Conversation
Bump brace-expansion, minimatch, next, and qs to patched versions and refresh the root lockfile so npm audit passes cleanly.
Mirror root security overrides in test fixtures and refresh their lockfiles so audit:all stays clean.
Apply Dependabot PR #149 to keep the test container image on a supported Node.js release.
Mirror root dependency updates in test fixtures and refresh their lockfiles.
fix(deps): resolve audit findings and consolidate dependabot updates
## [0.18.3-beta.1](v0.18.2...v0.18.3-beta.1) (2026-06-08) ### Bug Fixes * **deps:** resolve npm audit findings across workspace ([bb41f5c](bb41f5c))
📝 WalkthroughWalkthroughThis PR performs a coordinated dependency audit fix and version bump for release 0.18.3-beta.1. It updates Node.js runtime to version 26, advances key toolchain packages (esbuild, jsdom, vite, Next.js, TypeScript), and applies matching override constraints across root and test fixture package manifests to resolve transitive dependency security issues. ChangesDependency updates and version bump
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
package.json (1)
123-124: Confirm TypeScript 6.0.3 and Vite 8.0.11 are available on npm; consider pinning for deployment stability.
package.jsonpinstypescriptas^6.0.3andviteas^8.0.11(lines 123-124). Both exact versions are published on npm (6.0.3,8.0.11) and their releases correspond to TypeScript v6.0.3 (Apr 16, 2026) and Vite v8.0.11 (May 7, 2026). Using^can still pull newer releases within the same major—pin exact versions (or rely on your lockfile) if you want maximum stability.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@package.json` around lines 123 - 124, package.json currently uses caret ranges "^6.0.3" and "^8.0.11" for the typescript and vite dependencies which allows minior/patch upgrades; to ensure deterministic deployments, change the dependency entries for "typescript" and "vite" to exact versions "6.0.3" and "8.0.11" (or ensure your lockfile is committed and authoritative) so builds use the published releases exactly; update the "typescript" and "vite" entries accordingly and regenerate/commit the lockfile.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Line 2: The Dockerfile change to FROM node:26-alpine may introduce
compatibility issues; update and verify package.json engines.node and any native
modules for Node 26 support, then rebuild and run tests inside the container.
Specifically, ensure package.json "engines.node" (and any native dependency
build scripts/C bindings) allow >=26 or are adjusted, run npm/yarn install and
the project's build/test commands in a node:26-alpine container, and fix any
failing native module versions or rebuild flags (e.g., recompile native addons
or bump module versions) so the image and runtime are compatible with Node 26.
In `@package.json`:
- Line 107: The package.json change updates the esbuild dependency to "esbuild":
"^0.28.0", which introduced stricter integrity-hash checks that can break
installs in restricted network/proxy/offline scenarios; validate and mitigate by
(1) running npm install / npm ci and the full build in the same CI and local
environments that might use the fallback binary (including behind proxies, using
the cache, and offline modes), (2) confirm package-lock.json is updated and
committed if the lockfile changes, (3) if failures are observed, either pin
esbuild to the last known-good version or add a documented workaround (npm
config settings or explicit prebuilt binary provisioning) to CI scripts, and (4)
add a CI job that simulates the restricted environment to catch regressions;
locate this change via the "esbuild" dependency entry in package.json.
