Update dependency#4348
Conversation
jeradrutnam
added
Type/Improvement
dependencies-approved
trigger-pr-builder
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughWorkspace dependency pins, minimum-version overrides, and a patched ChangesDependency and routing updates
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@samples/apps/wayfinder-sample/frontend/package.json`:
- Around line 18-20: Complete the React Router v8 migration by updating all
existing react-router-dom imports in the frontend package to the corresponding
Router v8 import paths, and raise the react and react-dom dependencies from
^19.1.0 to ^19.2.7. Keep the existing routing behavior unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: a17a07b5-c3b1-4dda-9329-81741cfc2f27
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (4)
pnpm-workspace.yamlsamples/apps/react-vanilla-sample/server/package.jsonsamples/apps/wayfinder-sample/frontend/package.jsonsamples/apps/wayfinder-sample/frontend/src/main.jsx
| "react": "^19.1.0", | ||
| "react-dom": "^19.1.0", | ||
| "react-router-dom": "6.30.4" | ||
| "react-router": "8.3.0" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n --glob '*.{js,jsx,ts,tsx}' \
'from ["'\'']react-router-dom["'\'']|require\(["'\'']react-router-dom["'\'']\)' \
samples/apps/wayfinder-sample/frontend/src
rg -n '"react(-dom)?":|"react-router":' \
samples/apps/wayfinder-sample/frontend/package.jsonRepository: thunder-id/thunderid
Length of output: 1645
🌐 Web query:
React Router 8.3.0 changelog react-router-dom removed requires React 19.2.7 dependency
💡 Result:
The information regarding React Router v8, including the removal of the react-router-dom package and the requirement for React 19.2.7+, is associated with the transition to React Router v8, specifically documented in the v8 release notes rather than exclusively v8.3.0. 1. Removal of react-router-dom: In React Router v8, the react-router-dom package has been removed [1]. While it was maintained in v7 as a convenience layer to ease the upgrade from v6, it is no longer available in v8 [1]. Users must update their imports to use react-router and react-router/dom instead [1]. 2. React 19.2.7 Dependency: React Router v8 introduced a minimum requirement of React 19.2.7 [1]. This is part of the v8 breaking changes and requirements list [1]. 3. Clarification on v8.3.0: React Router v8.3.0 is a specific release within the v8 lifecycle (released around July 22, 2026) [2][3][4]. The changelog for v8.3.0 focuses on minor features, patches, and RSC (React Server Component) updates, such as encoding path parameters per RFC 3986 and using crypto.randomUUID for session IDs [2][3][4]. The architectural changes, such as the removal of react-router-dom and the minimum React 19.2.7 requirement, were introduced as part of the initial v8 release, not as a specific addition or change in v8.3.0 [1].
Citations:
- 1: https://reactrouter.com/dev/changelog
- 2: https://github.com/remix-run/react-router/blob/HEAD/CHANGELOG.md
- 3: https://reactrouter.com/start/start/changelog
- 4: https://reactrouter.com/changelog
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
FILE="samples/apps/wayfinder-sample/frontend/package.json"
echo "package metadata:"
python3 - <<'PY'
import json
from pathlib import Path
p = Path("samples/apps/wayfinder-sample/frontend/package.json")
data = json.loads(p.read_text())
for key in ["name", "type", "dependencies", "devDependencies"]:
if key in data:
print(f"{key}:")
for k, v in data[key].items():
if k in ("react", "react-dom", "react-router") or "react" in k or k.startswith("@"):
print(f" {k}: {v}")
PY
echo
echo "react-router-dom import occurrences in package:"
find samples/apps/wayfinder-sample/frontend/src -type f \( -name '*.js' -o -name '*.jsx' -o -name '*.ts' -o -name '*.tsx' \) -print0 | xargs -0 rg -n 'from ["'"'"']react-router-dom["'"'"']|require\(["'"'"']react-router-dom["'"'"']\)' || true
echo
echo "package-lock references, if present:"
if [ -f samples/apps/wayfinder-sample/frontend/package-lock.json ]; then
rg -n '"react-router-dom"|"react-router"|resolved|version' samples/apps/wayfinder-sample/frontend/package-lock.json | head -80
else
echo "no frontend package-lock.json"
fiRepository: thunder-id/thunderid
Length of output: 309
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
FILE="samples/apps/wayfinder-sample/frontend/package.json"
echo "package.json:"
sed -n '1,120p' "$FILE"
echo
echo "react-router-dom import occurrences under frontend/src:"
find samples/apps/wayfinder-sample/frontend/src -type f \( -name '*.js' -o -name '*.jsx' -o -name '*.ts' -o -name '*.tsx' \) -print0 | xargs -0 rg -n 'from ["'"'"']react-router-dom["'"'"']|require\(["'"'"']react-router-dom["'"'"']\)' || true
echo
echo "lockfile presence:"
if [ -f samples/apps/wayfinder-sample/frontend/package-lock.json ]; then
rg -n '"react-router-dom"|"react-router"|resolved|version' samples/apps/wayfinder-sample/frontend/package-lock.json | head -80 || true
else
echo "no frontend package-lock.json"
fiRepository: thunder-id/thunderid
Length of output: 2261
Complete the React Router 8 migration.
This package now installs react-router@8.3.0, but react-router-dom is no longer provided in Router v8 and the React dependency range still allows 19.1.x, which is below Router’s React 19.2.7 baseline. Move the existing react-router-dom imports to the Router v8 import paths and raise React/React DOM to ^19.2.7.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@samples/apps/wayfinder-sample/frontend/package.json` around lines 18 - 20,
Complete the React Router v8 migration by updating all existing react-router-dom
imports in the frontend package to the corresponding Router v8 import paths, and
raise the react and react-dom dependencies from ^19.1.0 to ^19.2.7. Keep the
existing routing behavior unchanged.
There was a problem hiding this comment.
The import-migration half of this is already done: rg 'react-router-dom' samples/apps/wayfinder-sample/frontend/src returns zero matches, and main.jsx / App.jsx now import from "react-router" directly. The React peer-range point is technically true (declared ^19.1.0 vs react-router@8.3.0 peer >=19.2.7), but pnpm resolves the sample onto react 19.2.3–19.2.7 in practice, so this is not a functional break. Leaving the declared range as is to keep this PR scoped to the security fix.
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "Remaining react-router-dom imports in the Wayfinder frontend source:"
rg -n --glob '*.{js,jsx,ts,tsx}' \
'from\s+["'\'']react-router-dom["'\'']|require\(\s*["'\'']react-router-dom["'\'']\s*\)' \
samples/apps/wayfinder-sample/frontend/src || true
echo
echo "Workspace lockfiles:"
fd -HI '^pnpm-lock\.yaml$|^pnpm-lock\.yml$' .
echo
echo "Wayfinder importer and React/Router resolution context:"
for lockfile in $(fd -HI '^pnpm-lock\.yaml$|^pnpm-lock\.yml$' .); do
echo "--- ${lockfile} ---"
rg -n -A30 -B3 \
'wayfinder-sample/frontend:|react-router@8\.3\.0|react@19\.2|react-dom@19\.2' \
"$lockfile" || true
doneLength of output: 205518
@ThaminduDilshan, thanks, I verified both points.
The import migration is complete, so that portion of my comment does not apply.
However, the committed pnpm-lock.yaml resolves this sample specifically to react@19.2.3 and react-dom@19.2.3, while react-router@8.3.0 declares >=19.2.7 for both peers. Therefore, the current lockfile still has an unsatisfied peer dependency, rather than a compatible 19.2.7 resolution.
Please either update the React and React DOM constraints and lockfile in this PR, or move the Router v8 upgrade to a follow-up scoped with its required React upgrade.
There was a problem hiding this comment.
This is previously tried and has failed the sample startup due to oxygen-ui-icons dependency mismatch. Hence this require bumping that too.
Better to take as a followup
There was a problem hiding this comment.
@ThaminduDilshan, understood. Given the startup regression from the oxygen-ui-icons mismatch, this needs a coordinated dependency upgrade and is reasonable to handle separately from this security-focused PR.
Would you like me to open a GitHub follow-up issue for the React Router v8, React/React DOM, and oxygen-ui-icons compatibility upgrade?
🐇💭
✏️ Learnings added
Learnt from: ThaminduDilshan
Repo: thunder-id/thunderid PR: 4348
File: samples/apps/wayfinder-sample/frontend/package.json:18-20
Timestamp: 2026-07-25T10:37:37.925Z
Learning: In `samples/apps/wayfinder-sample/frontend`, raising React and React DOM to meet React Router v8’s peer requirement requires a coordinated `oxygen-ui-icons` dependency upgrade; attempting the React upgrade alone previously caused sample startup failure due to an oxygen-ui-icons dependency mismatch.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
456cf8c to
e5b0a51
Compare
e5b0a51 to
1b4e7e5
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pnpm-workspace.yaml`:
- Around line 184-185: Update the body-parser override in the workspace
configuration to preserve both supported major ranges while excluding vulnerable
versions: keep 1.x consumers on at least 1.20.6 and 2.x consumers on at least
2.3.0, rather than forcing all consumers to the 2.x range.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 9a76ee01-385a-42c1-806f-b5dbaaef7b5c
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (15)
pnpm-workspace.yamlsamples/apps/react-vanilla-sample/server/package.jsonsamples/apps/wayfinder-sample/frontend/package.jsonsamples/apps/wayfinder-sample/frontend/src/App.jsxsamples/apps/wayfinder-sample/frontend/src/auth/useAuth.jssamples/apps/wayfinder-sample/frontend/src/components/SearchPanel.jsxsamples/apps/wayfinder-sample/frontend/src/main.jsxsamples/apps/wayfinder-sample/frontend/src/pages/AuthPage.jsxsamples/apps/wayfinder-sample/frontend/src/pages/BookingDetailsPageWithAuth.jsxsamples/apps/wayfinder-sample/frontend/src/pages/BookingsPageWithAuth.jsxsamples/apps/wayfinder-sample/frontend/src/pages/FlightDetailsPage.jsxsamples/apps/wayfinder-sample/frontend/src/pages/NativeAuthPage.jsxsamples/apps/wayfinder-sample/frontend/src/pages/NativeVerboseAuthPage.jsxsamples/apps/wayfinder-sample/frontend/src/pages/PaymentPageWithAuth.jsxsamples/apps/wayfinder-sample/frontend/src/pages/ResultsPage.jsx
🚧 Files skipped from review as they are similar to previous changes (3)
- samples/apps/wayfinder-sample/frontend/src/main.jsx
- samples/apps/react-vanilla-sample/server/package.json
- samples/apps/wayfinder-sample/frontend/package.json
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
patches/minimatch@3.1.5.patch (1)
9-10: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winAdd a compatibility smoke test for the patched CJS contract.
Test that the patched
minimatch@3.1.5still handles a brace pattern after workspace resolution, for example{a,b}.js. This guards both patch application and the namedexpandexport boundary documented by brace-expansion 5.x. (npmjs.com)Also applies to: 22-23
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@patches/minimatch`@3.1.5.patch around lines 9 - 10, The patch needs a compatibility smoke test proving minimatch@3.1.5 resolves the patched named expand export and matches a brace pattern such as {a,b}.js. Add a workspace-level CJS test that imports minimatch through its normal package entry point and verifies matching behavior for the brace pattern, covering both patch application and the brace-expansion 5.x export boundary.Source: MCP tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pnpm-workspace.yaml`:
- Around line 127-132: Update the brace-expansion override in the workspace
dependency configuration so version 5.0.8 is only used by consumers compatible
with its named export API. Patch every legacy minimatch variant that directly
calls require('brace-expansion'), including minimatch@3.1.4, or scope the
override to the already patched minimatch@3.1.5 path; do not force
brace-expansion@5.0.8 globally without covering all such consumers.
---
Nitpick comments:
In `@patches/minimatch`@3.1.5.patch:
- Around line 9-10: The patch needs a compatibility smoke test proving
minimatch@3.1.5 resolves the patched named expand export and matches a brace
pattern such as {a,b}.js. Add a workspace-level CJS test that imports minimatch
through its normal package entry point and verifies matching behavior for the
brace pattern, covering both patch application and the brace-expansion 5.x
export boundary.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 99c246f7-adde-41b2-a682-e17f75b8ad72
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
patches/minimatch@3.1.5.patchpnpm-workspace.yaml
fa25474 to
20b8a5a
Compare
About commit 20b8a5a — patching
|
2 participants
This pull request updates several dependencies and overrides across the workspace and sample applications, primarily to ensure security. The most significant changes are focused on upgrading packages to patched versions, improving security, and aligning dependency versions.
Dependency and Security Updates:
dompurifyto version3.4.12and updated its version constraint in both the workspace and sample app. [1] [2] [3]eslintto9.39.5in the workspace.brace-expansionto5.0.8and adjusted allminimatchoverrides. [1] [2] [3]fast-xml-parser,vitest,glob,storybook,rollup,axios,form-data,picomatch,body-parser,webpack-dev-server, andhono. [1] [2]body-parser(version>=2.3.0) in thereact-vanilla-sampleserver app.Dependency Alignment and Compatibility:
react-routerto8.3.0and removedreact-router-domin the wayfinder sample frontend, updating imports inmain.jsxaccordingly. [1] [2]Summary by CodeRabbit
Security
dompurifyandbody-parser).minimatchbehavior via itsbrace-expansionusage.Compatibility
react-routerimports (replacingreact-router-dom) across router setup, navigation, links, and routing hooks.Maintenance
eslint) and adjusted global override rules for transitive dependency ranges.