Skip to content

chore(deps): enroll 47 third-party packages into Bun workspace catalog#2416

Merged
andrew-bierman merged 5 commits into
mainfrom
chore/enroll-catalog-candidates
May 14, 2026
Merged

chore(deps): enroll 47 third-party packages into Bun workspace catalog#2416
andrew-bierman merged 5 commits into
mainfrom
chore/enroll-catalog-candidates

Conversation

@andrew-bierman

@andrew-bierman andrew-bierman commented May 13, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Enrolled 47 third-party packages from CATALOG CANDIDATE warnings into the Bun workspace catalog — one source of truth for third-party dep versions across all workspaces
  • Removed stale standalone apps/guides/bun.lock (my-v0-project) that predated the monorepo and caused CF Pages catalog resolution failures
  • Fixed Cloudflare Pages: packrat-guides preinstall hook error message to show the exact CF Pages dashboard path when PACKRAT_NATIVEWIND_UI_GITHUB_TOKEN is missing
  • Fixed Cloudflare Pages: packrat-api deploy failure — wrangler.jsonc had cpu_ms: 400000 but Cloudflare's hard cap is 300,000 ms (error code 10206)

Acceptance criteria

  • bun ./scripts/lint/no-duplicate-deps.ts0 CATALOG CANDIDATES for third-party packages ✅
  • 0 CATALOG VIOLATIONS, 0 VERSION MISMATCHES
  • bun run check-types exits 0 ✅
  • bun install re-run to sync lockfile ✅

Post-Deploy Monitoring & Validation

  • What to monitor: Worker CPU metrics in the CF dashboard after the cpu_ms cap change; confirm the API worker deploys without error 10206
  • Expected healthy behavior: wrangler deploy completes; Worker CPU limit shows 300 s in the dashboard
  • Failure signal: Error 10206 on next manual deploy → recheck wrangler.jsonc limits.cpu_ms
  • Validation window: Next deploy after merge
  • No runtime impact from the catalog-only dependency changes (no code paths changed)

Compound Engineered 🤖 Generated with Claude Code

Copilot AI review requested due to automatic review settings May 13, 2026 06:36
@coderabbitai

coderabbitai Bot commented May 13, 2026

Copy link
Copy Markdown
Contributor

Walkthrough

This PR converts 47 third-party packages from pinned versions to a centralized Bun workspace catalog, updates .github/scripts/configure-deps.ts to detect Cloudflare Pages and emit CF-specific missing-token instructions, expands the root package.json catalog, and migrates 19 workspace package.json files to use catalog:.

Changes

Catalog System Enrollment

Layer / File(s) Summary
CI Build Environment Detection
.github/scripts/configure-deps.ts
Adds isCFPages() (detects CF_PAGES === '1') and branches the missing-token CI message to provide Cloudflare Pages-specific secret setup instructions.
Root Catalog Definition
package.json
Expands the root catalog to include many runtime/dev/type packages (47 new catalog entries) used across apps and packages.
Application Workspaces Migration
apps/admin/package.json, apps/expo/package.json, apps/guides/package.json, apps/landing/package.json, apps/trails/package.json, apps/web/package.json
Migrate app workspaces to reference catalog: for dependencies and devDependencies (React/Next/TanStack/UI, tooling, and types), preserving a few explicit ranges where noted.
Package Workspaces Migration
packages/analytics/package.json, packages/api/package.json, packages/app/package.json, packages/cli/package.json, packages/mcp/package.json, packages/osm-db/package.json, packages/osm-import/package.json, packages/overpass/package.json, packages/units/package.json, packages/web-ui/package.json
Migrate package workspaces to catalog: for dependencies, devDependencies, and peerDependencies (DB drivers, CLIs, types, test tooling, UI libs).
Catalog Enrollment Plan Documentation
docs/plans/2026-05-13-chore-enroll-catalog-candidates-plan.md
Adds plan detailing the 47 catalog candidates, acceptance criteria, enrollment steps, and verification checklist.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

Suggested labels

ci/cd

Suggested reviewers

  • mikib0
  • Isthisanmol
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title directly and clearly describes the main change: moving 47 third-party packages into the Bun workspace catalog. It accurately reflects the primary objective demonstrated in the raw summary.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch chore/enroll-catalog-candidates