---
Nitpick comments:
In `@package.json`:
- Around line 123-124: package.json currently uses caret ranges "^6.0.3" and
"^8.0.11" for the typescript and vite dependencies which allows minior/patch
upgrades; to ensure deterministic deployments, change the dependency entries for
"typescript" and "vite" to exact versions "6.0.3" and "8.0.11" (or ensure your
lockfile is committed and authoritative) so builds use the published releases
exactly; update the "typescript" and "vite" entries accordingly and
regenerate/commit the lockfile.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: d2cd5815-6007-4ae1-bdf4-7010b2b350cf
⛔ Files ignored due to path filters (4)
package-lock.jsonis excluded by!**/package-lock.jsontests/test-commonjs/package-lock.jsonis excluded by!**/package-lock.jsontests/test-nextjs-cjs/package-lock.jsonis excluded by!**/package-lock.jsontests/test-nextjs/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (6)
CHANGELOG.mdDockerfilepackage.jsontests/test-commonjs/package.jsontests/test-nextjs-cjs/package.jsontests/test-nextjs/package.json
| @@ -1,5 +1,5 @@ | |||
| # Use official Node.js image | |||
| FROM node:25-alpine | |||
| FROM node:26-alpine | |||
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check if node:26-alpine Docker image exists
echo "=== Checking node:26-alpine availability ==="
docker pull node:26-alpine --quiet && echo "Image available" || echo "Image not found"
echo "=== Latest Node.js LTS versions ==="
curl -s https://nodejs.org/dist/index.json | jq -r '[.[] | select(.lts != false)] | .[0:3] | .[] | "\(.version) (LTS: \(.lts))"'Repository: mi-examples/pp-dev
Length of output: 294
🌐 Web query:
Node.js 26 release date alpine
💡 Result:
Node.js 26 was initially released on May 5, 2026 [1][2][3]. Regarding Alpine Linux support, the Node.js project typically publishes official Docker images based on Alpine Linux (e.g., node:26-alpine) shortly after the release of a new major version. As of June 8, 2026, the Node.js 26.x release line is active [1][2], and Alpine-based images for current Node.js 26 versions are maintained and available on the official Node.js Docker Hub registry. You can use tags such as node:26-alpine or node:26.3-alpine to access the latest available version [4].
Citations:
- 1: https://github.com/nodejs/release?tab=readme-ov-file
- 2: https://nodejs.org/en/about/previous-releases
- 3: https://nodejs.org/en/blog/release/v26.0.0
- 4: https://nodejs.org/en/blog/release/v26.3.0
Ensure dependency compatibility with Node.js 26 (node:26-alpine).
Dockerfile now uses FROM node:26-alpine. Node.js 26 is released and official Alpine-based Docker images for the 26.x line are maintained on Docker Hub, but the major-version upgrade can still break runtime/build compatibility. Check package.json engines.node (and any native modules) for Node 26 support, and run the project’s build/test steps in the container.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` at line 2, The Dockerfile change to FROM node:26-alpine may
introduce compatibility issues; update and verify package.json engines.node and
any native modules for Node 26 support, then rebuild and run tests inside the
container. Specifically, ensure package.json "engines.node" (and any native
dependency build scripts/C bindings) allow >=26 or are adjusted, run npm/yarn
install and the project's build/test commands in a node:26-alpine container, and
fix any failing native module versions or rebuild flags (e.g., recompile native
addons or bump module versions) so the image and runtime are compatible with
Node 26.
| "dir-compare": "^5.0.0", | ||
| "ejs": "^5.0.1", | ||
| "esbuild": "^0.27.7", | ||
| "esbuild": "^0.28.0", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify esbuild 0.28.0 exists and check for breaking changes
# Check if esbuild 0.28.0 is published
npm view esbuild@0.28.0 version 2>/dev/null || echo "Version not found"
# Get changelog between 0.27.x and 0.28.0
npm view esbuild@0.27.7 version
npm view esbuild@0.28.0 versionRepository: mi-examples/pp-dev
Length of output: 83
🌐 Web query:
esbuild 0.28.0 changelog breaking changes
💡 Result:
The release of esbuild v0.28.0 is designated as a breaking change release primarily due to internal modifications regarding how the package manages binary installation integrity [1][2]. The breaking change is associated with the addition of integrity checks to the fallback download path for the esbuild binary [1][3]. Previously, the last-resort fallback mechanism—which triggers if the standard npm-based installation of platform-specific packages fails—did not verify the integrity of the downloaded binary [1][2]. In v0.28.0, esbuild now verifies that the hash of the downloaded binary matches the expected hash for the current release [1][3]. To support this, the hashes for all platform-specific binary packages are now embedded within the top-level esbuild package [1][2]. While this change is intended to improve security and reliability without expected functional regressions, it is labeled as a breaking change out of caution regarding the modified installation process [1][2]. Additionally, v0.28.0 includes the following updates: - Added support for with { type: 'text' } imports, consistent with the TC39 stage 3 proposal and existing behavior in Deno and Bun [1][2][3]. - Updated the Go compiler from version 1.25.7 to 1.26.1, which involves significant internal changes (e.g., a new garbage collector and more aggressive stack allocation) [1][2][3]. While these are not classified as direct breaking API changes, they may lead to different behavior in specific edge cases [1][4].
