PP-2787 fix(deps): Security Updates, Dependency Upgrades & Cursor Rules - #51
Merged
Conversation
- Add npm overrides for minimatch ^10.2.2 to fix ReDoS vulnerability - Upgrade @clack/prompts to ^1.0.1 - Upgrade template packages to latest versions - Set node >=22.0.0 and npm >=10.0.0 in engines for all packages
- Fix validate callbacks to accept string | undefined - Fix p.select generic (use single Framework type arg) - Fix pkgJson.dependencies for vanilla templates (no deps key) - Fix spawn.sync: pass command and args separately for install
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
scripts/postbuild.js (2)
12-20: Consider potential edge case with stale tarballs.The script finds all
.tgzfiles matching the package name and selects the latest by modification time. If stale tarballs from previous builds accumulate in the root directory, they won't cause issues due to the mtime sorting, but they may clutter the directory over time.Consider adding cleanup of old tarballs or documenting that developers should periodically clean them. This is optional and doesn't block the PR.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/postbuild.js` around lines 12 - 20, The tgzFiles collection (built using readdirSync, filter by .tgz and packName, mapped with statSync mtime and sorted) can leave stale tarballs that clutter rootDir; update the script after building to remove older artifacts by keeping only the most recent N entries from tgzFiles (e.g., 1 or configurable retention) and unlinking the rest (use fs.unlinkSync or fs.promises.unlink) with proper error handling and a short log message, or alternatively add a documented note about manual cleanup if you prefer not to auto-delete.
31-31: Regex handles common semver patterns but has a minor limitation.The regex
/-[\d.]+(-[a-z0-9.-]+)?\.tgz$/correctly handles versions like1.0.0,0.5.5-beta.2, etc. However, the prerelease pattern[a-z0-9.-]+only matches lowercase letters. While semver technically allows uppercase in prerelease identifiers (e.g.,1.0.0-RC.1), this is uncommon in npm packages.For robustness, consider using case-insensitive matching:
♻️ Optional: Support uppercase prerelease identifiers
-const latestNameNew = latestName.replace(/-[\d.]+(-[a-z0-9.-]+)?\.tgz$/, "-latest.tgz"); +const latestNameNew = latestName.replace(/-[\d.]+(-[a-z0-9.-]+)?\.tgz$/i, "-latest.tgz");Or explicitly include uppercase:
-const latestNameNew = latestName.replace(/-[\d.]+(-[a-z0-9.-]+)?\.tgz$/, "-latest.tgz"); +const latestNameNew = latestName.replace(/-[\d.]+(-[a-zA-Z0-9.-]+)?\.tgz$/, "-latest.tgz");🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/postbuild.js` at line 31, The regex used to build latestNameNew (const latestNameNew = latestName.replace(/-[\d.]+(-[a-z0-9.-]+)?\.tgz$/, "-latest.tgz")) only matches lowercase prerelease identifiers; update the replace call to allow uppercase prerelease identifiers by making the regex case-insensitive (add the i flag) or expand the character class (e.g., [A-Za-z0-9.-]) so 1.0.0-RC.1 and similar tags are handled correctly.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.cursor/rules/create-pr.mdc:
- Around line 33-40: Update the example PR message in
.cursor/rules/create-pr.mdc by changing the commit type header "## 🚀 feat: Add
minimatch override for security" to use the correct maintenance type (e.g., "##
🚧 chore: Add minimatch override for security") and expand the body to include
the required sections: Summary (2–3 sentences), Key Features & Improvements,
Impact Summary (file/code stats), Breaking Changes, Testing & Quality Assurance,
Included Commits, Release Notes, and Ready for [Target] status so the template
enforces required content and correct commit type for dependency/security
maintenance.
In @.cursor/rules/create-release.mdc:
- Around line 8-37: The release rule currently instructs manual tagging and
pushing (git fetch/git tag/git push); update it to align with semantic-release
by removing the manual tag/push commands and replacing Steps 4–5 with guidance
to trigger the semantic-release workflow from a merged PR (ensuring releases are
created by semantic-release on origin/main), and add a verification step to
check the tag created by semantic-release on origin/main; reference the existing
rule headings/steps ("Read version from package.json", "Strip beta suffix", "Tag
name", and the current "Create tag on latest origin/main"/"Push tag") so the
manual commands are replaced with "Use semantic-release" and "Verify tag"
instructions.
---
Nitpick comments:
In `@scripts/postbuild.js`:
- Around line 12-20: The tgzFiles collection (built using readdirSync, filter by
.tgz and packName, mapped with statSync mtime and sorted) can leave stale
tarballs that clutter rootDir; update the script after building to remove older
artifacts by keeping only the most recent N entries from tgzFiles (e.g., 1 or
configurable retention) and unlinking the rest (use fs.unlinkSync or
fs.promises.unlink) with proper error handling and a short log message, or
alternatively add a documented note about manual cleanup if you prefer not to
auto-delete.
- Line 31: The regex used to build latestNameNew (const latestNameNew =
latestName.replace(/-[\d.]+(-[a-z0-9.-]+)?\.tgz$/, "-latest.tgz")) only matches
lowercase prerelease identifiers; update the replace call to allow uppercase
prerelease identifiers by making the regex case-insensitive (add the i flag) or
expand the character class (e.g., [A-Za-z0-9.-]) so 1.0.0-RC.1 and similar tags
are handled correctly.
ℹ️ Review info
Configuration used: defaults
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (10)
.cursor/rules/create-pr.mdc.cursor/rules/create-release.mdc.gitignorepackage.jsonscripts/postbuild.jssrc/index.tstemplate-nextjs/package.jsontemplate-react/package.jsontemplate-vanilla-ts/package.jsontemplate-vanilla/package.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR addresses security vulnerabilities (minimatch ReDoS), upgrades dependencies across the root package and all templates, adds npm/Node engine requirements, introduces a postbuild script for pack artifacts, and adds Cursor rules for PR and release workflows.
✨ Key Features & Improvements
📊 Impact Summary
🔄 Breaking Changes
🧪 Testing & Quality Assurance
npm auditreports 0 vulnerabilities after changesnpm run buildsucceeds with postbuild pack + copy📝 Included Commits
ee27478fix(deps): add minimatch override and upgrade packages for security14141f8chore: add postbuild script and gitignore for latest tgz029973efeat(cursor): add Create PR and Create release rules🏷️ Release Notes
✅ Ready for develop
Merge Request:
pp-2787-updates→origin/developStatus: Ready for Review ✅
Summary by CodeRabbit
New Features
Chores