Warning

Review ran into problems

🔥 Problems

Stopped waiting for pipeline failures after 30000ms. One of your pipelines takes longer than our 30000ms fetch window to run, so review may not consider pipeline-failure results for inline comments if any failures occurred after the fetch window. Increase the timeout if you want to wait longer or run a @coderabbit review after the pipeline has finished.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions github-actions Bot added documentation Improvements or additions to documentation dependencies Pull requests that update a dependency file api mobile web labels May 13, 2026
@github-actions

github-actions Bot commented May 13, 2026

Copy link
Copy Markdown
Contributor

Coverage Report for Expo Unit Tests Coverage (./apps/expo)

Status Category Percentage Covered / Total
🔵 Lines 82.61% 480 / 581
🔵 Statements 82.61% (🎯 75%) 480 / 581
🔵 Functions 92.59% 50 / 54
🔵 Branches 90.9% 170 / 187
File CoverageNo changed files found.
Generated in workflow #1216 for commit f16805f by the Vitest Coverage Report Action

@github-actions

github-actions Bot commented May 13, 2026

Copy link
Copy Markdown
Contributor

Coverage Report for API Unit Tests Coverage (./packages/api)

Status Category Percentage Covered / Total
🔵 Lines 76.17% 502 / 659
🔵 Statements 76.17% (🎯 65%) 502 / 659
🔵 Functions 95% 38 / 40
🔵 Branches 88.67% 227 / 256
File CoverageNo changed files found.
Generated in workflow #1216 for commit f16805f by the Vitest Coverage Report Action

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented May 13, 2026

Copy link
Copy Markdown
Contributor

Deploying packrat-landing with  Cloudflare Pages  Cloudflare Pages

Latest commit: b2fe566
Status: ✅  Deploy successful!
Preview URL: https://05c3f720.packrat-landing.pages.dev
Branch Preview URL: https://chore-enroll-catalog-candida.packrat-landing.pages.dev

View logs

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented May 13, 2026

Copy link
Copy Markdown
Contributor

Deploying packrat-guides with  Cloudflare Pages  Cloudflare Pages

Latest commit: b2fe566
Status: ✅  Deploy successful!
Preview URL: https://3d08e3aa.packrat-guides-6gq.pages.dev
Branch Preview URL: https://chore-enroll-catalog-candida.packrat-guides-6gq.pages.dev

View logs

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented May 13, 2026

Copy link
Copy Markdown
Contributor

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs
packrat-admin b2fe566 Commit Preview URL

Branch Preview URL
May 14 2026, 02:27 PM

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR centralizes shared third-party dependency versions by enrolling additional “catalog candidate” packages into Bun’s root workspace catalog, replacing repeated pinned versions across multiple workspace package.json files with "catalog:" to prevent version drift.

Changes:

  • Expanded the root package.json "catalog" with additional shared third-party dependencies.
  • Updated multiple workspace manifests to reference shared versions via "catalog:" instead of explicit version strings.
  • Regenerated bun.lock and added a planning doc describing the enrollment process and acceptance criteria.

Reviewed changes

Copilot reviewed 18 out of 19 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
packages/web-ui/package.json Switches shared UI deps (and some peers/dev deps) to "catalog:" references.
packages/units/package.json Moves vitest to "catalog:" for shared test tooling consistency.
packages/overpass/package.json Moves vitest to "catalog:" for shared test tooling consistency.
packages/osm-import/package.json Moves pg to "catalog:" to centralize DB driver versioning.
packages/osm-db/package.json Moves DB/runtime deps (pg, ws, drizzle, neon) to "catalog:" and catalogs drizzle-kit.
packages/mcp/package.json Switches shared Cloudflare/vitest/wrangler deps to "catalog:".
packages/cli/package.json Switches shared deps (e.g., @duckdb/node-api, consola, @types/bun) to "catalog:".
packages/app/package.json Moves shared state/query deps to "catalog:" (deps + peers).
packages/api/package.json Moves shared infra deps (@neondatabase/serverless, pg, ws, vitest tooling, etc.) to "catalog:".
packages/analytics/package.json Switches shared deps and test tooling to "catalog:".
package.json Adds new catalog entries for shared third-party deps (now used across workspaces).
docs/plans/2026-05-13-chore-enroll-catalog-candidates-plan.md Documents the catalog enrollment plan, rationale, and acceptance criteria.
bun.lock Updates lockfile to reflect catalog-based dependency specs and resolved versions.
apps/web/package.json Switches shared web app deps (next, query tooling, styles tooling) to "catalog:".
apps/trails/package.json Switches shared trails app deps (Next/UI/map deps + dev tooling) to "catalog:".
apps/landing/package.json Switches shared landing app deps (form/UI/style tooling) to "catalog:".
apps/guides/package.json Switches shared guides app deps (AI SDK, UI tooling, style tooling) to "catalog:".
apps/expo/package.json Switches shared Expo deps and test tooling to "catalog:".
apps/admin/package.json Switches shared admin app deps (Next/UI/map deps + dev tooling) to "catalog:".
Comments suppressed due to low confidence (1)

