upstream 取り込み PR #6: version bump (1.5.5→1.5.10) + uuid v14#404
upstream 取り込み PR #6: version bump (1.5.5→1.5.10) + uuid v14#404
Conversation
Addresses GHSA-w5hq-g745-h8pq (Dependabot #29): uuid < 14.0.0 is missing buffer bounds checks in v3/v5/v6 when a caller-provided buffer is passed, allowing silent partial writes. Our usage is limited to v4()/validate/version with no caller buffers, so there's no direct exposure, but bumping to 14.0.0 clears the alert.
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 50 minutes and 55 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🧹 Preview Cleanup CompleteThe following preview resources have been cleaned up:
Thank you for your contribution! 🎉 |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8e06a0deb7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
main 側に存在した lockfile の不整合 (`@mastra/core/p-retry@^7.1.1` に対する resolution entry 欠落) により electron-builder の production dependency traversal が fail していた問題を解消。`rm bun.lock && bun install` で完全再生成。 - fork 固有依存 (ansi_up, @vscode/ripgrep, @xyflow/react, vscode-*) は全て保持 - desktop build がローカルで exit 0 成功 - typecheck / lint 全 pass
3 participants
Summary
upstream 取り込み PR #6: version bump + dependency bump 5 commits。Codex 事前調査を経て auto-updater 関連 2 commits と fork 既取り込み CVE bump を除外。
Codex が検出した bun.lock の
p-retry@7.1.1resolution 脱落問題 (main 側既存、CI Build fail の原因) も本 PR で修復。取り込み内容（5 commits）
追加 fix
@mastra/core/p-retry@^7.1.1resolution 欠落) により electron-builder の production dependency traversal が fail していた問題を解消。Codex が P1 で指摘。rm bun.lock && bun installで再生成し、ローカルbun run --filter @superset/desktop buildが exit 0 で成功除外した 3 commits（理由別）
fork の独自 auto-updater 実装と文脈不一致（skip）
92b6701ce8e9(fix(desktop): guard installUpdate against repeat clicks on macOS superset-sh/superset#3549 guard installUpdate against repeat clicks) — fork のinstallUpdate()は GitHub Releases URL を開く独自実装でquitAndInstallを使わない872361c3dc97(fix(desktop): show spinner on install update button while pending superset-sh/superset#3561 show spinner on install update button while pending) — fork のUpdateToastはボタン文言が「Open releases」で upstream の「Install / Installing...」前提 spinner と意味が合わないfork 既取り込み相当（skip）
33848baf324f(security: bump drizzle-orm and better-auth to patch CVEs superset-sh/superset#3560 security bump drizzle-orm and better-auth) — fork に19a3db58bとして同内容相当 commit が既に存在Fork 側のコンフリクト解決
apps/desktop/package.json(chore(deps): bump uuid to ^14.0.0 (GHSA-w5hq-g745-h8pq) superset-sh/superset#3680): fork 独自依存 (vscode-*,ws,yaml-language-server,yauzl) を維持しつつuuidを^14.0.0に更新bun.lock: 完全再生成で整合性担保、fork 独自依存 (ansi_up,@vscode/ripgrep,@xyflow/react) は全て維持fork リリース運用との整合性
apps/desktopversion:1.5.5→1.5.10(upstream トラッキング、CLAUDE.md/AGENTS.md 方針)v1.5.10-fork.1から再スタートrelease-desktop.ymlはdesktop-v*.*.*発火条件、fork の手動運用 tag とは干渉しないuuid v14 breaking change (Codex 検証済み)
packages/local-db/src/schema/*.ts,apps/desktop/src/main/lib/local-db/index.tsv4 as uuidv4,validate as uuidValidate,version as uuidVersion) のみ使用、API 変更なしFork 固有機能ヘルスチェック
baseline 比較で 全項目健在:
ansi_up,@vscode/ripgrep,@xyflow/reactTERMINAL_OPTIONS,SUPERSET_WORKSPACE_NAME,moonshot-ai.kimi-codelistBranchessortOrder/pinDefaultdmg.size="4g"(electron-builder.ts)Codex 最終レビュー: マージ可
全観点 pass。P1 指摘の
p-retry@7.1.1脱落は本 commit で修復。Test plan
bun install正常完了bun run typecheckグリーン (27/27)bun run lintグリーンbun run --filter @superset/desktop buildローカル exit 0 成功apps/desktop/package.jsonversion = 1.5.10, uuid = ^14.0.0v1.5.10-fork.1タグを切る運用に移行次の PR