chore(deps): bump the frontend-npm group across 1 directory with 7 updates - #1230
chore(deps): bump the frontend-npm group across 1 directory with 7 updates#1230dependabot[bot] wants to merge 8 commits into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
📝 WalkthroughWalkthroughFrontend dependency constraints were updated for ChangesFrontend governance repair
Estimated code review effort: 4 (Complex) | ~45 minutes Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
PR governance metadata gate is not ready for
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@frontend/package.json`:
- Line 45: Update the postcss workspace override in pnpm-workspace.yaml to
8.5.25, regenerate and commit the corresponding pnpm-lock.yaml, then verify the
dependency resolution with a frozen install using pnpm 11.5.3.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 7ffef09f-658c-47f2-bd50-76912447084c
⛔ Files ignored due to path filters (1)
frontend/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
frontend/package.json
|
@jules Repair this Dependabot group in place without adding workflow files and without merging it. The current diff is not merge-ready: it still raises ESLint from 9.39.5 to 10.8.0, and it updates PostCSS only in Required final state:
Leave the PR draft if any peer/dependency incompatibility or test failure remains. Otherwise mark it ready for independent review, but do not merge it. |
e28e5ee to
6cd0d35
Compare
6cd0d35 to
00397fe
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@frontend/pnpm-workspace.yaml`:
- Line 18: Update the expected PostCSS version values in the governance checks
within test_release_governance.py from 8.5.24 to 8.5.25, while preserving the
existing resolutions.postcss requirement.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 02fee735-cca4-4b6b-b9d0-9f4d5c4941a1
⛔ Files ignored due to path filters (1)
frontend/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
frontend/package.jsonfrontend/pnpm-workspace.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
- frontend/package.json
|
@dependabot rebase |
|
Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry! If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
@opencode-agent @cwl-noema-review @coderabbitai review Review exact current head only. Verify pnpm lock reproducibility, PostCSS security override alignment, supported ESLint/Next.js compatibility, frozen install, tests, lint, typecheck, coverage, production build, and absence of unrelated dependency or credential changes. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '=== PR metadata ==='
gh pr view 1230 --repo ContextualWisdomLab/naruon \
--json number,state,isDraft,baseRefName,headRefName,headRefOid,title,body,files \
--jq '{number,state,isDraft,baseRefName,headRefName,headRefOid,title,body,files:[.files[].path]}'
echo '=== exact changed files and diff stat ==='
git diff --name-status origin/develop...HEAD
git diff --stat origin/develop...HEAD
echo '=== exact dependency diff ==='
git diff --no-ext-diff --unified=80 origin/develop...HEAD -- \
frontend/package.json frontend/pnpm-workspace.yaml frontend/pnpm-lock.yaml
echo '=== package manager and frontend metadata candidates ==='
fd -HI '^(package\.json|pnpm-workspace\.yaml|pnpm-lock\.yaml|\.npmrc|packageManager|volta)$' . \
-E node_modules -E .git | sort
echo '=== root package manager fields ==='
if [ -f package.json ]; then
jq '{packageManager,engines,volta}' package.json
fi
echo '=== frontend package scripts and dependency control fields ==='
jq '{packageManager,engines,scripts,dependencies,devDependencies,pnpm,resolutions,overrides}' frontend/package.json
