking upgrade: replace the mismatched SHAs or use the canonical tag refs for the two actions (pnpm/action-setup and changesets/action) so the pinned commit matches the claimed tag (e.g., change uses: pnpm/action-setup@fc06... to either pnpm/action-setup@b307475762933b98ed359c036b0e51f26b63b74b or simply pnpm/action-setup@v5.0.0, and change uses: changesets/action@6a0a83... to the commit for v1.7.0 or changesets/action@v1.7.0); because pnpm/action-setup v5 requires Node 24, either downgrade to v4 (pnpm/action-setup@v4) or ensure your runner images support Node 24 (or pin node-version accordingly) before merging.
🧹 Nitpick comments (2)
.github/workflows/ci-security.yaml (1)
5-15: Confirm thepathsfilter scope is intentional.The
pull_requestandpushtriggers are both gated bypaths: [".github/workflows/**"], so this security analysis only runs when workflow files themselves change. That matches the intent of azizmor-based GitHub Actions linter, but worth confirming you don't also want a scheduled run (e.g.,schedule:cron) to catch regressions in pinned third-party actions over time.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/ci-security.yaml around lines 5 - 15, The CI workflow currently restricts triggers to pull_request and push events only when ".github/workflows/**" changes (see the pull_request, push and paths entries); confirm this scope is intentional and either keep it or broaden triggers—if you want periodic security checks add a schedule: cron entry to run the job on a cadence (e.g., daily/weekly) and/or remove/expand the paths filter so the analysis runs on all pushes/PRs, then update the workflow's pull_request/push/paths or add schedule accordingly.pnpm-workspace.yaml (1)
59-60: Remove staleastro-iconcatalog entry.The workspace has migrated from
astro-icontounplugin-icons. Verification confirms no package in the workspace depends onastro-icon, and the integration is not present inwww/astro.config.ts. Theastro-icon: 1.1.5entry in thewwwcatalog should be removed.♻️ Proposed cleanup
www: "@iconify-json/logos": 1.2.11 "@iconify-json/ph": 1.2.2 "astro": 6.1.8 - "astro-icon": 1.1.5 unplugin-icons: 23.0.1🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pnpm-workspace.yaml` around lines 59 - 60, Remove the stale "astro-icon": 1.1.5 entry from the www catalog in pnpm-workspace.yaml; locate the catalog section listing "astro-icon" alongside "unplugin-icons" and delete that single line, then save the file and run a quick workspace check (e.g., search for "astro-icon" across the repo) to confirm no remaining references.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/ci-security.yaml:
- Around line 17-21: The workflow currently sets permissions: {} which blocks
all token scopes and prevents the reusable job zizmor (which calls
luxass/shared-workflows/.github/workflows/ci-security.yaml) from obtaining the
required scopes; update the permissions to grant contents: read,
security-events: write, and id-token: write either at the top-level permissions
block or scoped under the zizmor job so the shared workflow can perform checkout
and SARIF upload (ensure the permissions keys are exactly contents,
security-events, and id-token).
---
Outside diff comments:
In @.github/workflows/release.yaml:
- Around line 23-47: The workflow pins for the GitHub Actions are inconsistent
and one is a breaking upgrade: replace the mismatched SHAs or use the canonical
tag refs for the two actions (pnpm/action-setup and changesets/action) so the
pinned commit matches the claimed tag (e.g., change uses:
pnpm/action-setup@fc06... to either
pnpm/action-setup@b307475762933b98ed359c036b0e51f26b63b74b or simply
pnpm/action-setup@v5.0.0, and change uses: changesets/action@6a0a83... to the
commit for v1.7.0 or changesets/action@v1.7.0); because pnpm/action-setup v5
requires Node 24, either downgrade to v4 (pnpm/action-setup@v4) or ensure your
runner images support Node 24 (or pin node-version accordingly) before merging.
---
Nitpick comments:
In @.github/workflows/ci-security.yaml:
- Around line 5-15: The CI workflow currently restricts triggers to pull_request
and push events only when ".github/workflows/**" changes (see the pull_request,
push and paths entries); confirm this scope is intentional and either keep it or
broaden triggers—if you want periodic security checks add a schedule: cron entry
to run the job on a cadence (e.g., daily/weekly) and/or remove/expand the paths
filter so the analysis runs on all pushes/PRs, then update the workflow's
pull_request/push/paths or add schedule accordingly.
In `@pnpm-workspace.yaml`:
- Around line 59-60: Remove the stale "astro-icon": 1.1.5 entry from the www
catalog in pnpm-workspace.yaml; locate the catalog section listing "astro-icon"
alongside "unplugin-icons" and delete that single line, then save the file and
run a quick workspace check (e.g., search for "astro-icon" across the repo) to
confirm no remaining references.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 2606d81c-d038-41d0-a991-1d95d8203899
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (17)
.github/workflows/ci-security.yaml.github/workflows/ci.yaml.github/workflows/ci.yml.github/workflows/release.yamlpnpm-workspace.yamlwww/astro.config.tswww/package.jsonwww/src/components/examples-section.astrowww/src/components/header.astrowww/src/components/toolbar.astrowww/src/lib/schemas.tswww/src/pages/404.astrowww/src/pages/examples/[slug].astrowww/src/pages/examples/index.astrowww/src/pages/index.astrowww/src/pages/schema.json.tswww/wrangler.jsonc
💤 Files with no reviewable changes (1)
- .github/workflows/ci.yml
✅ Files skipped from review due to trivial changes (7)
- www/src/pages/index.astro
- www/package.json
- www/src/pages/schema.json.ts
- www/src/components/toolbar.astro
- www/src/components/header.astro
- .github/workflows/ci.yaml
- www/src/lib/schemas.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- www/astro.config.ts
Co-authored-by: Copilot <copilot@github.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
2 participants
eslintto version 10.2.1 and related linting packages.vitestand@vitest/coverage-v8to 4.1.4.@changesets/cli,tsdown,turbo, andtypescript.astroto version 6.1.8 and related packages in thewwwcatalog.ES2024and modified paths forlesetidandremark-lesetid.astro.config.tsby removing unnecessaryplatformProxysettings.Summary by CodeRabbit
New Features
Chores