docs/plans/2026-05-13-chore-enroll-catalog-candidates-plan.md:59

  • @types/bun is listed with version latest, which is not a pinned version and can change over time. To keep installs deterministic and align with the catalog’s purpose, consider replacing latest with a specific version (matching what bun.lock resolved).
| `@tanstack/react-query` | `^5.70.0` | apps/web, apps/admin, apps/expo, apps/guides, packages/app |
| `@tanstack/react-query-devtools` | `^5.70.0` | apps/web, apps/guides |
| `@types/bun` | `latest` | packages/cli, packages/api, packages/analytics |
| `@types/leaflet` | `^1.9.21` | apps/trails, apps/admin, apps/expo |

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread package.json
"@radix-ui/react-tooltip": "^1.2.7",
"@tanstack/react-query": "^5.70.0",
"@tanstack/react-query-devtools": "^5.70.0",
"@types/bun": "latest",
Comment on lines +43 to +44
All 47 are currently at a **consistent version** across all workspaces (no mismatches), so the
catalog version is simply the existing pinned string.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/plans/2026-05-13-chore-enroll-catalog-candidates-plan.md`:
- Around line 29-36: The markdown in
docs/plans/2026-05-13-chore-enroll-catalog-candidates-plan.md has fenced JSON
blocks that lack surrounding blank lines which triggers markdownlint MD031; add
a blank line before and after each fenced code block (the block containing
"package-name": "^x.y.z" and the block containing "package-name": "catalog:") so
each fenced ```json ... ``` is separated by an empty line from the surrounding
list items and paragraphs.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: c41c41b4-8203-4d78-a0c8-34ff1a3cbabf

📥 Commits

Reviewing files that changed from the base of the PR and between 44534b1 and 7871c15.

⛔ Files ignored due to path filters (2)
  • apps/guides/bun.lock is excluded by !**/*.lock
  • bun.lock is excluded by !**/*.lock, !bun.lock
📒 Files selected for processing (19)
  • .github/scripts/configure-deps.ts
  • apps/admin/package.json
  • apps/expo/package.json
  • apps/guides/package.json
  • apps/landing/package.json
  • apps/trails/package.json
  • apps/web/package.json
  • docs/plans/2026-05-13-chore-enroll-catalog-candidates-plan.md
  • package.json
  • packages/analytics/package.json
  • packages/api/package.json
  • packages/app/package.json
  • packages/cli/package.json
  • packages/mcp/package.json
  • packages/osm-db/package.json
  • packages/osm-import/package.json
  • packages/overpass/package.json
  • packages/units/package.json
  • packages/web-ui/package.json

Comment on lines +29 to +36
1. Add an entry to the `"catalog"` object in root `package.json`:
```json
"package-name": "^x.y.z"
```
2. In every workspace `package.json` that pins that dep, replace the explicit version with:
```json
"package-name": "catalog:"
```

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add blank lines around fenced JSON blocks to clear markdownlint MD031.

Lines 30–32 and 34–36 need surrounding blank lines; otherwise docs lint can fail.

Suggested fix
 1. Add an entry to the `"catalog"` object in root `package.json`:
+
    ```json
    "package-name": "^x.y.z"
    ```
+
 2. In every workspace `package.json` that pins that dep, replace the explicit version with:
+
    ```json
    "package-name": "catalog:"
    ```
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
1. Add an entry to the `"catalog"` object in root `package.json`:
```json
"package-name": "^x.y.z"
```
2. In every workspace `package.json` that pins that dep, replace the explicit version with:
```json
"package-name": "catalog:"
```
1. Add an entry to the `"catalog"` object in root `package.json`:
🧰 Tools
🪛 markdownlint-cli2 (0.22.1)

[warning] 30-30: Fenced code blocks should be surrounded by blank lines

(MD031, blanks-around-fences)


[warning] 32-32: Fenced code blocks should be surrounded by blank lines

(MD031, blanks-around-fences)


[warning] 34-34: Fenced code blocks should be surrounded by blank lines

(MD031, blanks-around-fences)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/plans/2026-05-13-chore-enroll-catalog-candidates-plan.md` around lines
29 - 36, The markdown in
docs/plans/2026-05-13-chore-enroll-catalog-candidates-plan.md has fenced JSON
blocks that lack surrounding blank lines which triggers markdownlint MD031; add
a blank line before and after each fenced code block (the block containing
"package-name": "^x.y.z" and the block containing "package-name": "catalog:") so
each fenced ```json ... ``` is separated by an empty line from the surrounding
list items and paragraphs.

andrew-bierman and others added 4 commits May 14, 2026 08:25
Move all CATALOG CANDIDATE dependencies (same version pinned in 2+ workspaces)
into the root catalog section. Replace pinned version strings with "catalog:"
in 16 workspace package.json files (164 replacements total).

Root catalog grows from 46 → 93 entries. The no-duplicate-deps pre-push check
now shows 0 third-party candidates; only workspace:* internal refs remain
(intentional — they use the workspace protocol, not semver).
…atalog resolution

apps/guides/bun.lock was created in isolation ('my-v0-project') and didn't
understand catalog: entries from the monorepo root. CF Pages found this file
and tried to install against it, failing to resolve the new catalog: deps.
Deleting it lets CF Pages use the root bun.lock like all other apps.
…ges token

When packrat-guides builds on Cloudflare Pages and PACKRAT_NATIVEWIND_UI_GITHUB_TOKEN
is absent, the preinstall hook now prints the exact CF Pages dashboard path to add it,
rather than the generic CI secrets message.

Root cause of packrat-guides CF Pages failure since c29d174: the token was removed
or expired in the CF Pages project environment variables. Fix: add
PACKRAT_NATIVEWIND_UI_GITHUB_TOKEN (GitHub PAT with read:packages scope) to the
packrat-guides CF Pages project settings.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
…uides

Pre-push hook caught that apps/landing and apps/guides were pinning
vitest@~3.1.4 directly instead of referencing the workspace catalog entry.
@andrew-bierman andrew-bierman force-pushed the chore/enroll-catalog-candidates branch from 7871c15 to b2fe566 Compare May 14, 2026 14:26
@github-actions github-actions Bot added the ci/cd label May 14, 2026
Cloudflare Workers enforces a hard cap of 300,000 ms (code: 10206).
The previous value of 400,000 ms caused every wrangler deploy to fail.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

♻️ Duplicate comments (1)
docs/plans/2026-05-13-chore-enroll-catalog-candidates-plan.md (1)

29-36: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add blank lines around fenced JSON blocks to clear markdownlint MD031.

The fenced code blocks at lines 30–32 and 34–36 still need surrounding blank lines to satisfy MD031.

📝 Proposed fix
 1. Add an entry to the `"catalog"` object in root `package.json`:
+
    ```json
    "package-name": "^x.y.z"
    ```
+
 2. In every workspace `package.json` that pins that dep, replace the explicit version with:
+
    ```json
    "package-name": "catalog:"
    ```
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/plans/2026-05-13-chore-enroll-catalog-candidates-plan.md` around lines
29 - 36, The Markdown fenced JSON blocks containing `"package-name": "^x.y.z"`
and `"package-name": "catalog:"` lack blank lines before and after which
triggers markdownlint MD031; edit the document to insert a blank line above the
opening ```json fence and a blank line below the closing ``` fence for both
fenced blocks so each code block is separated from surrounding text (preserve
the exact code inside the fences).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/scripts/configure-deps.ts:
- Line 58: The hardcoded Cloudflare Pages project name "packrat-guides" in the
string on configure-deps.ts should be made generic or dynamic: update the array
entry that currently contains '  dash.cloudflare.com → Pages → packrat-guides →
Settings → Environment variables' to either a generic path like ' 
dash.cloudflare.com → Pages → <project> → Settings → Environment variables' or
construct it with the CF_PAGES_PROJECT_NAME env var (e.g. use
process.env.CF_PAGES_PROJECT_NAME with a sensible fallback) so the navigation
instruction is correct for other apps.

