fix: add caret prefix to paperclipai dependency - #1349
Conversation
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Mesa DescriptionTL;DRAdd What changed?
Description generated by Mesa. Update settings |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates paperclipai to a canary version and downgrades pino and pino-http to version 9 via dependency overrides. Feedback was provided to remove a trailing comma in the bun.lock file to prevent parsing issues and to request justification for the major version downgrades to avoid potential regressions or security risks.
| ], | ||
| "overrides": { | ||
| "pino": "9.6.0", | ||
| "pino-http": "9.0.0", |
There was a problem hiding this comment.
The trailing comma at the end of the overrides block is inconsistent with the rest of the bun.lock file and may cause parsing issues. Standard JSON and the Bun lockfile format typically do not include trailing commas for the last item in an object. This suggests the lockfile may have been manually edited, which is generally discouraged; it is safer to let bun install regenerate it.
"pino-http": "9.0.0"
| "overrides": { | ||
| "pino": "9.6.0", | ||
| "pino-http": "9.0.0" | ||
| }, |
There was a problem hiding this comment.
The addition of the overrides section forces a major version downgrade for pino (from v10.3.1 to 9.6.0) and pino-http (from v10.5.0 to 9.0.0). This significant change is not mentioned in the pull request summary. Forcing a downgrade can lead to regressions, loss of performance improvements, or security vulnerabilities addressed in the newer major versions. Please provide a justification for this downgrade in the PR description.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 2 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="bun.lock">
<violation number="1" location="bun.lock:124">
P2: The `overrides` section forces major version downgrades for `pino` (10.3.1 → 9.6.0) and `pino-http` (10.5.0 → 9.0.0). The `pino-http` override to 9.0.0 is particularly concerning since `@paperclipai/server` declares `"pino-http": "^10.4.0"` as its dependency — the override forces a version below the library's own declared minimum, which may cause runtime incompatibilities. Additionally, `pino-http@9.0.0` declares a peer/dependency on `"pino": "^8.17.1"`, not `^9`, creating a potential version mismatch. If these downgrades are intentional (e.g., to work around a bug), please document the justification.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
| "@googleworkspace/cli", | ||
| ], | ||
| "overrides": { | ||
| "pino": "9.6.0", |
There was a problem hiding this comment.
P2: The overrides section forces major version downgrades for pino (10.3.1 → 9.6.0) and pino-http (10.5.0 → 9.0.0). The pino-http override to 9.0.0 is particularly concerning since @paperclipai/server declares "pino-http": "^10.4.0" as its dependency — the override forces a version below the library's own declared minimum, which may cause runtime incompatibilities. Additionally, pino-http@9.0.0 declares a peer/dependency on "pino": "^8.17.1", not ^9, creating a potential version mismatch. If these downgrades are intentional (e.g., to work around a bug), please document the justification.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At bun.lock, line 124:
<comment>The `overrides` section forces major version downgrades for `pino` (10.3.1 → 9.6.0) and `pino-http` (10.5.0 → 9.0.0). The `pino-http` override to 9.0.0 is particularly concerning since `@paperclipai/server` declares `"pino-http": "^10.4.0"` as its dependency — the override forces a version below the library's own declared minimum, which may cause runtime incompatibilities. Additionally, `pino-http@9.0.0` declares a peer/dependency on `"pino": "^8.17.1"`, not `^9`, creating a potential version mismatch. If these downgrades are intentional (e.g., to work around a bug), please document the justification.</comment>
<file context>
@@ -120,6 +120,10 @@
"@googleworkspace/cli",
],
+ "overrides": {
+ "pino": "9.6.0",
+ "pino-http": "9.0.0",
+ },
</file context>
There was a problem hiding this comment.
Pull request overview
Updates the Bun-managed dependency graph for this repo’s CLI/tooling by bumping paperclipai to a newer canary and introducing dependency overrides.
Changes:
- Bump
paperclipaifrom^2026.325.0to^2026.403.0-canary.10 - Add
overridesforpinoandpino-http - Regenerate
bun.lockto reflect the new resolution
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| package.json | Updates paperclipai version and adds overrides for pino/pino-http. |
| bun.lock | Updates resolved paperclipai (and related @paperclipai/*) packages and applies the new overrides in the lockfile. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| @@ -67,6 +67,10 @@ | |||
| "vite-plus": "^0.1.14", | |||
| "xcodebuildmcp": "^2.3.1" | |||
| }, | |||
| "overrides": { | |||
| "pino": "9.6.0", | |||
| "pino-http": "9.0.0" | |||
| }, | |||
There was a problem hiding this comment.
PR metadata says this change is only adding a caret prefix to paperclipai (2026.403.0-canary.10 -> ^...), but paperclipai was already caret-ranged and this diff also bumps the version (from ^2026.325.0) and introduces new overrides entries. Please update the PR title/description to reflect the actual changes, or split the overrides into a separate PR if they’re unrelated.
| "open-composer": "^0.8.23", | ||
| "openclaw": "^2026.3.28", | ||
| "paperclipai": "^2026.325.0", | ||
| "paperclipai": "^2026.403.0-canary.10", |
There was a problem hiding this comment.
Be careful relying on ^2026.403.0-canary.10 to “allow compatible minor/patch updates”: SemVer range matching typically excludes prerelease versions unless the range explicitly opts into them, which can lead to unexpected behavior (e.g., later -canary.* versions may not satisfy this range even if they’re higher). If the intent is to track canary updates, consider using an explicit range strategy that actually matches the desired prerelease stream, or pin the exact version to avoid surprise upgrades.
| "paperclipai": "^2026.403.0-canary.10", | |
| "paperclipai": "2026.403.0-canary.10", |
| "overrides": { | ||
| "pino": "9.6.0", | ||
| "pino-http": "9.0.0" |
There was a problem hiding this comment.
The new overrides force pino-http to 9.0.0, but @paperclipai/server@2026.403.0-canary.10 declares pino-http: ^10.4.0 (see bun.lock). This override violates the upstream version range and is likely to break runtime behavior. Either remove the overrides or pin versions that satisfy the dependency ranges (and add a note explaining why overrides are required).
| "overrides": { | |
| "pino": "9.6.0", | |
| "pino-http": "9.0.0" | |
| "overridesNote": "Overrides are pinned to versions that satisfy upstream dependency ranges; keep pino-http on a 10.x release compatible with @paperclipai/server.", | |
| "overrides": { | |
| "pino": "9.6.0", | |
| "pino-http": "10.4.0" |
* feat: add paperclip service (#1342) * feat: add paperclip service - Systemd service on kyber: runs `paperclipai run` via bun, depends on docker-postgres - Config via builtins.toJSON: external postgres on kyber, embedded on macOS - Setup script creates paperclip database on docker-postgres - Makefile target: `make systemctl-paperclip` * fix: add shellcheck disable and shell test coverage for paperclip * fix: correct shellcheck disable directive syntax * refactor: use config.template.json pattern for paperclip * refactor: rename setup.sh to hydrate.sh for paperclip * test: add auto-switch hook tests and update coverage spec * fix: remove EnvironmentFile from paperclip service (#1344) * fix: paperclip authenticated mode and required config fields (#1345) * fix: remove EnvironmentFile from paperclip service * fix: use authenticated mode on kyber, add required meta/logging fields * fix: add allowedHostnames for paperclip.shunkakinoki.com * fix: format config template json * fix: use trust auth for docker-postgres (#1346) POSTGRES_HOST_AUTH_METHOD=trust removes password auth for all connections. The password kept going out of sync after crash recovery, causing paperclip and other services to fail with 'password authentication failed'. Safe since postgres is only reachable from the host. * fix: use k8s postgres via DATABASE_URL, remove docker-postgres dep, add authenticated mode (#1347) * fix: use bun runtime for paperclip (pino-http node crash), k8s postgres via DATABASE_URL (#1348) * fix: use nix-profile bun path for paperclip service (#1350) * fix: add caret prefix to paperclipai dependency (#1349) * fix: use extra-substituters to avoid untrusted user warnings (#1351) * fix: run paperclip from cloned repo via pnpm dev:once (#1352) * fix: run paperclip from cloned repo via pnpm dev:once The global bun install flattens pino@10 + pino-http@10.5 together, but pino-http needs pino@9. The repo lockfile resolves this correctly with nested dependencies. Running from the repo avoids the crash. * fix: use bun run server/src/index.ts instead of pnpm dev:once * fix: pin pino@9.14.0 override, run paperclipai from dotfiles node_modules The bun flat hoisting was resolving pino@10 which is incompatible with pino-http@10.5. Pinning pino to 9.14.0 via overrides matches the paperclip repo's lockfile resolution and fixes the crash. * fix: use global bun paperclipai with pino override (#1353) * fix: use global ~/.bun/bin/paperclipai with pino override Propagate overrides from dotfiles package.json to ~/.bun/install/global/ so the global binary resolves pino@9.14.0 correctly. * test: add tests for npm-globals dependency overrides * fix: resolve GitHub Actions failures and code review issues - Fix non-portable \s regex to [[:space:]] in auto-switch.sh (shfmt compat) - Add jq dependency check alongside cswap - Use printf instead of echo for safer output - Fix claude-swap version from >=1.1.5 (non-existent) to >=0.7.1 - Add auto-switch.sh to Nix deployment config (default.nix) - Sort covered_scripts list alphabetically in coverage_spec.sh https://claude.ai/code/session_012GyQBesQGF1asTfKebWyLM --------- Co-authored-by: Claude <noreply@anthropic.com>
Summary
^prefix topaperclipaidependency version ("2026.403.0-canary.10"->"^2026.403.0-canary.10") to allow compatible minor/patch updatesSummary by cubic
Switch
paperclipaito a caret range and bump to^2026.403.0-canary.10to receive compatible updates. Pinpinoandpino-httpto v9 viaoverridesto avoid v10 breaking changes.paperclipaito^2026.403.0-canary.10(lockfile aligns related@paperclipai/*packages).overrides:pino@9.6.0,pino-http@9.0.0.Written for commit 0097c1a. Summary will update on new commits.