echo '=== frontend workspace override configuration ==='
cat frontend/pnpm-workspace.yaml
echo '=== postcss and eslint lockfile occurrences ==='
rg -n -C 3 '(^\s{0,2}(postcss|eslint)@|^\s{2,}(postcss|eslint):|postcss@8\.5\.25|eslint@)' frontend/pnpm-lock.yaml
echo '=== dependency and credential indicators in the changed files ==='
git diff --no-ext-diff origin/develop...HEAD -- \
frontend/package.json frontend/pnpm-workspace.yaml frontend/pnpm-lock.yaml \
| rg -n -i -C 2 '(token|secret|password|api[_-]?key|authorization|npmrc|registry|https?://)' || trueLength of output: 116820 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '=== added workflow with line numbers ==='
nl -ba .github/workflows/pr-1230-finalize-frontend-governance.yml
echo '=== workflow credential and privilege indicators ==='
rg -n -i -C 3 '(permissions:|id-token|secrets\.|github\.token|GITHUB_TOKEN|token|write-all|contents:\s*write|pull-requests:\s*write|actions:\s*write|checkout@|curl|wget|gh\s)' \
.github/workflows/pr-1230-finalize-frontend-governance.yml || true
echo '=== exact PR body dependency-table rows ==='
gh pr view 1230 --repo ContextualWisdomLab/naruon --json body --jq '.body' \
| sed -n '/| Package | From | To |/,/^$/p'
echo '=== changed-line locations in manifest ==='
git diff --unified=0 origin/develop...HEAD -- frontend/package.json frontend/pnpm-workspace.yaml \
| rg -n -C 2 '^[@+ -]' || trueLength of output: 1196 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '=== added workflow with line numbers ==='
awk '{printf "%6d %s\n", NR, $0}' .github/workflows/pr-1230-finalize-frontend-governance.yml
echo '=== workflow credential and privilege indicators ==='
rg -n -i -C 3 '(permissions:|id-token|secrets\.|github\.token|GITHUB_TOKEN|token|write-all|contents:\s*write|pull-requests:\s*write|actions:\s*write|checkout@|curl|wget|gh\s)' \
.github/workflows/pr-1230-finalize-frontend-governance.yml || true
echo '=== exact PR body dependency-table rows ==='
gh pr view 1230 --repo ContextualWisdomLab/naruon --json body --jq '.body' \
| sed -n '/| Package | From | To |/,/^$/p'
echo '=== changed-line locations in manifest ==='
git diff --unified=0 origin/develop...HEAD -- frontend/package.json frontend/pnpm-workspace.yaml \
| rg -n -C 2 '^[@+ -]' || trueLength of output: 7478
Findings
Static verification
I could not run
|
|
@dependabot rebase |
|
Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry! If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request |
|
/oc Fix the sole exact-head Application CI failure directly on branch Root cause from run Repair the governance test at the source rather than reverting the patched dependency:
Run the focused governance test, complete 1,600+ backend suite, frontend tests/lint/typecheck/build/Playwright smoke, dependency/security/container gates, and |
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr-1230-finalize-frontend-governance.yml:
- Around line 52-64: The workflow’s hardcoded replacement must be replaced by
permanent checks in test_release_governance.py. Update the governance tests to
derive the PostCSS version from frontend/package.json, require it to be at least
8.5.24, and verify exact alignment across the manifest, pnpm workspace override,
lockfile metadata, and the single-version lock closure; remove the temporary
"8.5.24" to "8.5.25" replacement step.
- Around line 84-109: Update the workflow’s verification steps before the
commit/push stage to run the repository’s required security scanners and
container checks as blocking gates. Add the established security and
container-check commands alongside the existing frontend and backend
verification commands, ensuring any failure stops the workflow.
