Conversation
rahulbarwal
added
Dependencies
rahulbarwal
requested review from
hetunandu and
jsartisan
and removed request for
riodeuno
WalkthroughA new Dependabot configuration file has been added to automate npm and Maven dependency updates in the Changes
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
📜 Recent review detailsConfiguration used: .coderabbit.yaml 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms (7)
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
github-actions
bot
added
the
skip-changelog
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (4)
.github/dependabot.yml (1)
5-9: Ensure ignore rule covers intended TinyMCE versions.
You’ve set Dependabot to ignore updates fortinymceat version6.8.3. If the goal is to ignore all patch updates within 6.8 (e.g., 6.8.4, 6.8.5), consider using a wildcard range like"6.8.x"instead of a fixed version.app/client/.husky/check-staged-files.sh (3)
10-10: Consider handling filenames with spaces.
Usinggrepandsedongit diff --name-onlyoutput can break if filenames contain whitespace. To robustly handle all cases, you could switch to NUL-delimited output:- staged_server_files=$(git diff --cached --name-only | grep "app/server" | sed 's|app/server/||') + staged_server_files=$(git diff --cached --name-only -z \ + | grep -z "app/server" \ + | sed -z 's|app/server/||' \ + | xargs -0)
12-12: Normalize indentation for consistency.
The leading spaces before this comment are deeper than surrounding lines. Align to the script’s two-space indent convention:- # Check if Spotless succeeded + # Check if Spotless succeeded
26-28: Add error handling topushd/popd.
Shellcheck (SC2164) warns thatpushd/popdmay fail silently. Guard against failures to avoid surprising behavior:- pushd app/server > /dev/null + pushd app/server > /dev/null || exit 1 apply_spotless_and_commit_staged_files - popd > /dev/null + popd > /dev/null || exit 1🧰 Tools
🪛 Shellcheck (0.10.0)
[warning] 26-26: Use 'pushd ... || exit' or 'pushd ... || return' in case pushd fails.
(SC2164)
[warning] 28-28: Use 'popd ... || exit' or 'popd ... || return' in case popd fails.
(SC2164)
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/dependabot.yml(1 hunks)app/client/.husky/check-staged-files.sh(2 hunks)
🧰 Additional context used
🪛 Shellcheck (0.10.0)
app/client/.husky/check-staged-files.sh
[warning] 26-26: Use 'pushd ... || exit' or 'pushd ... || return' in case pushd fails.
(SC2164)
[warning] 28-28: Use 'popd ... || exit' or 'popd ... || return' in case popd fails.
(SC2164)
⏰ Context from checks skipped due to timeout of 90000ms (6)
- GitHub Check: perform-test / client-build / client-build
- GitHub Check: perform-test / server-build / server-unit-tests
- GitHub Check: client-unit-tests / client-unit-tests
- GitHub Check: client-lint / client-lint
- GitHub Check: client-build / client-build
- GitHub Check: client-prettier / prettier-check
🔇 Additional comments (2)
.github/dependabot.yml (2)
1-4: Validate the package-ecosystem and path.
Usingpackage-ecosystem: "npm"anddirectory: "/app/client"correctly scopes Dependabot to your frontend dependencies. Confirm that all relevant client-side packages live under this path and that no additional ecosystems (e.g., GitHub Actions, Docker) require their own entries.
10-16: Review PR limits, labels, and commit formatting.
Limiting to 5 open PRs, tagging withdependencies/javascript, and using achore(scope):commit message prefix all align with common conventions. Ensure these labels exist in your repo and that any bots or CI workflows correctly interpret thechoreprefix.
hetunandu
left a comment
hetunandu
left a comment
There was a problem hiding this comment.
dependabot is also used to check server dependencies. this change will force it to be client only
rahulbarwal
deleted the
rahulbarwal/Remove-tinyMCE-precommit-check-and-move-to-dependabot-configuration-
branch
3 participants
Description
We are implementing this to control Dependabot alerts and prevent flagging of the TinyMCE library, which we are maintaining at version 6.8.3.
Fixes #
Issue Numberor
Fixes
Issue URLWarning
If no issue exists, please create an issue first, and check with the maintainers if the issue is valid.
Automation
/ok-to-test tags="@tag.Sanity"
🔍 Cypress test results
Tip
🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
Workflow run: https://github.com/appsmithorg/appsmith/actions/runs/14770091908
Commit: bc96027
Cypress dashboard.
Tags:
@tag.SanitySpec:
Thu, 01 May 2025 05:43:58 UTC
Communication
Should the DevRel and Marketing teams inform users about this change?
Summary by CodeRabbit