-
-
Notifications
You must be signed in to change notification settings - Fork 231
chore(deps): update all non-major dependencies #719
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,9 +14,9 @@ | |
| "devDependencies": { | ||
| "@types/jscodeshift": "^17.1.1", | ||
| "@types/node": "^24.10.1", | ||
| "jscodeshift": "^17.1.1", | ||
| "prettier": "^3.7.4", | ||
| "jscodeshift": "^17.3.0", | ||
| "prettier": "^3.8.4", | ||
| "typescript": "5.9.3", | ||
| "vitest": "^4.0.14" | ||
| "vitest": "^4.1.8" | ||
|
Comment on lines
+17
to
+20
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
# Verify jscodeshift, prettier, and vitest versions exist and check for security issues
echo "=== Checking jscodeshift 17.3.0 ==="
npm view jscodeshift@17.3.0 version 2>/dev/null || echo "Version not found"
echo -e "\n=== Checking prettier 3.8.3 ==="
npm view prettier@3.8.3 version 2>/dev/null || echo "Version not found"
echo -e "\n=== Checking vitest 4.1.8 ==="
npm view vitest@4.1.8 version 2>/dev/null || echo "Version not found"
echo -e "\n=== Checking for security advisories ==="
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: NPM, package: "jscodeshift") {
nodes {
advisory { summary severity publishedAt }
vulnerableVersionRange
firstPatchedVersion { identifier }
}
}
}'
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: NPM, package: "prettier") {
nodes {
advisory { summary severity publishedAt }
vulnerableVersionRange
firstPatchedVersion { identifier }
}
}
}'
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: NPM, package: "vitest") {
nodes {
advisory { summary severity publishedAt }
vulnerableVersionRange
firstPatchedVersion { identifier }
}
}
}'Repository: TanStack/ai Length of output: 1715 🏁 Script executed: #!/bin/bash
set -euo pipefail
# 1) Confirm exact versions in codemods/package.json
if [ -f codemods/package.json ]; then
echo "=== codemods/package.json (lines 1-60) ==="
nl -ba codemods/package.json | sed -n '1,80p'
else
echo "codemods/package.json not found"
exit 1
fi
# 2) Find vitest config / test setup in codemods
echo "=== Search for vitest config in codemods/ ==="
rg -n --hidden --no-ignore \
-S "vitest|test:|describe\(|it\(|setupFiles|globals|environment|ui|server" \
codemods -g'*.ts' -g'*.js' -g'*.mts' -g'*.cts' -g'*.mjs' -g'*.cjs' -g'*.json' -g'*.config.*' -g'*.md' || true
echo "=== Search for vitest.config.* under repo (limited) ==="
fd -t f -H "vitest.config" . || true
fd -t f -H "vite*.config" codemods || trueRepository: TanStack/ai Length of output: 159 🏁 Script executed: #!/bin/bash
set -euo pipefail
# 1) Confirm exact versions in codemods/package.json (use cat -n since nl is unavailable)
if [ -f codemods/package.json ]; then
echo "=== codemods/package.json (lines 1-60) ==="
cat -n codemods/package.json | sed -n '1,80p'
else
echo "codemods/package.json not found"
exit 1
fi
# 2) Search for vitest/test runner config / usage in codemods/
echo "=== Search for vitest/test config keywords in codemods/ ==="
rg -n --hidden --no-ignore \
-S "vitest|test:|describe\(|it\(|setupFiles|globals|environment|ui|server|vitest\.config" \
codemods || trueRepository: TanStack/ai Length of output: 8662 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Check pnpm lockfile to confirm what versions actually resolve for vitest/jscodeshift/prettier
if [ -f pnpm-lock.yaml ]; then
echo "=== pnpm-lock.yaml: resolved vitest/jscodeshift/prettier entries ==="
rg -n "vitest@|jscodeshift@|prettier@" pnpm-lock.yaml | head -n 80
else
echo "pnpm-lock.yaml not found"
fi
# Also look for vitest version specifically (resolved version patterns)
if [ -f pnpm-lock.yaml ]; then
echo "=== Find occurrences of 'vitest:' block (first 120 matches) ==="
rg -n "vitest:" pnpm-lock.yaml | head -n 120
fiRepository: TanStack/ai Length of output: 9774 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== Check pnpm-lock.yaml for resolved vitest@4.1.8 ==="
rg -n "vitest@4\.1\.8" pnpm-lock.yaml || echo "not found"
echo "=== Check pnpm-lock.yaml for resolved prettier@3.8.3 ==="
rg -n "prettier@3\.8\.3" pnpm-lock.yaml || echo "not found"
echo "=== Check pnpm-lock.yaml for codemods package identity ==="
rg -n "`@tanstack/ai-codemods`|ai-codemods" pnpm-lock.yaml | head -n 50
echo "=== Search for vitest config files in repo ==="
fd -t f -H "vitest.config" . || true
fd -t f -H "*vitest*" codemods || true
echo "=== Search codemods/ for vitest --ui / server usage ==="
rg -n --hidden --no-ignore -S "(--ui|ui\.|server|listen\(|createServer|happy-dom|jsdom)" codemods || trueRepository: TanStack/ai Length of output: 246 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== Find `@tanstack/ai-codemods` entries in pnpm-lock.yaml ==="
rg -n "`@tanstack/ai-codemods`" pnpm-lock.yaml | head -n 50
echo "=== Around the ai-codemods block (if present) ==="
# If the lockfile contains a package snapshot for ai-codemods, print a small window around the first match
line=$(rg -n "`@tanstack/ai-codemods`" pnpm-lock.yaml | head -n 1 | cut -d: -f1 || true)
if [ -n "${line:-}" ]; then
start=$((line-40))
if [ $start -lt 1 ]; then start=1; fi
end=$((line+120))
sed -n "${start},${end}p" pnpm-lock.yaml | sed -n '1,200p'
else
echo "No `@tanstack/ai-codemods` string found to window."
