chore: Reduce npm vulnerability and attack surface across workspace#43
Merged
Conversation
WalkthroughThis pull request refactors the project's tooling infrastructure and the playground application. The playground is migrated from Next.js to Vite with React, including updated build configuration, environment variable prefixes (Next.js to Vite), and removal of Next.js-specific files. The linting and formatting tools are replaced from ESLint and Prettier to Biome across the project. GitHub Actions workflows are updated to include linting and type-checking steps prior to build and test execution. Configuration files for the JavaScript package are updated to remove ESLint and Terser dependencies while adding a dedicated build TypeScript configuration. Build outputs are adjusted to reflect the new tooling (from 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@apps/playground/package.json`:
- Line 14: The playground's check-types task fails because it depends only on
upstream check-types and not upstream builds, so `@formbricks/js` .d.ts files are
not produced; update turbo.json so the check-types task (the "check-types" entry
for playground) adds a dependency on upstream builds (e.g., add "^build" to
dependsOn or replace "^check-types" with ["^build","^check-types"]) so that
`@formbricks/js` is built (tsc --project tsconfig.build.json) before running type
checks and the dist/index.d.ts exists.
In `@apps/playground/README.md`:
- Line 13: The ordered list item currently starts with "2. Create a `.env` file
with your Formbricks credentials:" which triggers markdownlint MD029; change the
numbering to start at "1." (or make the whole list use incremental 1., 2., ...
starting from 1) so the list uses correct 1/1/1 style; update the line
containing "2. Create a `.env` file with your Formbricks credentials:"
accordingly (search for that exact string in the README and replace the leading
"2." with "1.").
In `@apps/playground/src/app.tsx`:
- Around line 26-34: The formbricks.setup() conditional silently skips
initialization when import.meta.env.VITE_FORMBRICKS_ENVIRONMENT_ID or
import.meta.env.VITE_FORMBRICKS_API_HOST are missing; update the conditional
around formbricks.setup to log a clear console.warn including the missing
variable names (referencing import.meta.env.VITE_FORMBRICKS_ENVIRONMENT_ID and
import.meta.env.VITE_FORMBRICKS_API_HOST) so developers see a warning when
formbricks.setup is not called and know which env var(s) are unset.
In `@apps/playground/src/index.css`:
- Line 3: Update the inline Sonar suppression comment for the Tailwind custom
variant declaration by adding whitespace inside the comment markers: locate the
`@custom-variant` rule (the token "@custom-variant dark (&:is(.dark *));" in the
file) and change the trailing comment from /*NOSONAR*/ to the spaced form /*
NOSONAR */ so Stylelint stops flagging the missing whitespace.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: f0df178a-f2de-4bca-9446-346a79097e3b
⛔ Files ignored due to path filters (2)
apps/playground/src/assets/fb-setup.pngis excluded by!**/*.pngpnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (37)
.github/workflows/build.yml.github/workflows/lint.yml.github/workflows/release.yml.github/workflows/sonarqube.yml.github/workflows/test.ymlapps/playground/.env.exampleapps/playground/.gitignoreapps/playground/README.mdapps/playground/app/dashboard/page.tsxapps/playground/app/layout.tsxapps/playground/components/layout-app.tsxapps/playground/components/sidebar.tsxapps/playground/eslint.config.mjsapps/playground/globals.cssapps/playground/index.htmlapps/playground/lib/utils.tsapps/playground/next.config.tsapps/playground/package.jsonapps/playground/postcss.config.mjsapps/playground/src/app.tsxapps/playground/src/index.cssapps/playground/src/main.tsxapps/playground/tsconfig.jsonapps/playground/vite.config.tsbiome.jsonpackage.jsonpackages/js/eslint.config.mjspackages/js/package.jsonpackages/js/src/index.test.tspackages/js/src/index.tspackages/js/src/lib/load-formbricks.test.tspackages/js/src/lib/load-formbricks.tspackages/js/src/types/formbricks.tspackages/js/tsconfig.build.jsonpackages/js/tsconfig.jsonpackages/js/vite.config.tsturbo.json
💤 Files with no reviewable changes (10)
- apps/playground/lib/utils.ts
- apps/playground/eslint.config.mjs
- apps/playground/postcss.config.mjs
- apps/playground/components/layout-app.tsx
- apps/playground/next.config.ts
- apps/playground/app/layout.tsx
- apps/playground/components/sidebar.tsx
- apps/playground/globals.css
- apps/playground/app/dashboard/page.tsx
- packages/js/eslint.config.mjs
mattinannt
changed the title
WalkthroughThe pull request migrates the playground application from Next.js to Vite + React, updates GitHub Actions workflows to include linting and type-checking steps, and transitions the entire project from ESLint/Prettier to Biome for code quality tooling. Configuration files are updated across the workspace, including TypeScript, Vite, and Biome setup. Environment variable naming conventions change from NEXT_PUBLIC_ prefixes to VITE_ prefixes in the playground. Multiple Next.js-specific files are removed, and the CI/CD pipelines are refined to validate code quality earlier in the build process. Node.js version constraints are updated to require 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 7
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/lint.yml:
- Around line 34-38: Add a pnpm cache restore/save step so CI doesn't reinstall
deps every run: before the "Install dependencies" step (and after "Install
pnpm") add a cache action that restores the pnpm store and node_modules (or use
actions/setup-node with cache: 'pnpm'), keyed by OS and pnpm-lock.yaml integrity
hash, and update the "Install dependencies" step to run only after cache
restore; reference the existing step names "Install pnpm" and "Install
dependencies" so the new cache restore/save steps integrate in that location.