In `@docs/plans/2026-05-13-chore-enroll-catalog-candidates-plan.md`:
- Line 58: Replace the floating `latest` spec for the dependency `@types/bun`
with the actual resolved version currently used across workspaces (e.g., the
version shown in lockfile or node_modules) and update the dependency entries in
the catalog and the affected package.json files (packages/cli, packages/api,
packages/analytics) to that exact version string; locate the `@types/bun` row in
the catalog table and the dependency entries in each package's package.json (or
the central catalog mechanism you use) and change `latest` to the pinned version
(e.g., "1.2.3") so installs are deterministic.

In `@package.json`:
- Line 81: Update the dependency spec for the `@duckdb/node-api` package to use a
pre-release range operator so minor/patch pre-release updates are allowed;
change the version string for the "@duckdb/node-api" entry in package.json to
use a tilde pre-release range (e.g., ~1.5.0-r.1) if you want to permit
patch-level updates within the 1.5.0-r series, or else add an inline comment
next to the "@duckdb/node-api" key documenting why an exact pin is required for
this native module and leave it as-is.
- Line 120: Replace the non-reproducible version specifier "latest" for the
`@types/bun` dependency in package.json with a pinned range such as "^1.2.17" (or
the exact version you currently have in root devDependencies); open
package.json, locate the dependency key "@types/bun" and change its value from
"latest" to the chosen caret/tilde or exact version string, then run an install
to update the lockfile to ensure deterministic installs.

---

Duplicate comments:
In `@docs/plans/2026-05-13-chore-enroll-catalog-candidates-plan.md`:
- Around line 29-36: The Markdown fenced JSON blocks containing `"package-name":
"^x.y.z"` and `"package-name": "catalog:"` lack blank lines before and after
which triggers markdownlint MD031; edit the document to insert a blank line
above the opening ```json fence and a blank line below the closing ``` fence for
both fenced blocks so each code block is separated from surrounding text
(preserve the exact code inside the fences).
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: f83aedcb-f4a2-4515-9e8b-d938935f069e

📥 Commits

Reviewing files that changed from the base of the PR and between 7871c15 and b2fe566.

⛔ Files ignored due to path filters (2)
  • apps/guides/bun.lock is excluded by !**/*.lock
  • bun.lock is excluded by !**/*.lock, !bun.lock
📒 Files selected for processing (19)
  • .github/scripts/configure-deps.ts
  • apps/admin/package.json
  • apps/expo/package.json
  • apps/guides/package.json
  • apps/landing/package.json
  • apps/trails/package.json
  • apps/web/package.json
  • docs/plans/2026-05-13-chore-enroll-catalog-candidates-plan.md
  • package.json
  • packages/analytics/package.json
  • packages/api/package.json
  • packages/app/package.json
  • packages/cli/package.json
  • packages/mcp/package.json
  • packages/osm-db/package.json
  • packages/osm-import/package.json
  • packages/overpass/package.json
  • packages/units/package.json
  • packages/web-ui/package.json

console.error(`❌ ${TOKEN_VAR} not found in Cloudflare Pages build environment.`);
console.error('Add it as an environment variable in the CF Pages project settings:');
console.error(
' dash.cloudflare.com → Pages → packrat-guides → Settings → Environment variables',

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Hardcoded CF Pages project name may cause confusion.

Line 58 hardcodes "packrat-guides" in the navigation path. If other apps in this monorepo are also deployed to CF Pages, this instruction will be incorrect for those builds.

CF Pages typically provides a CF_PAGES_PROJECT_NAME environment variable. Consider either:

  1. Dynamically inserting the project name from the environment
  2. Making the path generic without a specific project name
📝 Proposed fix to make the path generic
-      console.error(
-        '  dash.cloudflare.com → Pages → packrat-guides → Settings → Environment variables',
-      );
+      console.error(
+        '  dash.cloudflare.com → Pages → [your-project] → Settings → Environment variables',
+      );

Or with dynamic project name:

       console.error('Add it as an environment variable in the CF Pages project settings:');
+      const projectName = process.env.CF_PAGES_PROJECT_NAME || '[your-project]';
       console.error(
-        '  dash.cloudflare.com → Pages → packrat-guides → Settings → Environment variables',
+        `  dash.cloudflare.com → Pages → ${projectName} → Settings → Environment variables`,
       );
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/scripts/configure-deps.ts at line 58, The hardcoded Cloudflare Pages
project name "packrat-guides" in the string on configure-deps.ts should be made
generic or dynamic: update the array entry that currently contains ' 
dash.cloudflare.com → Pages → packrat-guides → Settings → Environment variables'
to either a generic path like '  dash.cloudflare.com → Pages → <project> →
Settings → Environment variables' or construct it with the CF_PAGES_PROJECT_NAME
env var (e.g. use process.env.CF_PAGES_PROJECT_NAME with a sensible fallback) so
the navigation instruction is correct for other apps.

