chore(deps): update dotagents dependencies - #1172
Conversation
- Update dotagents binary to latest version - Update bun.lock with latest dependency changes - Update package.json with dependency updates Entire-Checkpoint: 791f6781885a
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
📝 WalkthroughWalkthroughA submodule pointer for dotagents was updated to a new commit revision, and a new dependency "vite-plus" (version ^0.1.12) was added to the project alongside its inclusion in the trustedDependencies array. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Mesa DescriptionTL;DRUpdated dotagents dependencies to their latest versions. What changed?
Description generated by Mesa. Update settings |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@dotagents`:
- Line 1: The pinned submodule commit ed1ffc528703a16cb499f7bc33c1b427eefe84e6
does not exist upstream, so update the dotagents submodule reference to a
reachable commit (for example 88e0a3f7760d091bd6391ead808ad54753b6439f) in the
repository metadata (the submodule entry that references
https://github.com/shunkakinoki/dotagents), then run git add on the updated
submodule state and commit; verify by running git submodule sync && git
submodule update --init --recursive to confirm the new SHA is fetchable.
In `@package.json`:
- Around line 94-95: Remove "vite-plus" from the trustedDependencies array in
package.json because it defines no lifecycle scripts; edit the
trustedDependencies entry (currently listing "vite" and "vite-plus") to only
include "vite" so that "vite-plus" is no longer granted trusted execution
privileges.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: fb706d06-fb89-4c35-b22f-ae2cd1c97095
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
dotagentspackage.json
| @@ -1 +1 @@ | |||
| Subproject commit ae94d8fd73b75890bab057486ab757e3a436c057 | |||
| Subproject commit ed1ffc528703a16cb499f7bc33c1b427eefe84e6 | |||
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
TARGET_SHA="ed1ffc528703a16cb499f7bc33c1b427eefe84e6"
echo "1) Read submodule URL from .gitmodules"
git config -f .gitmodules --get-regexp '^submodule\..*\.url$' | sed -n '/dotagents/p'
echo
echo "2) Confirm gitlink SHA recorded in current tree"
git ls-tree HEAD dotagents
echo
echo "3) If dotagents submodule is present locally, inspect tag containment (read-only)"
if [ -d dotagents/.git ]; then
git -C dotagents rev-parse HEAD
git -C dotagents cat-file -t "$TARGET_SHA" || true
git -C dotagents tag --contains "$TARGET_SHA" || true
else
echo "Submodule working tree not initialized in this environment; run the same commands locally after submodule init."
fiRepository: shunkakinoki/dotfiles
Length of output: 478
🏁 Script executed:
#!/bin/bash
set -euo pipefail
TARGET_SHA="ed1ffc528703a16cb499f7bc33c1b427eefe84e6"
REPO_URL="https://github.com/shunkakinoki/dotagents"
echo "Querying upstream repository for commit and tag information..."
echo
# Use git ls-remote to check if commit exists and find tags
echo "1) Checking if commit exists in upstream (via ls-remote):"
git ls-remote "$REPO_URL" | grep -E "refs/(heads|tags)" | head -20
echo
echo "2) Attempting to fetch commit metadata via GitHub API:"
# Try GitHub API to get commit details
curl -s "https://api.github.com/repos/shunkakinoki/dotagents/commits/$TARGET_SHA" \
-H "Accept: application/vnd.github.v3+json" | python3 -m json.tool 2>/dev/null || echo "API query completed or limited"
echo
echo "3) Checking for tags pointing to this commit:"
git ls-remote "$REPO_URL" | grep "refs/tags" | grep -v "\^{}" || echo "No matching tags found in ls-remote output"Repository: shunkakinoki/dotfiles
Length of output: 1079
🏁 Script executed:
#!/bin/bash
set -euo pipefail
TARGET_SHA="ed1ffc528703a16cb499f7bc33c1b427eefe84e6"
REPO_URL="https://github.com/shunkakinoki/dotagents"
echo "Attempting to verify commit reachability..."