fi
echo "=== Search lockfile for prettier@3.8.3 / vitest@4.1.8 occurrences (confirm absence) ==="
rg -n "prettier@3\.8\.3|vitest@4\.1\.8" pnpm-lock.yaml || echo "No exact prettier@3.8.3 or vitest@4.1.8 found"
echo "=== Search codemods for vitest UI/server usage indicators ==="
rg -n --hidden --no-ignore -S "(--ui|vitest.*ui|server\.listen|ui\.listen|createServer|happy-dom|jsdom|listen\()" codemods || trueRepository: TanStack/ai Length of output: 116 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== Check if codemods has its own pnpm-lock.yaml ==="
find . -maxdepth 3 -name "pnpm-lock.yaml" -print
echo "=== Check pnpm-workspace.yaml for codemods ==="
if [ -f pnpm-workspace.yaml ]; then
rg -n "codemods" pnpm-workspace.yaml || echo "No 'codemods' in pnpm-workspace.yaml"
cat -n pnpm-workspace.yaml | sed -n '1,120p'
else
echo "pnpm-workspace.yaml not found"
fi
echo "=== Search for prettier usage in codemods/ ==="
rg -n --hidden --no-ignore -S "prettier" codemods || true
echo "=== Search for vitest config / UI usage in codemods/ ==="
rg -n --hidden --no-ignore -S "vitest\.config|--ui|ui\.|createServer|listen\(" codemods || trueRepository: TanStack/ai Length of output: 2668 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== Find codemods importer block in pnpm-lock.yaml ==="
line=$(rg -n "^\\s*codemods:" pnpm-lock.yaml | head -n 1 | cut -d: -f1 || true)
if [ -n "${line:-}" ]; then
start=$((line-20))
end=$((line+120))
if [ $start -lt 1 ]; then start=1; fi
echo "--- pnpm-lock.yaml lines ${start}-${end} ---"
sed -n "${start},${end}p" pnpm-lock.yaml
else
echo "No 'codemods:' importer key found (lockfile format may differ)."
echo "Searching for 'codemods' occurrences near importer section:"
rg -n "codemods" pnpm-lock.yaml | head -n 20
fi
echo "=== Show which importer brings vitest 4.0.14/4.0.15 (vulnerable by range <4.1.0) ==="
rg -n "vitest@4\.0\.(14|15)|vitest: 4\.0\.(14|15)" pnpm-lock.yaml | head -n 80
echo "=== Show importer blocks that mention vitest (first 120 matches) ==="
rg -n "vitest" pnpm-lock.yaml | head -n 120Repository: TanStack/ai Length of output: 23748 Update
However,
so the dependency bumps in File: "jscodeshift": "^17.3.0",
"prettier": "^3.8.3",
"typescript": "5.9.3",
"vitest": "^4.1.8"🤖 Prompt for AI Agents |
||
| } | ||
| } | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: TanStack/ai
Length of output: 244
Fix pinned
actions/checkoutSHA mismatch (supply-chain risk)In
.github/workflows/sync-models.ymlline 22,actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3does not match thev6.0.3tag commit SHA (9f698171ed81b15d1823a05fc7211befd50c8ae0). Update the pinned SHA (or the comment) so it reflects the realv6.0.3tag.🤖 Prompt for AI Agents