chore: resolve dev Dependabot alerts#859
Conversation
📝 WalkthroughWalkthroughThis PR updates development dependencies across the monorepo workspace: vitest is bumped to ^4.1.8, testcontainers packages are upgraded to ^12.0.1, root toolchain updates include mssql and hono versions, and some manifests reorder dependency entries for consistency. ChangesWorkspace dependency maintenance
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsStopped waiting for pipeline failures after 30000ms. One of your pipelines takes longer than our 30000ms fetch window to run, so review may not consider pipeline-failure results for inline comments if any failures occurred after the fetch window. Increase the timeout if you want to wait longer or run a Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/ddl-docs-cli/package.json`:
- Line 41: The scaffolded Vitest version in the project generator is out of
date: in packages/ztd-cli/src/commands/init.ts the template string that writes
package.json currently pins "vitest": '^4.0.7' — update that template to use
'^4.1.8' (or better, read the workspace version dynamically) so generated
projects match the workspace; locate the code that constructs the scaffolded
package.json (the init command / function that writes the template) and replace
the hardcoded '^4.0.7' with '^4.1.8' or a variable sourced from the workspace.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: c76f8b91-2c8d-4b65-93bf-e97beee03205
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (15)
package.jsonpackages/adapters/adapter-node-pg/package.jsonpackages/advanced-runtime/package.jsonpackages/core/package.jsonpackages/ddl-docs-cli/package.jsonpackages/ddl-docs-vitepress/package.jsonpackages/executor/package.jsonpackages/sql-grep-core/package.jsonpackages/test-evidence-core/package.jsonpackages/test-evidence-renderer-md/package.jsonpackages/testkit-core/package.jsonpackages/testkit-postgres/package.jsonpackages/testkit-sqlite/package.jsonpackages/transfer/package.jsonpackages/ztd-cli/package.json
1 participant
Summary
honoto4.12.21, align workspacevitestpackages on4.1.8, movetestcontainerspackages to12.0.1sotmpresolves to0.2.7, and update rootmssqlto remove the olduuidpath.ztd initgenerated project Vitest devDependency with the workspace-supported^4.1.8version and add a changeset for the scaffold-visible update.Verification
pnpm why hono --recursive --depth 8resolveshonoto4.12.21.pnpm why vitest --recursive --depth 2resolves workspace Vitest usage to4.1.8.pnpm why tmp --recursive --depth 8resolvestmpto0.2.7.pnpm why uuid --recursive --depth 8returns no dependency path.rg -n -F "^4.0.7" --glob "!node_modules/**" --glob "!tmp/**"returns no matches.pnpm --filter @rawsql-ts/ztd-cli exec vitest run tests/init.command.test.tspnpm typechecknode ./scripts/release-readiness.js detect --base-sha 8b8cb2282487b06df347c0f5f0280f44f370b8fd --head-sha dfb54d832caf4f18acf37ad6c1d934961b149aae --event-path tmp/pr-event.jsontest:essential, ztd-cli build, and ztd-cli lint.pnpm build,pnpm test, andgit diff --check.Merge Readiness
Tracking issue: none
Scoped checks run:
pnpm typecheck;pnpm build;pnpm test;git diff --check; ztd-clitest:essential; release-readiness detect; targetedpnpm whychecks forhono,vitest,tmp, anduuidWhy full baseline is not required: Not applicable; no baseline exception requested.
Self Review
Self-review workflow:
developer-self-reviewtwo-cycle consistency review and human acceptance review.Self-review result: No blockers remain; CodeRabbit's scaffolded Vitest version finding was valid and is fixed with test coverage.
Concept-review workflow: Checked the ztd-cli scaffold boundary for a generated package devDependency-only change plus dependency manifest updates.
Concept-review result: No concept or package-boundary violations found; the scaffold continues to emit a DB-free test command and now emits the patched Vitest line.
CLI Surface Migration
No-migration rationale: The
ztd initcommand surface did not change; generated projects receive the same test setup with an updated compatible Vitest devDependency.Upgrade note: Not applicable.
Deprecation/removal plan or issue: Not applicable.
Docs/help/examples updated: Not applicable; no command, option, help text, or example workflow changed.
Release/changeset wording:
.changeset/fresh-vitest-scaffold.mdrecords the scaffold-visible Vitest alignment for@rawsql-ts/ztd-cli.Scaffold Contract Proof
No-proof rationale: Not applicable.
Non-edit assertion: Existing package.json values are still preserved unless missing or scaffold-owned; the change only updates the scaffold default Vitest version inserted by
ztd init.Fail-fast input-contract proof:
pnpm --filter @rawsql-ts/ztd-cli exec vitest run tests/init.command.test.tspassed, covering init command package generation paths.Generated-output viability proof: ztd-cli pre-commit gate passed
test:essential, including init/scaffold tests, ztd-cli build, and ztd-cli lint.