Skip to content

fix(studio): Address pnpm audit and latest node versions - #1042

Merged
steramae-nvidia merged 3 commits into
mainfrom
steramae/vulns-8-26
Aug 3, 2026
Merged

fix(studio): Address pnpm audit and latest node versions#1042
steramae-nvidia merged 3 commits into
mainfrom
steramae/vulns-8-26

Conversation

@steramae-nvidia

@steramae-nvidia steramae-nvidia commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Signed-off-by: Sean Teramae steramae@nvidia.com

Summary by CodeRabbit

  • Chores
    • Updated supported Node.js and pnpm versions for more consistent setup.
    • Updated development tooling and package versions.
    • Refreshed dependency overrides and upgraded PostCSS.
    • Addressed outdated or vulnerable package versions.
  • Documentation
    • Updated setup, bootstrap, and troubleshooting guidance to reflect current runtime requirements.

Signed-off-by: Sean Teramae <steramae@nvidia.com>
@steramae-nvidia

Copy link
Copy Markdown
Contributor Author

This change is part of the following stack:

Change managed by git-spice.

@steramae-nvidia
steramae-nvidia requested review from a team as code owners August 3, 2026 17:33
@github-actions github-actions Bot added the fix label Aug 3, 2026
@coderabbitai

coderabbitai Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

The changes align Node.js and pnpm versions across project configuration and setup guidance. They also update workspace dependency overrides, the postcss catalog constraint, and the Studio js-yaml development dependency.

Changes

Toolchain and dependency updates

Layer / File(s) Summary
Runtime and package manager versions
Makefile, web/.nvmrc, web/package.json, README.md, AGENTS.md, docs/get-started/setup.mdx
Node.js is updated to 22.23.2. The minimum Node.js and pnpm versions, the pnpm package manager pin, bootstrap guidance, prerequisites, and troubleshooting instructions are updated.
Workspace dependency constraints
web/pnpm-workspace.yaml, web/packages/studio/package.json
Dependency overrides are updated for brace-expansion, fast-uri, js-yaml, linkify-it, and postcss. The postcss catalog and Studio js-yaml version constraints are raised.

Suggested labels: build

Suggested reviewers: a2bondar

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the updates to pnpm audit dependencies and Node.js versions.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch steramae/vulns-8-26

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Makefile`:
- Line 236: Update the Node.js bootstrap version documented in README.md from
22.18.0 to 22.23.2, matching the version shown by the Makefile command and the
web/package.json configuration.

In `@web/package.json`:
- Around line 57-60: Add the requested scripts across all affected manifests:
add test:ci as vitest run --coverage to web/package.json,
web/packages/scripts/package.json, and web/packages/storybook/package.json; add
typecheck as tsc --noEmit to web/package.json and
web/packages/storybook/package.json; add the coverage script to
web/packages/sdk/package.json; and remove --noErrorTruncation from the typecheck
scripts in web/packages/scripts/package.json and
web/packages/studio/package.json. The anchor web/package.json lines 57-60 and
sibling web/packages/studio/package.json line 118 require these manifest
updates.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 51a6e44b-8ff8-4ed1-96b1-be1a62bf8478

📥 Commits

Reviewing files that changed from the base of the PR and between 2cb9a08 and 0de49e7.

⛔ Files ignored due to path filters (1)
  • web/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (5)
  • Makefile
  • web/.nvmrc
  • web/package.json
  • web/packages/studio/package.json
  • web/pnpm-workspace.yaml

Comment thread Makefile
Comment thread web/package.json
@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor
Suite Lines Covered Line Rate Branch Rate
Unit Tests 30032/38046 78.9% 63.5%
Integration Tests 17780/36715 48.4% 20.8%

Follow-up to the toolchain bump: README still documented 22.18.0 while
the Makefile hint, web/.nvmrc, and web/package.json engines all moved to
22.23.2.

Signed-off-by: Sean Teramae <steramae@nvidia.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Line 82: Update the toolchain requirements in README.md to state Node.js
>=22.23.2 <23 instead of 22.18.x, and add the documented pnpm requirement
>=10.34.5. Keep the existing bootstrap guidance unchanged, noting that pnpm env
use --global 22.23.2 only changes Node.js.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 750f34db-390a-4660-93d4-f61da777eb18

📥 Commits

Reviewing files that changed from the base of the PR and between 0de49e7 and 27987f3.

📒 Files selected for processing (1)
  • README.md

Comment thread README.md
…json

README prerequisites still listed Node 22.18.x and omitted a pnpm floor.
Also updates the setup guide and AGENTS.md, which carried the same stale
22.18.0 bootstrap version. Release-notes docs are left as-is since they
record what each shipped release required.

Signed-off-by: Sean Teramae <steramae@nvidia.com>
@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@AGENTS.md`:
- Line 245: Update AGENTS.md at line 245 to state the exact Node.js range
>=22.23.2 <23 and pnpm range >=10.34.5 instead of 22.23.x and the indirect pnpm
reference; update docs/get-started/setup.mdx at line 16 to add pnpm >=10.34.5 to
the source-checkout prerequisites.

In `@docs/get-started/setup.mdx`:
- Line 53: Update both Studio recovery instructions in
docs/get-started/setup.mdx at lines 53-53 and 247-247 to add a step that
installs or validates pnpm version 10.34.5 or newer before rerunning make
bootstrap-studio; retain the existing Node.js setup guidance and apply the same
pnpm requirement at both locations.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2090089e-1034-457f-9f63-2b3e8eb3676f

📥 Commits

Reviewing files that changed from the base of the PR and between 27987f3 and 7622b69.

📒 Files selected for processing (3)
  • AGENTS.md
  • README.md
  • docs/get-started/setup.mdx

Comment thread AGENTS.md
Comment thread docs/get-started/setup.mdx
@steramae-nvidia
steramae-nvidia added this pull request to the merge queue Aug 3, 2026
Merged via the queue into main with commit f7e1e29 Aug 3, 2026
56 checks passed
@steramae-nvidia
steramae-nvidia deleted the steramae/vulns-8-26 branch August 3, 2026 18:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants