fix: upgrade esbuild to patch GHSA-67mh-4wv8-2f99#305
Conversation
|
📝 WalkthroughWalkthroughAdded a pnpm override for esbuild, specifying that versions 0.24.2 and below should resolve to version 0.25.0 or higher. This modifies dependency resolution constraints without altering code or dependencies themselves. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
package.json (2)
44-47:⚠️ Potential issue | 🟠 Major
packageManagerversion mismatch: pnpm 10.14.0 specified but documentation requires pnpm 9.x.AGENTS.md and .cursorrules both document pnpm 9.x as the required version, with no changeset or record indicating an intentional upgrade to 10.x. Either update
packageManagertopnpm@9.xfor consistency, or if the upgrade to pnpm 10.x was intentional, document the decision via changeset and update all references in AGENTS.md and .cursorrules.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@package.json` around lines 44 - 47, The packageManager entry in package.json currently reads "pnpm@10.14.0" but AGENTS.md and .cursorrules expect pnpm 9.x; either revert packageManager to "pnpm@9.x" (update the packageManager field in package.json) to match existing docs, or if upgrading to pnpm 10.x was intentional, add a changeset and update AGENTS.md and .cursorrules to document the pnpm 10.x requirement and any migration notes so all references (packageManager, AGENTS.md, .cursorrules) are consistent.
25-36:⚠️ Potential issue | 🟠 MajorCreate a Changeset entry before publishing this change.
No changeset entry currently exists in
.changeset/. Per the coding guidelines, Changesets are required for managing releases; runpnpm changesetbefore publishing to ensure the release notes and version bump reflect this change.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@package.json` around lines 25 - 36, Add a Changeset entry to the repository so this change is tracked for release: run the interactive changeset command (pnpm changeset) and create a new .changeset/* MD file describing the package(s) affected and the desired version bump, then commit that file alongside your changes; ensure the new changeset aligns with the scripts in package.json (notably "changeset", "changeset:version", and "changeset:publish") so CI/release tooling will pick up the bump during pnpm run build && changeset publish.
🧹 Nitpick comments (1)
package.json (1)
64-66: Consider tightening the override target to avoid unintended future breaking upgrades.
">=0.25.0"can float to any future0.xrelease; since esbuild 0.25.0 includes backwards-incompatible changes (includingserve()return shape changes), you may want to cap this to the patched minor line (e.g.^0.25.0which stays<0.26.0) unless you explicitly want to float indefinitely. (newreleases.io)Proposed change (cap to 0.25.x)
"pnpm": { "overrides": { ... - "esbuild@<=0.24.2": ">=0.25.0" + "esbuild@<=0.24.2": "^0.25.0" } }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@package.json` around lines 64 - 66, The override for the esbuild package currently uses a floating range ("esbuild@<=0.24.2": ">=0.25.0") which allows unintended future 0.x upgrades; update that override in package.json to a capped range such as "^0.25.0" (or ">=0.25.0 <0.26.0") so it stays within the 0.25.x line and avoids pulling in breaking changes from 0.26.0 and above.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@package.json`:
- Around line 44-47: The packageManager entry in package.json currently reads
"pnpm@10.14.0" but AGENTS.md and .cursorrules expect pnpm 9.x; either revert
packageManager to "pnpm@9.x" (update the packageManager field in package.json)
to match existing docs, or if upgrading to pnpm 10.x was intentional, add a
changeset and update AGENTS.md and .cursorrules to document the pnpm 10.x
requirement and any migration notes so all references (packageManager,
AGENTS.md, .cursorrules) are consistent.
- Around line 25-36: Add a Changeset entry to the repository so this change is
tracked for release: run the interactive changeset command (pnpm changeset) and
create a new .changeset/* MD file describing the package(s) affected and the
desired version bump, then commit that file alongside your changes; ensure the
new changeset aligns with the scripts in package.json (notably "changeset",
"changeset:version", and "changeset:publish") so CI/release tooling will pick up
the bump during pnpm run build && changeset publish.
---
Nitpick comments:
In `@package.json`:
- Around line 64-66: The override for the esbuild package currently uses a
floating range ("esbuild@<=0.24.2": ">=0.25.0") which allows unintended future
0.x upgrades; update that override in package.json to a capped range such as
"^0.25.0" (or ">=0.25.0 <0.26.0") so it stays within the 0.25.x line and avoids
pulling in breaking changes from 0.26.0 and above.
ℹ️ Review info
Configuration used: defaults
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
package.json
2 participants
What it says on the tin.
Summary by CodeRabbit