Codex pnpm audit fixes - #153
Conversation
📝 WalkthroughWalkthroughThis PR updates security documentation to clarify assessment outcomes and adds spacing for readability, while also upgrading dev dependency versions and introducing pnpm transitive dependency pinning to ensure consistent builds. ChangesMaintenance Updates
🎯 2 (Simple) | ⏱️ ~8 minutes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Around line 26-27: Update release validation by confirming Node.js target and
testing linting/secret workflows: verify the project's Node.js engine/version
(ensure it meets Node.js 22+ if upgrading `@commitlint/cli` to ^21.0.1), run
commitlint CLI with current config (packages "`@commitlint/cli`" and
"`@commitlint/config-conventional`") to observe the new CLI output formatting and
test using the --legacy-output flag where needed, and run secretlint (including
v13 behavior) against the repo to confirm .gitignore is respected and no files
are unintentionally excluded; if issues appear, either pin commitlint to a
Node-compatible version, adjust package.json engines, or update CI scripts to
pass --legacy-output and update secretlint config to explicitly include/exclude
files.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: c2e680fa-76f9-4e75-b581-7a273302c87a
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
SECURITY.mdpackage.json
| "@commitlint/cli": "^21.0.1", | ||
| "@commitlint/config-conventional": "^21.0.1", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify the existence of the specified package versions
echo "Checking `@commitlint/cli`@21.0.1..."
npm view `@commitlint/cli`@21.0.1 version 2>/dev/null || echo "❌ Version not found"
echo "Checking `@secretlint/secretlint-rule-preset-recommend`@13.0.2..."
npm view `@secretlint/secretlint-rule-preset-recommend`@13.0.2 version 2>/dev/null || echo "❌ Version not found"
echo "Checking secretlint@13.0.2..."
npm view secretlint@13.0.2 version 2>/dev/null || echo "❌ Version not found"
echo ""
echo "Fetching release notes for major version changes..."
echo "Commitlint v21 changes:"
gh api repos/conventional-changelog/commitlint/releases --jq '.[] | select(.tag_name | startswith("v21")) | {tag: .tag_name, url: .html_url}' | head -5
echo ""
echo "Secretlint v12 and v13 changes:"
gh api repos/secretlint/secretlint/releases --jq '.[] | select(.tag_name | startswith("v12") or startswith("v13")) | {tag: .tag_name, url: .html_url}' | head -10Repository: dotmh/ts
Length of output: 1216
🌐 Web query:
commitlint v21 release notes changelog breaking changes
💡 Result:
Commitlint v21.0.0 was released on May 8, 2026 [1][2]. This major release includes several breaking changes and internal cleanups [1]. Breaking Changes: - Minimum Node.js version: The minimum supported Node.js version has been increased to v22 [1]. - CLI Output: The CLI now displays input from a new line [1]. A --legacy-output flag has been introduced as a transitional escape hatch to maintain previous behavior, though it is planned for removal in a future major release [1]. Users are advised to migrate their parsers and snapshots to the new format during the v21 lifecycle [1]. Other Notable Changes: - Dependency Cleanup: Significant internal refactoring was performed to leverage Node.js 22 built-ins, resulting in the removal of dependencies such as glob, fast-glob, import-meta-resolve, minimist, and fs-extra [1]. - Dependency Updates: Updated yargs to v18 and widened the cz-commitlint inquirer peer dependency to support versions 9–12 [1]. For a complete list of changes, you can view the full changelog on the official GitHub repository [1].
Citations:
- 1: https://github.com/conventional-changelog/commitlint/releases/tag/v21.0.0
- 2: https://newreleases.io/project/github/conventional-changelog/commitlint/release/v21.0.0
🌐 Web query:
secretlint v13 v12 release notes breaking changes migration guide
💡 Result:
Secretlint v13.0.0 was released on May 4, 2026 [1]. A key change in this version is that secretlint now respects.gitignore files by default [1]. Regarding the transition from v12 to v13, users should consult the official changelog on GitHub for a comprehensive list of changes [1]. While specific, detailed migration guides are often maintained within the repository's documentation or release notes, the primary breaking change noted in recent development cycles for secretlint has been the shift toward security-focused defaults, such as making --maskSecrets the default behavior (implemented in earlier versions) [2]. To migrate or upgrade: 1. Review the full changelog between v12.3.1 and v13.0.0 on GitHub to identify any specific breaking changes affecting your configuration [1]. 2. Test your existing workflows, especially those relying on file inclusion/exclusion, as the new default behavior of respecting.gitignore may change which files are scanned [1]. 3. If you encounter issues with file scanning, you may need to adjust your configuration or CLI arguments to explicitly include or exclude files as necessary. For the most accurate and up-to-date information, always refer to the official GitHub releases page [3].
Citations:
- 1: https://github.com/secretlint/secretlint/releases/tag/v13.0.0
- 2: Make --maskSecrets the default behavior and add --no-maskSecrets option secretlint/secretlint#1067
- 3: https://github.com/secretlint/secretlint/releases
Verify compatibility with Node.js 22 requirement and test for output format/scanning behavior changes.
Major version bumps introduce breaking changes that require testing:
@commitlintv21.0.1: Requires Node.js 22 minimum (increased from previous requirement). CLI output format now displays from a new line;--legacy-outputflag available for backward compatibility during migration.@secretlintv13.0.2: Now respects.gitignorefiles by default, potentially changing which files are scanned for secrets.
Verify the project's Node.js target version and test commit message linting and secret detection workflows before merging.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` around lines 26 - 27, Update release validation by confirming
Node.js target and testing linting/secret workflows: verify the project's
Node.js engine/version (ensure it meets Node.js 22+ if upgrading `@commitlint/cli`
to ^21.0.1), run commitlint CLI with current config (packages "`@commitlint/cli`"
and "`@commitlint/config-conventional`") to observe the new CLI output formatting
and test using the --legacy-output flag where needed, and run secretlint
(including v13 behavior) against the repo to confirm .gitignore is respected and
no files are unintentionally excluded; if issues appear, either pin commitlint
to a Node-compatible version, adjust package.json engines, or update CI scripts
to pass --legacy-output and update secretlint config to explicitly
include/exclude files.
1 participant
This pull request updates the project's development dependencies to their latest versions and introduces explicit
pnpmpackage overrides to ensure consistent dependency resolution. Additionally, it clarifies and expands the security policy inSECURITY.mdto provide clearer guidance for vulnerability reporters.Dependency updates and package management:
package.jsonto their latest versions, including@commitlint/cli,@commitlint/config-conventional,@secretlint/secretlint-rule-preset-recommend,@typescript-eslint/eslint-plugin,@typescript-eslint/parser,@vitest/coverage-istanbul,eslint,eslint-plugin-promise,secretlint,vitest, andyaml.pnpm.overridessection topackage.jsonto pin specific versions of key dependencies (ajv@8,brace-expansion@1,fast-uri,flatted,picomatch,postcss,rollup, andvite) for improved build consistency and compatibility.Security policy improvements:
SECURITY.mdto clarify the process for accepting or rejecting vulnerability reports, including the appeal process and next steps if a report is accepted.SECURITY.mdto explicitly request confidentiality, reasonable disclosure timelines, and good faith actions from reporters.Summary by CodeRabbit
Documentation
Chores