| `@neondatabase/serverless` | `^1.0.0` | packages/api, packages/osm-db |
| `@tanstack/react-query` | `^5.70.0` | apps/web, apps/admin, apps/expo, apps/guides, packages/app |
| `@tanstack/react-query-devtools` | `^5.70.0` | apps/web, apps/guides |
| `@types/bun` | `latest` | packages/cli, packages/api, packages/analytics |

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Pin @types/bun to a specific version instead of latest.

The catalog's purpose is to ensure version consistency across workspaces. Specifying latest defeats this guarantee because each bun install can resolve to a different version, causing silent drift between environments.

🔧 Suggested fix

Determine the current resolved version of @types/bun across the workspaces and pin it explicitly:

-| `@types/bun` | `latest` | packages/cli, packages/api, packages/analytics |
+| `@types/bun` | `^1.2.3` | packages/cli, packages/api, packages/analytics |

Replace ^1.2.3 with the actual version currently in use. If you want to stay on the latest types, manually bump the pinned version when upgrading Bun rather than using the floating latest tag.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
| `@types/bun` | `latest` | packages/cli, packages/api, packages/analytics |
| `@types/bun` | `^1.2.3` | packages/cli, packages/api, packages/analytics |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/plans/2026-05-13-chore-enroll-catalog-candidates-plan.md` at line 58,
Replace the floating `latest` spec for the dependency `@types/bun` with the
actual resolved version currently used across workspaces (e.g., the version
shown in lockfile or node_modules) and update the dependency entries in the
catalog and the affected package.json files (packages/cli, packages/api,
packages/analytics) to that exact version string; locate the `@types/bun` row in
the catalog table and the dependency entries in each package's package.json (or
the central catalog mechanism you use) and change `latest` to the pinned version
(e.g., "1.2.3") so installs are deterministic.

Comment thread package.json
"catalog": {
"@ai-sdk/openai": "^3.0.53",
"@cloudflare/workers-types": "^4.20250405.0",
"@duckdb/node-api": "1.5.0-r.1",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial | 💤 Low value

Consider adding a range operator to the pre-release pin.

@duckdb/node-api is the only catalog entry without a version-range operator (all others use ^ or ~). If you want to allow patch updates within the 1.5.0-r pre-release series, use ~1.5.0-r.1. If you need an exact pin because this is a fragile native module, document that intent in a comment or keep as-is.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 81, Update the dependency spec for the `@duckdb/node-api`
package to use a pre-release range operator so minor/patch pre-release updates
are allowed; change the version string for the "@duckdb/node-api" entry in
package.json to use a tilde pre-release range (e.g., ~1.5.0-r.1) if you want to
permit patch-level updates within the 1.5.0-r series, or else add an inline
comment next to the "@duckdb/node-api" key documenting why an exact pin is
required for this native module and leave it as-is.

Comment thread package.json
"@radix-ui/react-tooltip": "^1.2.7",
"@tanstack/react-query": "^5.70.0",
"@tanstack/react-query-devtools": "^5.70.0",
"@types/bun": "latest",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Replace "latest" with a pinned version range.

Using "latest" for @types/bun makes the lockfile non-reproducible—different installs may resolve different versions. Pin to a specific range (e.g., "^1.2.17" to match your current root devDependency, or use a caret/tilde range if you want updates within bounds).

📌 Proposed fix
-    "@types/bun": "latest",
+    "@types/bun": "^1.2.17",
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"@types/bun": "latest",
"@types/bun": "^1.2.17",
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 120, Replace the non-reproducible version specifier
"latest" for the `@types/bun` dependency in package.json with a pinned range such
as "^1.2.17" (or the exact version you currently have in root devDependencies);
open package.json, locate the dependency key "@types/bun" and change its value
from "latest" to the chosen caret/tilde or exact version string, then run an
install to update the lockfile to ensure deterministic installs.

@andrew-bierman andrew-bierman merged commit feb909d into main May 14, 2026
12 of 14 checks passed
@andrew-bierman andrew-bierman deleted the chore/enroll-catalog-candidates branch May 14, 2026 14:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

api ci/cd dependencies Pull requests that update a dependency file documentation Improvements or additions to documentation mobile web

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants