ci: fix tao udeps environment - #14
Conversation
|
Warning Review limit reached
Next review available in: 2 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe udeps workflow now pins its artifact download action and installs ChangesUdeps workflow
Workspace dependency overrides
Estimated code review effort: 1 (Trivial) | ~3 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
audit-js is a required check and has been failing on dev since at least 2026-07-30 on 3062a89, for reasons unrelated to the udeps fix here. Every PR targeting dev inherits it, which is why this one has been red for two weeks despite touching only .github/workflows/udeps.yml. Two advisory groups had to be cleared: - brace-expansion: the override pinned 5.0.7, but GHSA-rgw5-rvv9-x895 and its predecessor now require >=5.0.8 and >=5.0.9. Bumped to 5.0.9. - postcss: <=8.5.17 (high, path traversal in previous source map) and <=8.5.22 (moderate, incomplete fix of GHSA-6g55-p6wh-862q). Added a postcss@<8.5.23 override. `pnpm audit` now reports no known vulnerabilities, and prettier is clean on both changed files. Note: the postcss override is only needed on this branch. The upstream sync in #15 pulls newer transitive deps that already resolve postcss >=8.5.23, so once that lands this entry is redundant and can be dropped. The brace-expansion bump is the same change #15 carries, so expect a trivial conflict in pnpm-workspace.yaml / pnpm-lock.yaml between the two -- take either side for brace-expansion, drop postcss.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pnpm-workspace.yaml`:
- Line 15: Align the Node.js support policy with the brace-expansion@5.0.9
override: update the CLI package’s engine.node declaration and corresponding CI
matrix to Node 20 or >=22, or replace the override with a version compatible
with the currently supported Node floor. Ensure pnpm install --engine-strict
succeeds for every supported Node version.
- Line 18: Update the PostCSS override in the workspace configuration to target
only dependencies compatible with the PostCSS 8 API and peer constraints, rather
than forcing every version below 8.5.23 to 8.5.23. If older consumers cannot use
PostCSS 8, separate their override or handling instead of applying this broad
range.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: ecd1d9cf-b067-490d-a1d9-0c6883fef8e0
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
pnpm-workspace.yaml
Review follow-up. postcss@<8.5.23 was broader than the advisories it addresses -- GHSA path-traversal is <=8.5.17 and GHSA-fxqj-rqcc-2cmp is <=8.5.22, both within 8.x -- so the unbounded lower end would have silently pulled a hypothetical postcss 6/7 consumer across a major boundary. Nothing in the tree resolves below 8 today, so this is latent rather than an active break, but the bounded form matches both the advisory range and the convention already used by the other entries in this block. Only the recorded override key changes in the lockfile; postcss still resolves to 8.5.23 and `pnpm audit` still reports no known vulnerabilities.
GHSA-4cwx-7wf7-3272 (high, cross-user information disclosure and parse-time crash via degenerate private cache directives) and GHSA-8xcm-r25x-g524 (moderate, downstream response desynchronization via the retry interceptor). Both are >=7.0.0 <7.29.0, patched in 7.29.0. Single path: crates__tauri-schema-worker>wrangler>miniflare>undici, i.e. build/test tooling for the schema worker, not the desktop binary or the frontend bundle. Pinned as ^7.29.0 rather than a bare >=7.29.0 on purpose: undici 8.x is released (8.10.0 is latest), so an open-ended lower bound would drag miniflare across a major. undici now resolves to 7.29.0 and pnpm audit reports no known vulnerabilities. These advisories are new drift, not merge fallout -- audit-js was green on this branch at 45/45 before they were published. Same pattern as the brace-expansion and postcss bumps. Note on the postcss override inherited from dev via #14: it is inert here, because the upstream sync already resolves postcss >=8.5.23 on its own. Left in place rather than removed, since dropping it is a separate decision from this sync.
1 participant
Fixes the dev Udeps failure for ./ports/tao by installing libadwaita-1-dev, which is required when cargo udeps runs with --all-features. Also pins actions/download-artifact v8.0.1 at its immutable SHA to use the supported Node 24 runtime and clear the deprecation warning.
Validation:
Failing run: https://github.com/OlympusLedgerOrg/tauri/actions/runs/29767841539
Summary by CodeRabbit