echo
# Method: Use git ls-remote with a specific commit (most permissive check)
# Or check if commit appears in the output of refs that include the commit
echo "1) Attempting to verify commit visibility in upstream:"
git ls-remote "$REPO_URL" "$TARGET_SHA" || echo "Commit not found via direct SHA lookup"
echo
echo "2) Checking reachability from main branch:"
# Try to see the commit log from main to see if this SHA appears
git ls-remote "$REPO_URL" refs/heads/main | while read sha ref; do
echo "Main branch HEAD: $sha"
# We can't directly check ancestry in sandbox, but we can note the main branch SHA
done
echo
echo "3) Summary of upstream state:"
echo " - Target SHA: $TARGET_SHA"
echo " - Submodule URL: $REPO_URL"
echo " - Repository appears to have no release tags"
echo " - Commit must be verified locally after: git submodule update --init dotagents"Repository: shunkakinoki/dotfiles
Length of output: 548
🏁 Script executed:
git -C dotagents cat-file -t ed1ffc528703a16cb499f7bc33c1b427eefe84e6
git -C dotagents branch -a --contains ed1ffc528703a16cb499f7bc33c1b427eefe84e6Repository: shunkakinoki/dotfiles
Length of output: 410
Reject: The pinned dotagents commit does not exist in the upstream repository.
The commit ed1ffc528703a16cb499f7bc33c1b427eefe84e6 is not reachable in the configured upstream (https://github.com/shunkakinoki/dotagents). Attempting to fetch it produces:
fatal: remote error: upload-pack: not our ref ed1ffc528703a16cb499f7bc33c1b427eefe84e6
This means:
- The SHA is not in any branch, tag, or ref in the upstream repository
- Cloning or updating this submodule will fail for all users
- This breaks reproducibility and CI/CD pipelines
Update the submodule pointer to a valid commit that exists in the upstream repository (e.g., the current main branch: 88e0a3f7760d091bd6391ead808ad54753b6439f).
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@dotagents` at line 1, The pinned submodule commit
ed1ffc528703a16cb499f7bc33c1b427eefe84e6 does not exist upstream, so update the
dotagents submodule reference to a reachable commit (for example
88e0a3f7760d091bd6391ead808ad54753b6439f) in the repository metadata (the
submodule entry that references https://github.com/shunkakinoki/dotagents), then
run git add on the updated submodule state and commit; verify by running git
submodule sync && git submodule update --init --recursive to confirm the new SHA
is fetchable.
| "vite", | ||
| "vite-plus" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Trusted entry check:"
jq '.trustedDependencies | map(select(. == "vite-plus"))' package.json
echo "Lockfile references:"
fd 'bun.lock*' -x sh -c 'echo "--- {} ---"; rg -n "vite-plus" "{}" || true'
echo "Published npm scripts for vite-plus@0.1.12:"
curl -s https://registry.npmjs.org/vite-plus/0.1.12 | jq '{name,version,scripts}'Repository: shunkakinoki/dotfiles
Length of output: 16548
Remove vite-plus from trustedDependencies—it defines no lifecycle scripts.
vite-plus@0.1.12 contains only custom build/test scripts and no lifecycle scripts (install, postinstall, prepare). Granting it trusted execution privileges increases supply-chain risk unnecessarily.
Suggested change
"vite",
- "vite-plus"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "vite", | |
| "vite-plus" | |
| "vite", |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@package.json` around lines 94 - 95, Remove "vite-plus" from the
trustedDependencies array in package.json because it defines no lifecycle
scripts; edit the trustedDependencies entry (currently listing "vite" and
"vite-plus") to only include "vite" so that "vite-plus" is no longer granted
trusted execution privileges.
There was a problem hiding this comment.
Pull request overview
Updates the dotagents submodule and refreshes JS toolchain dependencies (including adding vite-plus) with corresponding Bun lockfile changes.
Changes:
- Bump
dotagentssubmodule commit to a newer revision - Add
vite-plustopackage.jsondependencies andtrustedDependencies - Update
bun.lockto reflect the new dependency graph (incl.vite-plusand related tooling)
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Adds vite-plus and marks it as trusted for install scripts |
| dotagents | Updates the submodule pointer to the latest commit |
| bun.lock | Updates dependency resolutions/versions to match package.json changes |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
| "vite", | ||
| "vite-plus" |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request focuses on updating the dependencies of the project, ensuring that the project is using the latest versions of its dependencies. This includes updating the Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
The pull request updates the dotagents subproject commit, adds vite-plus as a dependency and to trustedDependencies in package.json, and updates several dependencies in bun.lock, including @oxc-project/types, @types/chai, pixelmatch, and adds sirv.
