Repository navigation
Conversation
Clears GHSA-qw65-cvwx-89v3 and GHSA-58mr-gqgx-xq4g (high) and GHSA-hrr3-gc8f-f4qj (moderate). fast-uri is transitive via conf -> ajv. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
type-check, build and all 139 unit tests pass unchanged on node 22. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
tsc --noEmit passes with 7.0.2. tsup builds with esbuild and emits no .d.ts, so the TS 7 dts breakage seen in the sdk repo does not apply here. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Your free trial PR review limit of 1000 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI. |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_509d3886-c77f-44d2-ad3a-687a00abbfcd) |
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour. 📜 Recent review details⏰ Context from checks skipped due to timeout. (5)
🔇 Additional comments (1)
📝 SummarySummary by CodeRabbit
WalkthroughThe TypeScript development dependency range changed to ChangesDevelopment Tool Version Updates
Priority: ➖ Normal Estimated code review effort: 1 (Trivial) | ~4 minutes Change: Other Merge Risk: ⚪ Minimal · up to The Node 20 smoke workflow installs Vitest outside its declared engine range, but the reported install, build, and pack succeed with a warning; tests run on Node 22. The lockfile matches the updated manifest, and no actionable merge-blocking risk is evident. Architecture SummaryArchitecture risk: 🔵 Low · up to The change affects 1 system. Changed systems: Architecture concerns Review detailsSystems and components
Before / after behavior
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| "typescript": "^5.9.3", | ||
| "vitest": "^4.0.16" | ||
| "typescript": "^7.0.2", | ||
| "vitest": "^5.0.2" |
There was a problem hiding this comment.
Vitest 5 requires Node 22.12 or newer, while this package still advertises Node 18+ and its smoke workflow includes Node 20. Tests run only on Node 22 in CI, so they do not check the test workflow on those older supported versions. Align the stated development requirement with Vitest, or keep a test runner that supports it.
ApprovabilityVerdict: Not approved Macroscope's review found this PR not approvable — This is a dependency and lockfile-only update with no application-source changes, but it introduces Vitest 5 while the package still advertises Node 18+ and includes Node 20 smoke coverage. The resulting supported-environment mismatch is a concrete unresolved compatibility risk. Not approved because:
Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more. |
🟢 WAVE BugBot — clearNo confident findings on the changed lines. Local review · $0 inference · wave-dispatch |
What
This PR changes manifests and the lockfile only. There are three commits, one per change, so any of them can be reverted on its own.
fast-uri(transitive, viaconf→ajv)npm audit fix, no--force.vitest(dev)^4.0.16→ 4.1.11^5.0.2→ 5.0.2latest(5.0.2, published 2026-09-25). Major, kept because every test passes unchanged.typescript(dev)^5.9.3→ 5.9.3^7.0.2→ 7.0.2latest(7.0.2, published 2026-07-08). Major, kept becausetsc --noEmitpasses.Versions and dates come from the npm registry, queried 2026-09-30. Advisory severities and dates come from
gh api /advisories/<id>.npm audit: 1 high, 1 low → 1 low. The remaining finding is esbuild GHSA-g7r4-m6w7-qqqr, which only affects the esbuild dev server on Windows. It comes in throughtsup@8.5.1, which pinsesbuild ^0.27.0.Why this is safe
tsup.config.tshas nodtsoption, sonpm run buildis esbuild-only. The TS 7rollup-plugin-dtscrash seen in the sdk repo's trial can't happen here.tscis used only fornpm run type-check.engines.node ^22.12.0 || ^24.0.0 || >=26.0.0. Theunitjob runs tests on node 22.smoke-installalso runs on node 20, but only fornpm ci,buildandpack. On node 20 those print anEBADENGINEwarning and still succeed.chalk@6(already on main) prints the same warning today.fast-urichange. Close it if this merges first.Receipts (local; GitHub Actions currently ends every run in
startup_failure, runner=null)Fresh clone of
mainat9d7ee87. Node v22.23.3 / npm 10.9.9 unless noted.npm cinpm run type-checknpm run buildnpm testnode dist/index.js --version1.0.10npm ci --include=dev,npm run build,npm packI also ran vitest 5 and TS 7 as separate trials before committing, and each passed on its own.
npm run lintfails on both main and this branch witheslint: command not found:eslintisn't a devDependency, and no workflow runs lint (see the note in_release-verify.yml). This PR leaves that alone.Not in this PR
inquirer14,open11,ora9 andzod4 are runtime majors, outside the key-dependency sweep.package.json/package-lock.json. Whichever merges second needsnpm installto regenerate the lockfile.This PR is part of a go-live sweep of key dependencies across the WAVE repositories.
Not merged. Opened for review.
🤖 Generated with Claude Code
Note
Medium Risk
Major dev-tool upgrades can surface new type errors or test-runner behavior on some Node versions; vitest 5’s engine requirement is stricter than
package.json’s>=18, though CI reportedly runs Node 22 for tests.Overview
Bumps dev tooling and refreshes the lockfile to address security and major-version updates, with no application source changes.
package.jsonraises TypeScript from^5.9.3to^7.0.2and Vitest from^4.0.16to^5.0.2. The lockfile follows with TS 7’s platform-specific optional packages, Vitest 5’s slimmer dependency graph (fewer@vitest/*subpackages), and transitive bumps includingfast-uri3.1.8 (security advisories), rolldown/vite/postcss, and related build-tool peers marked"peer": true.Runtime dependencies and CLI behavior are unchanged; impact is limited to
npm run type-check,npm test, and CI install/build gates.Reviewed by Cursor Bugbot for commit 5ceb2a2. Bugbot is set up for automated code reviews on this repo. Configure here.