In `@AGENTS.md`:
- Line 3: Add a single blank line after every Markdown section heading in
AGENTS.md (e.g., after "Project Structure & Module Organization" and the other
top-level section headings) so each heading is followed by one empty line;
update each heading occurrence to ensure exactly one blank line separates the
heading from the following paragraph or list and remove any extra or missing
newlines to conform to standard Markdown rendering.
- Line 4: The AGENTS.md contains several very dense paragraphs (e.g., the one
starting "This repository is a `pnpm` workspace..." and the long paragraphs
later) that should be split into concise bullet lists or shorter paragraphs for
scannability; update AGENTS.md by replacing each long paragraph with 3–6 bullet
points that surface key facts (workspace layout, where SDK source and helpers
live, demo app purpose, and which generated outputs should not be edited), do
the same for the other dense paragraphs called out in the review, and ensure
each bullet is one concise sentence and uses consistent punctuation and parallel
phrasing for easier scanning.
In `@apps/playground/README.md`:
- Line 13: Update the ordered-list numbering to use the "1." prefix style
required by markdownlint (MD029); specifically change the list item text that
currently starts with "2. Create a `.env` file with your Formbricks
credentials:" to start with "1. Create a `.env` file with your Formbricks
credentials:" so the entire ordered list uses the repeated "1." style expected
by the linter.
In `@apps/playground/src/app.tsx`:
- Around line 74-77: The displayed environment ID
(import.meta.env.VITE_FORMBRICKS_ENVIRONMENT_ID) can be empty/undefined; update
the UI where the <strong> renders that value to use a clear fallback (e.g., "Not
configured" or "—") or hide the element when the value is falsy so users aren't
shown an empty/undefined string; change the rendering logic around the element
that currently uses import.meta.env.VITE_FORMBRICKS_ENVIRONMENT_ID to
conditionally render the fallback text or omit the node when the env value is
falsy.
In `@apps/playground/tsconfig.json`:
- Around line 14-16: TypeScript path alias "@formbricks/js" in tsconfig.json is
only used at compile-time and won't resolve in Vite; update the Vite config to
mirror that mapping by adding a resolve.alias entry for "@formbricks/js"
pointing to the same target (the package's src index) or install and enable the
vite-tsconfig-paths plugin in vite.config.ts so Vite's module resolver uses the
tsconfig paths; modify the file that exports defineConfig (vite.config.ts) to
include either a resolve.alias with "@formbricks/js" -> the
"../../packages/js/src/index.ts" absolute path (using node:path.resolve) or add
the vite-tsconfig-paths plugin to plugins.
In `@packages/js/tsconfig.build.json`:
- Around line 24-25: The tsconfig currently sets both "strict": true and
"strictNullChecks": true which is redundant; remove the explicit
"strictNullChecks" property so only "strict": true remains (keep the "strict"
key in the same object) to avoid duplicate/unused config entries and rely on
"strict" to enable null-checking and other strict flags.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: b9d9b00f-4695-4522-aabb-e836012dbbba
⛔ Files ignored due to path filters (2)
apps/playground/src/assets/fb-setup.pngis excluded by!**/*.pngpnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (38)
.github/workflows/build.yml.github/workflows/lint.yml.github/workflows/release.yml.github/workflows/sonarqube.yml.github/workflows/test.ymlAGENTS.mdapps/playground/.env.exampleapps/playground/.gitignoreapps/playground/README.mdapps/playground/app/dashboard/page.tsxapps/playground/app/layout.tsxapps/playground/components/layout-app.tsxapps/playground/components/sidebar.tsxapps/playground/eslint.config.mjsapps/playground/globals.cssapps/playground/index.htmlapps/playground/lib/utils.tsapps/playground/next.config.tsapps/playground/package.jsonapps/playground/postcss.config.mjsapps/playground/src/app.tsxapps/playground/src/index.cssapps/playground/src/main.tsxapps/playground/tsconfig.jsonapps/playground/vite.config.tsbiome.jsonpackage.jsonpackages/js/eslint.config.mjspackages/js/package.jsonpackages/js/src/index.test.tspackages/js/src/index.tspackages/js/src/lib/load-formbricks.test.tspackages/js/src/lib/load-formbricks.tspackages/js/src/types/formbricks.tspackages/js/tsconfig.build.jsonpackages/js/tsconfig.jsonpackages/js/vite.config.tsturbo.json
💤 Files with no reviewable changes (10)
- apps/playground/lib/utils.ts
- apps/playground/globals.css
- apps/playground/next.config.ts
- apps/playground/postcss.config.mjs
- apps/playground/components/layout-app.tsx
- apps/playground/eslint.config.mjs
- apps/playground/app/layout.tsx
- packages/js/eslint.config.mjs
- apps/playground/app/dashboard/page.tsx
- apps/playground/components/sidebar.tsx
|
jobenjada
approved these changes
Mar 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR reduces the npm vulnerability and attack surface of the workspace by simplifying the frontend/tooling stack and removing avoidable dependencies from both the app and the SDK package.
What changed
apps/playgroundfrom Next.js to Vite + Reactvite-plugin-dtswith plaintscdeclaration emit in@formbricks/js@formbricks/jsand use Vite's default minifierbuild,lint, andtestworkflows, and enforce lint/typecheck in CI and releaseAttack surface reduction
apps/playgroundvite-plugin-dtsand its API Extractor / Vue language-core dependency chain from the SDK buildEstimated magnitude
pnpm audit --jsonis now clean with0vulnerabilitiesValidation
pnpm lintpnpm check-typespnpm buildpnpm testpnpm audit --jsoncd packages/js && npm pack --dry-run