| "vite-plus/oxfmt": ["oxfmt@0.40.0", "", { "dependencies": { "tinypool": "2.1.0" }, "optionalDependencies": { "@oxfmt/binding-android-arm-eabi": "0.40.0", "@oxfmt/binding-android-arm64": "0.40.0", "@oxfmt/binding-darwin-arm64": "0.40.0", "@oxfmt/binding-darwin-x64": "0.40.0", "@oxfmt/binding-freebsd-x64": "0.40.0", "@oxfmt/binding-linux-arm-gnueabihf": "0.40.0", "@oxfmt/binding-linux-arm-musleabihf": "0.40.0", "@oxfmt/binding-linux-arm64-gnu": "0.40.0", "@oxfmt/binding-linux-arm64-musl": "0.40.0", "@oxfmt/binding-linux-ppc64-gnu": "0.40.0", "@oxfmt/binding-linux-riscv64-gnu": "0.40.0", "@oxfmt/binding-linux-riscv64-musl": "0.40.0", "@oxfmt/binding-linux-s390x-gnu": "0.40.0", "@oxfmt/binding-linux-x64-gnu": "0.40.0", "@oxfmt/binding-linux-x64-musl": "0.40.0", "@oxfmt/binding-openharmony-arm64": "0.40.0", "@oxfmt/binding-win32-arm64-msvc": "0.40.0", "@oxfmt/binding-win32-ia32-msvc": "0.40.0", "@oxfmt/binding-win32-x64-msvc": "0.40.0" }, "bin": { "oxfmt": "bin/oxfmt" } }, "sha512-g0C3I7xUj4b4DcagevM9kgH6+pUHytikxUcn3/VUkvzTNaaXBeyZqb7IBsHwojeXm4mTBEC/aBjBTMVUkZwWUQ=="], | ||
|
|
||
| "vite-plus/oxlint": ["oxlint@1.55.0", "", { "optionalDependencies": { "@oxlint/binding-android-arm-eabi": "1.55.0", "@oxlint/binding-android-arm64": "1.55.0", "@oxlint/binding-darwin-arm64": "1.55.0", "@oxlint/binding-darwin-x64": "1.55.0", "@oxlint/binding-freebsd-x64": "1.55.0", "@oxlint/binding-linux-arm-gnueabihf": "1.55.0", "@oxlint/binding-linux-arm-musleabihf": "1.55.0", "@oxlint/binding-linux-arm64-gnu": "1.55.0", "@oxlint/binding-linux-arm64-musl": "1.55.0", "@oxlint/binding-linux-ppc64-gnu": "1.55.0", "@oxlint/binding-linux-riscv64-gnu": "1.55.0", "@oxlint/binding-linux-riscv64-musl": "1.55.0", "@oxlint/binding-linux-s390x-gnu": "1.55.0", "@oxlint/binding-linux-x64-gnu": "1.55.0", "@oxlint/binding-linux-x64-musl": "1.55.0", "@oxlint/binding-openharmony-arm64": "1.55.0", "@oxlint/binding-win32-arm64-msvc": "1.55.0", "@oxlint/binding-win32-ia32-msvc": "1.55.0", "@oxlint/binding-win32-x64-msvc": "1.55.0" }, "peerDependencies": { "oxlint-tsgolint": ">=0.15.0" }, "optionalPeers": ["oxlint-tsgolint"], "bin": { "oxlint": "bin/oxlint" } }, "sha512-T+FjepiyWpaZMhekqRpH8Z3I4vNM610p6w+Vjfqgj5TZUxHXl7N8N5IPvmOU8U4XdTRxqtNNTh9Y4hLtr7yvFg=="], |
There was a problem hiding this comment.
The vite-plus/oxfmt and vite-plus/oxlint dependencies are pinned to specific versions. This could lead to dependency conflicts if these packages are updated elsewhere in the project. Consider using a version range to allow for minor updates.
| @@ -753,7 +754,7 @@ | |||
|
|
|||
| "@oxc-project/runtime": ["@oxc-project/runtime@0.115.0", "", {}, "sha512-Rg8Wlt5dCbXhQnsXPrkOjL1DTSvXLgb2R/KYfnf1/K+R0k6UMLEmbQXPM+kwrWqSmWA2t0B1EtHy2/3zikQpvQ=="], | |||
|
|
|||
There was a problem hiding this comment.
The version of @oxc-project/types has been updated. Ensure that this version is compatible with other parts of the project that may depend on this package. Consider whether a more flexible version range would be appropriate to allow for minor updates without requiring lockfile changes.
|
|
||
| "@types/caseless": ["@types/caseless@0.12.5", "", {}, "sha512-hWtVTC2q7hc7xZ/RLbxapMvDMgUnDvKvMOpKal4DrMyfGBUfB1oKaZlIRr6mJL+If3bAP6sV/QneGzF6tJjZDg=="], | ||
|
|
||
| "@types/chai": ["@types/chai@5.2.3", "", { "dependencies": { "@types/deep-eql": "*", "assertion-error": "^2.0.1" } }, "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA=="], |
There was a problem hiding this comment.
