chore(deps): bump transitive dependency overrides#3818
Conversation
WalkthroughThis PR updates dependency version overrides in Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsGit: Failed to clone repository. Please run the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
package.json (1)
103-125: ⚡ Quick winVerify Prettier formatting compliance.
Ensure
pnpm run formathas been run before committing, as required by the coding guidelines for.jsonfiles.As per coding guidelines, JSON files should be formatted using Prettier by running
pnpm run formatbefore committing.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@package.json` around lines 103 - 125, The package.json changes are not Prettier-formatted; run the repository formatter and fix whitespace/ordering per project rules by running "pnpm run format" (or your project's Prettier command) on package.json, verify the diff for package.json now matches Prettier output (check the dependency entries such as the modified version lines like "qs@>=6.0.0 <6.15.2", "vite@>=5.0.0 <6.4.2", etc.), stage and recommit the formatted package.json so the file complies with the project's JSON formatting guidelines.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@package.json`:
- Around line 103-125: The package.json changes are not Prettier-formatted; run
the repository formatter and fix whitespace/ordering per project rules by
running "pnpm run format" (or your project's Prettier command) on package.json,
verify the diff for package.json now matches Prettier output (check the
dependency entries such as the modified version lines like "qs@>=6.0.0 <6.15.2",
"vite@>=5.0.0 <6.4.2", etc.), stage and recommit the formatted package.json so
the file complies with the project's JSON formatting guidelines.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 0f4f6fe7-8829-4948-b29b-5ecb0649a228
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
package.json
📜 Review details
🧰 Additional context used
📓 Path-based instructions (1)
**/*.{js,ts,tsx,jsx,css,json,md}
📄 CodeRabbit inference engine (AGENTS.md)
Use Prettier for code formatting and run
pnpm run formatbefore committing
Files:
package.json
🧠 Learnings (6)
📓 Common learnings
Learnt from: ericallam
Repo: triggerdotdev/trigger.dev PR: 3543
File: pnpm-workspace.yaml:15-16
Timestamp: 2026-05-14T13:46:01.116Z
Learning: In `pnpm-workspace.yaml` of triggerdotdev/trigger.dev, `secure-exec` and `secure-exec/*` are intentionally excluded from `minimumReleaseAge` quarantine. They back the `secureExec` build extension (packages/build/src/extensions/secureExec.ts) and rely on lockfile-pinned installs for version immutability. Both entries are planned to be removed alongside the build extension in a follow-up PR.
Learnt from: CR
Repo: triggerdotdev/trigger.dev PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-06-02T21:20:56.997Z
Learning: Install dependencies with `pnpm i` (requires pnpm `10.33.2` and Node.js `20.20.2`)
📚 Learning: 2026-06-02T21:20:43.541Z
Learnt from: CR
Repo: triggerdotdev/trigger.dev PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-06-02T21:20:43.541Z
Learning: Edit `package.json` directly instead of using `pnpm add` for adding dependencies, then run `pnpm i` from the repo root
Applied to files:
package.json
📚 Learning: 2026-06-02T21:20:56.997Z
Learnt from: CR
Repo: triggerdotdev/trigger.dev PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-06-02T21:20:56.997Z
Learning: Install dependencies with `pnpm i` (requires pnpm `10.33.2` and Node.js `20.20.2`)
Applied to files:
package.json
📚 Learning: 2026-06-02T21:20:43.541Z
Learnt from: CR
Repo: triggerdotdev/trigger.dev PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-06-02T21:20:43.541Z
Learning: Add a changeset when modifying any public package (`packages/*` or `integrations/*`) using `pnpm run changeset:add`
Applied to files:
package.json
📚 Learning: 2026-04-27T16:40:37.692Z
Learnt from: nicktrn
Repo: triggerdotdev/trigger.dev PR: 3456
File: apps/webapp/package.json:230-230
Timestamp: 2026-04-27T16:40:37.692Z
Learning: In `apps/webapp/remix.config.js` (Remix 2.x, CJS server build via `serverModuleFormat: "cjs"`), ESM-only npm packages must be added to the `serverDependenciesToBundle` array so esbuild inlines them rather than emitting a `require()` call. The `engines` field allows Node >=18.19.0 || >=20.6.0, so `require(esm)` (Node 20.19+) cannot be relied upon. Packages already listed include p-limit, p-map, axios, and (as of PR `#3456`) uuid. When upgrading a dependency that drops CJS support, always check the post-build artifact for `require("<package>")` and add it to `serverDependenciesToBundle` if present.
Applied to files:
package.json
📚 Learning: 2026-05-14T13:46:01.116Z
Learnt from: ericallam
Repo: triggerdotdev/trigger.dev PR: 3543
File: pnpm-workspace.yaml:15-16
Timestamp: 2026-05-14T13:46:01.116Z
Learning: In `pnpm-workspace.yaml` of triggerdotdev/trigger.dev, `secure-exec` and `secure-exec/*` are intentionally excluded from `minimumReleaseAge` quarantine. They back the `secureExec` build extension (packages/build/src/extensions/secureExec.ts) and rely on lockfile-pinned installs for version immutability. Both entries are planned to be removed alongside the build extension in a follow-up PR.
Applied to files:
package.json
🔇 Additional comments (1)
package.json (1)
103-103: ⚡ Quick winConfirm override pins match upstream patched security versions (and consider newer patch releases).
qs: fixed in 6.15.2 (CVE-2026-8723 / GHSA-q8mj-m7cp-5q26) — your override for<6.15.2should force ^6.15.2.protobufjs: patched in 7.5.6 (GHSA-75px-5xx7-5xc7) — ensurepnpm.overridesfor protobufjs forces 7.5.6+ (latest in 7.x is 7.6.2).fast-uri: patched in 3.1.2 (GHSA-v39h-62p7-jpjc) — ensure overrides force 3.1.2 (latest in 3.x is 3.1.2).fast-xml-builder: patched in 1.1.7 (GHSA-5wm8-gmm8-39j9) — ensure overrides force 1.1.7+ (latest in 1.x is 1.2.0).- Ensure
pnpm run formatwas run for the rootpackage.json.
2 participants
Routine maintenance pass on a few transitive
pnpm.overrides.fast-uri/fast-xml-builder: add overrides pinning to current releases (3.1.2/1.1.7).protobufjs/qs: bump existing override pins that had fallen a patch behind (7.5.6/6.15.2).Overrides-only - no first-party code changes; lockfile regenerated to match. Verified the affected transitives resolve to the pinned releases via
pnpm why -r.