Citations:
- 1: https://github.com/evanw/esbuild/releases/tag/v0.28.0
- 2: https://github.com/evanw/esbuild/blob/HEAD/CHANGELOG.md
- 3: chore(deps): update dependency esbuild to v0.28.0 (main) renovatebot/renovate#42522
- 4: https://github.com/evanw/esbuild/blob/master/CHANGELOG.md
Verify esbuild 0.28.0 upgrade impact on install/build
esbuild@0.28.0is published, so the version bump inpackage.json("esbuild": "^0.28.0") is resolvable.- esbuild v0.28.0 is labeled “breaking” due to stricter integrity-hash checks added to the fallback binary download path; validate
npm installand the build/CI pipeline in the environments where that fallback might be exercised (restricted network/proxy/offline/cache issues).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` at line 107, The package.json change updates the esbuild
dependency to "esbuild": "^0.28.0", which introduced stricter integrity-hash
checks that can break installs in restricted network/proxy/offline scenarios;
validate and mitigate by (1) running npm install / npm ci and the full build in
the same CI and local environments that might use the fallback binary (including
behind proxies, using the cache, and offline modes), (2) confirm
package-lock.json is updated and committed if the lockfile changes, (3) if
failures are observed, either pin esbuild to the last known-good version or add
a documented workaround (npm config settings or explicit prebuilt binary
provisioning) to CI scripts, and (4) add a CI job that simulates the restricted
environment to catch regressions; locate this change via the "esbuild"
dependency entry in package.json.
3 participants
🚀 Promote
developtomain(0.18.3-beta.1 — audit fixes + dependabot)Summary
Merge the current
origin/developline intoorigin/mainto ship v0.18.3-beta.1: full workspace npm audit remediation, consolidation of 12 open Dependabot PRs, and aligned test-sandbox lockfiles.Key changes
npm auditfindings in root and everytests/*package (brace-expansion,minimatch,qs,next, and related overrides).esbuild,jsdom,typescript,vite,vitest,@vitest/coverage-v8.node:25-alpine→node:26-alpine.chore(release): 0.18.3-beta.1 [skip ci]and CHANGELOG delta ondevelop(via #160).Stats
(
git diff --stat origin/main...origin/develop)Included commits
(
git log origin/main..origin/develop --oneline)1520656— chore(release): 0.18.3-beta.1 [skip ci]f8ffa4d— Merge pull request fix(deps): resolve audit findings and consolidate dependabot updates #160 from mi-examples/pp-3487c808e40— test(deps): align sandbox packages with dependabot bumpsf74c30a— build(docker): bump node from 25-alpine to 26-alpined1acc46— build(deps): apply dependabot dependency bumps5fd28b9— test(deps): align sandbox overrides with audited dependency policybb41f5c— fix(deps): resolve npm audit findings across workspaceTesting / verification
npm run audit:all— 0 vulnerabilities (root + eachtests/*package)npm run test:unit— 159/159 passednpm run buildnpm run test:integrationnpm ciat repo root succeedsSummary by CodeRabbit
Bug Fixes
Chores