- Around line 111-145: The workflow must not delete, commit, or push changes
from CI. Remove the self-mutating workflow file entirely, and apply the required
governance change directly to the Dependabot branch outside workflow automation.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 6c3da85c-eca5-41a0-9739-04b86a406be1
📒 Files selected for processing (1)
.github/workflows/pr-1230-finalize-frontend-governance.yml
|
/oc Apply the PostCSS governance repair directly on exact head The dependency update itself is valid. Fix only
Run the focused governance test, complete backend suite with warnings-as-errors, frontend tests/lint/typecheck/coverage/production build/Playwright smoke, dependency review, Bandit, Semgrep, Security Scan, container build, and |
|
Apply the remaining permanent governance repair directly to exact head In
Run the focused governance test, the complete backend suite, the complete frontend frozen-install/lint/type/test/coverage/build path with pnpm 11.5.3, repository security and container checks, docstring/coverage gates, and |
|
@opencode-agent @cwl-noema-review Exact-head repair request for Application CI run Repair this test contract directly on the existing branch, without any workflow writer. Preserve and strengthen the CodeRabbit-requested permanent behavior:
Do not add or restore |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current headb44d5f776c40a7248c3ee95d49f80cea655f301e. -
Head SHA:
b44d5f776c40a7248c3ee95d49f80cea655f301e -
Workflow run: 31189053425
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Frontend (3 files)"]
S1 --> I1["browser runtime and bundle"]
I1 --> R1["Review risk: Frontend (3 files)"]
R1 --> V1["frontend tests"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage evidence job did not run or did not publish coverage evidence. Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Frontend (3 files)"]
S1 --> I1["browser runtime and bundle"]
I1 --> R1["Review risk: Frontend (3 files)"]
R1 --> V1["frontend tests"]
|
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
2 participants
Bumps the frontend-npm group with 7 updates in the /frontend directory:
1.27.01.28.01.62.01.62.119.2.1719.2.1819.2.319.2.49.39.510.8.030.0.030.0.18.5.188.5.25Updates
lucide-reactfrom 1.27.0 to 1.28.0Release notes
Sourced from lucide-react's releases.
Commits
Updates
@playwright/testfrom 1.62.0 to 1.62.1Release notes
Sourced from @playwright/test's releases.
Commits
26a9e47cherry-pick(#42043): docs: release notes for v1.62 Python, Java, and .NET (#4...0a81d5dcherry-pick(#42040): docs(release-notes): mention the isolated headless clipb...8376826cherry-pick(#42034): fix(aria): keep icon-only clickable elements in ai snaps...66c5cc9chore: mark v1.62.1 (#42020)9672bc3cherry-pick(#42009): fix(types): support branded primitives in evaluate argum...4325804cherry-pick(#41988): fix(aria): preserve names from collapsed text contributors9632f8echerry-pick(#42005): fix(tsconfig): do not throw when "extends"/"references" ...Updates
@types/reactfrom 19.2.17 to 19.2.18Commits
Updates
@types/react-domfrom 19.2.3 to 19.2.4Commits
Updates
eslintfrom 9.39.5 to 10.8.0Release notes
Sourced from eslint's releases.
... (truncated)
Commits
749dfed10.8.04bd0d75Build: changelog update for 10.8.04fbf46dtest: pinwebpackversion to 5.108.4 (#21137)6ddf858docs: fix broken Specify Parser Options anchor link (#21106)784dfbedocs: Clarifyno-eq-nulldescription (#21120)6b8d2f7fix: escape reserved characters in rule id inhtmlformatter (#21129)2d063e2chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101)eccbe7btest: add error locations tono-class-assign(#21123)2fee9bbfeat: exportConfigObjectfromeslint/config(#21082)e7d1e43ci: bump actions/setup-go from 6 to 7 (#21118)Updates
jsdomfrom 30.0.0 to 30.0.1Release notes
Sourced from jsdom's releases.
Commits
658448530.0.10c51df6Update dependencies and dev dependencies32adb34Bump@asamuzakjp/dom-selector70f014aSpeed up range operations on large documents250d7eePartially fix getComputedStyle with calc()Updates
postcssfrom 8.5.18 to 8.5.25Release notes
Sourced from postcss's releases.
Changelog
Sourced from postcss's changelog.
Commits
08c989cRelease 8.5.25 version24f6814Fix 8.5.17 visitor regressionf2fa53fAdd supply chain security requirement to PostCSS plugin guide10edf0bfix: return empty array for empty string in list.split (#2121)0ebe8adRelease 8.5.24 version73218c6Update dependencies9a114f6Preserve the BOM when stringifying (#2119)9069261Fix types checkeb9e1feRelease 8.5.23 version9d19c78Update dependenciesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsSummary by CodeRabbit