A new type definition @types/chai has been added. Ensure that the version being added is the latest and compatible with the project's testing framework.
| "pino-std-serializers": ["pino-std-serializers@7.1.0", "", {}, "sha512-BndPH67/JxGExRgiX1dX0w1FvZck5Wa4aal9198SrRhZjH3GxKQUKIBnYJTdj2HDN3UQAS06HlfcSbQj2OHmaw=="], | ||
|
|
||
| "pixelmatch": ["pixelmatch@5.3.0", "", { "dependencies": { "pngjs": "^6.0.0" }, "bin": { "pixelmatch": "bin/pixelmatch" } }, "sha512-o8mkY4E/+LNUf6LzX96ht6k6CEDi65k9G2rjMtBe9Oo+VPKSvl+0GKHuH/AlG+GA5LPG/i5hrekkxUc3s2HU+Q=="], | ||
| "pixelmatch": ["pixelmatch@7.1.0", "", { "dependencies": { "pngjs": "^7.0.0" }, "bin": { "pixelmatch": "bin/pixelmatch" } }, "sha512-1wrVzJ2STrpmONHKBy228LM1b84msXDUoAzVEl0R8Mz4Ce6EPr+IVtxm8+yvrqLYMHswREkjYFaMxnyGnaY3Ng=="], |
There was a problem hiding this comment.
The version of pixelmatch has been updated. Verify that this update does not introduce any breaking changes or regressions in the visual comparison tests.
|
|
||
| "simple-xml-to-json": ["simple-xml-to-json@1.2.4", "", {}, "sha512-3MY16e0ocMHL7N1ufpdObURGyX+lCo0T/A+y6VCwosLdH1HSda4QZl1Sdt/O+2qWp48WFi26XEp5rF0LoaL0Dg=="], | ||
|
|
||
| "sirv": ["sirv@3.0.2", "", { "dependencies": { "@polka/url": "^1.0.0-next.24", "mrmime": "^2.0.0", "totalist": "^3.0.0" } }, "sha512-2wcC/oGxHis/BoHkkPwldgiPSYcpZK3JU28WoMVv55yHJgcZ8rlXvuG9iZggz+sU1d4bRgIGASwyWqjxu3FM0g=="], |
There was a problem hiding this comment.
A new library sirv has been added. Ensure that this library is indeed required and doesn't introduce any security vulnerabilities.
|
|
||
| "@jimp/core/mime": ["mime@3.0.0", "", { "bin": { "mime": "cli.js" } }, "sha512-jSCU7/VB1loIWBZe14aEYHU/+1UMEHoaO7qxCOVJOw9GgH72VAWppxNcjU+x9a2k3GSIBXNKxXQFqRvvZ7vr3A=="], | ||
|
|
||
| "@jimp/diff/pixelmatch": ["pixelmatch@5.3.0", "", { "dependencies": { "pngjs": "^6.0.0" }, "bin": { "pixelmatch": "bin/pixelmatch" } }, "sha512-o8mkY4E/+LNUf6LzX96ht6k6CEDi65k9G2rjMtBe9Oo+VPKSvl+0GKHuH/AlG+GA5LPG/i5hrekkxUc3s2HU+Q=="], |
There was a problem hiding this comment.
The version of pixelmatch has been updated. Verify that this update does not introduce any breaking changes or regressions in the visual comparison tests.
| "typescript": "^5.9.3", | ||
| "vite": "^8.0.0" | ||
| "vite": "^8.0.0", | ||
| "vite-plus": "^0.1.12" |
There was a problem hiding this comment.
The vite-plus dependency has been added. Ensure that this dependency is indeed required and doesn't introduce any security vulnerabilities.
| "typescript", | ||
| "vite" | ||
| "vite", | ||
| "vite-plus" |
There was a problem hiding this comment.
The vite-plus dependency has been added to trustedDependencies. Ensure that this dependency is indeed required and doesn't introduce any security vulnerabilities.
Changes
Technical Details
Testing
Generated with Claude Code by glm-4.7
Summary by cubic
Updated
dotagentsto the latest version and addedvite-plusto the toolchain. This keeps dependencies current and prepares our dev/build setup for recent ecosystem updates. No app code changes.dotagentssubmodule.vite-plus@^0.1.12to dev and trusted dependencies.bun.lockwith transitive updates (notable:@oxc-project/types@0.115.0,pixelmatch@7.1.0,oxlint-tsgolint@0.17.0).Written for commit dc134f1. Summary will update on new commits.