chore: update dependencies - #1405
Conversation
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 13 minutes and 35 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
📝 WalkthroughWalkthroughAdded Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Mesa DescriptionTL;DRUpdated project dependencies, introduced new development tools and a submodule, and refined Git ignore rules for Nix artifacts and local binaries. What changed?
Description generated by Mesa. Update settings |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds @getgrit/cli as a new dependency and includes it in the trustedDependencies list, with corresponding updates to the bun.lock file. The review feedback suggests alphabetically sorting both the dependencies and trustedDependencies sections in package.json to improve maintainability and ensure consistency.
| "@github/copilot": "^0.0.354", | ||
| "@google/jules": "^0.1.40", | ||
| "@getgrit/cli": "^0.1.0-alpha.1743007075", | ||
| "@nanocollective/nanocoder": "^1.16.3", | ||
| "cline": "^1.0.5", | ||
| "open-composer": "^0.8.23" |
There was a problem hiding this comment.
The dependencies are not alphabetically sorted. Sorting them improves maintainability and helps avoid duplicate entries or merge conflicts in the future.
| "@github/copilot": "^0.0.354", | |
| "@google/jules": "^0.1.40", | |
| "@getgrit/cli": "^0.1.0-alpha.1743007075", | |
| "@nanocollective/nanocoder": "^1.16.3", | |
| "cline": "^1.0.5", | |
| "open-composer": "^0.8.23" | |
| "@getgrit/cli": "^0.1.0-alpha.1743007075", | |
| "@github/copilot": "^0.0.354", | |
| "@google/jules": "^0.1.40", | |
| "@nanocollective/nanocoder": "^1.16.3", | |
| "cline": "^1.0.5", | |
| "open-composer": "^0.8.23" |
| "@github/copilot", | ||
| "@google/jules", | ||
| "@getgrit/cli", | ||
| "@nanocollective/nanocoder", | ||
| "cline", | ||
| "open-composer" |
There was a problem hiding this comment.
The trustedDependencies list should be alphabetically sorted to maintain consistency with the dependencies section and improve readability.
| "@github/copilot", | |
| "@google/jules", | |
| "@getgrit/cli", | |
| "@nanocollective/nanocoder", | |
| "cline", | |
| "open-composer" | |
| "@getgrit/cli", | |
| "@github/copilot", | |
| "@google/jules", | |
| "@nanocollective/nanocoder", | |
| "cline", | |
| "open-composer" |
There was a problem hiding this comment.
Pull request overview
Updates the Bun-managed dependency set for the dotfiles project by adding a new CLI tool and regenerating the Bun lockfile accordingly.
Changes:
- Add
@getgrit/clitodependenciesandtrustedDependenciesinpackage.json. - Regenerate
bun.lockto include@getgrit/cliand its transitive dependency graph (plus related lockfile metadata changes).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| package.json | Adds @getgrit/cli and marks it as a trusted dependency. |
| bun.lock | Lockfile regeneration to include the new package and updated resolved dependency versions/metadata. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "@github/copilot": "^0.0.354", | ||
| "@google/jules": "^0.1.40", | ||
| "@getgrit/cli": "^0.1.0-alpha.1743007075", | ||
| "@nanocollective/nanocoder": "^1.16.3", | ||
| "cline": "^1.0.5", |
There was a problem hiding this comment.
The newly added dependency is a pre-release (alpha) version and is specified with a caret range. For pre-release CLIs this can lead to unexpected upgrades on install; consider pinning to an exact version (or documenting why a floating alpha range is desired) to keep builds reproducible.
| "trustedDependencies": [ | ||
| "@github/copilot", | ||
| "@google/jules", | ||
| "@getgrit/cli", |
There was a problem hiding this comment.
Adding @getgrit/cli to trustedDependencies implicitly opts it into running install scripts. If this is not strictly required for this package to work, it would be safer to omit it; otherwise, please add a short rationale in the PR description since this expands the trusted supply-chain surface.
| "@getgrit/cli", |
| "@google/jules": "^0.1.40", | ||
| "@getgrit/cli": "^0.1.0-alpha.1743007075", | ||
| "@nanocollective/nanocoder": "^1.16.3", |
There was a problem hiding this comment.
PR title/description says "update dependencies", but this change also introduces a new dependency (@getgrit/cli). Consider calling that out explicitly in the PR description so reviewers know a new tool is being added (not just version bumps).
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@package.json`:
- Line 24: The added trustedDependencies entry for "@getgrit/cli" grants
execution of its postinstall script ("node ./install.js"); confirm whether that
postinstall is required by reviewing the package source (inspect install.js in
the `@getgrit/cli` package and the GitHub repo) and, if it is not strictly
necessary, remove "@getgrit/cli" from trustedDependencies or vendor the
dependency instead; if it must remain, document the reason inline in
package.json and pin the exact version + add a checksum/commit reference to the
repo to limit supply-chain risk.
- Line 16: The dependency "@getgrit/cli" at version "0.1.0-alpha.1743007075" is
an alpha release — confirm this is intentional and either update the
package.json entry for "@getgrit/cli" to a stable release (or a less risky
semver range) if available, or explicitly pin the alpha by keeping the exact
version and document the rationale in the PR/changeset (or README) so reviewers
know it was a deliberate choice; reference the dependency name "@getgrit/cli"
and the version string when making the change and adding the justification.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 40035c59-74af-41f5-8cc9-98224f82fa18
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (1)
package.json
| "dependencies": { | ||
| "@github/copilot": "^0.0.354", | ||
| "@google/jules": "^0.1.40", | ||
| "@getgrit/cli": "^0.1.0-alpha.1743007075", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify `@getgrit/cli` package version exists and check for security issues
echo "Checking package metadata..."
npm view `@getgrit/cli`@0.1.0-alpha.1743007075 version description 2>/dev/null || echo "Package version not found on npm registry"
echo -e "\nChecking for security advisories..."
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: NPM, package: "@getgrit/cli") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'Repository: shunkakinoki/dotfiles
Length of output: 412
🌐 Web query:
What is @getgrit/cli npm package and is version 0.1.0-alpha.1743007075 valid?
💡 Result:
@getgrit/cli is the Grit CLI: a command-line tool for running/applying GritQL code search & transformation patterns and workflows (e.g., grit apply ...). It’s distributed on npm and documented by Grit as installable via npm install --location=global @getgrit/cli``. [1][2]
Yes—version 0.1.0-alpha.1743007075 is valid:
- It is published on npm as an available release of
@getgrit/cli. [1] - The version format matches Semantic Versioning as a prerelease (
0.1.0-...) with dot-separated prerelease identifiers (alphaand a numeric identifier). [1]
Sources
- npm package page for
@getgrit/cli(shows the version and publish info) [1] - Grit CLI Quickstart docs (describes what the CLI is and how to install it) [2]
@getgrit/cli is a legitimate package; verify intentional adoption of alpha version.
The @getgrit/cli package version 0.1.0-alpha.1743007075 is published and valid. It's the Grit CLI tool, a legitimate utility for GritQL code search and transformation. However, adding an alpha version to your global dependencies carries inherent risks—alpha software may have breaking changes, instability, or be superseded by new releases without migration guidance.
Before proceeding, confirm this alpha version is intentional for your use case and consider whether a stable release version (once available) would be more appropriate for a global setup.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@package.json` at line 16, The dependency "@getgrit/cli" at version
"0.1.0-alpha.1743007075" is an alpha release — confirm this is intentional and
either update the package.json entry for "@getgrit/cli" to a stable release (or
a less risky semver range) if available, or explicitly pin the alpha by keeping
the exact version and document the rationale in the PR/changeset (or README) so
reviewers know it was a deliberate choice; reference the dependency name
"@getgrit/cli" and the version string when making the change and adding the
justification.
| "trustedDependencies": [ | ||
| "@github/copilot", | ||
| "@google/jules", | ||
| "@getgrit/cli", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Inspect `@getgrit/cli` package for postinstall scripts
echo "Checking package.json for install scripts..."
npm view `@getgrit/cli`@0.1.0-alpha.1743007075 scripts 2>/dev/null || echo "Unable to fetch package scripts"
echo -e "\nChecking package metadata..."
npm view `@getgrit/cli`@0.1.0-alpha.1743007075 name version repository 2>/dev/nullRepository: shunkakinoki/dotfiles
Length of output: 392
Verify necessity of trusting postinstall scripts for an alpha package.
Adding @getgrit/cli to trustedDependencies allows its postinstall script (node ./install.js) to execute during installation. While the repository appears legitimate (github.com/getgrit/gritql), trusting code execution from an alpha package carries security risk.
Confirm:
- Is the postinstall script necessary for this package's functionality?
- Have you reviewed the install.js script or the package source for any concerning behavior?
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@package.json` at line 24, The added trustedDependencies entry for
"@getgrit/cli" grants execution of its postinstall script ("node ./install.js");
confirm whether that postinstall is required by reviewing the package source
(inspect install.js in the `@getgrit/cli` package and the GitHub repo) and, if it
is not strictly necessary, remove "@getgrit/cli" from trustedDependencies or
vendor the dependency instead; if it must remain, document the reason inline in
package.json and pin the exact version + add a checksum/commit reference to the
repo to limit supply-chain risk.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 2 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="bun.lock">
<violation number="1" location="bun.lock:20">
P2: Adding `@getgrit/cli` to `trustedDependencies` allows its postinstall script (`node ./install.js`) to execute automatically during installation. Since this is an alpha package, this expands the trusted supply-chain surface with less-stable software. If the postinstall script isn't strictly required for functionality, omit this entry; otherwise, document the rationale.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
| "trustedDependencies": [ | ||
| "cline", | ||
| "open-composer", | ||
| "@getgrit/cli", |
There was a problem hiding this comment.
P2: Adding @getgrit/cli to trustedDependencies allows its postinstall script (node ./install.js) to execute automatically during installation. Since this is an alpha package, this expands the trusted supply-chain surface with less-stable software. If the postinstall script isn't strictly required for functionality, omit this entry; otherwise, document the rationale.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At bun.lock, line 20:
<comment>Adding `@getgrit/cli` to `trustedDependencies` allows its postinstall script (`node ./install.js`) to execute automatically during installation. Since this is an alpha package, this expands the trusted supply-chain surface with less-stable software. If the postinstall script isn't strictly required for functionality, omit this entry; otherwise, document the rationale.</comment>
<file context>
@@ -13,9 +15,10 @@
"trustedDependencies": [
+ "cline",
"open-composer",
+ "@getgrit/cli",
"@google/jules",
- "cline",
</file context>
05bf708 to
a79cd17
Compare
- Updated @anthropic-ai/claude-code from ^2.1.92 to ^2.1.94 - Updated @augmentcode/auggie from ^0.22.0 to ^0.23.0 - Updated @github/copilot from ^1.0.19 to ^1.0.21 - Updated @kaitranntt/ccs from ^7.66.0 to ^7.66.1 - Updated @sourcegraph/amp from ^0.0.1775520453-gc5dccc to ^0.0.1775606940-gada1d5 - Updated @typescript/native-preview from ^7.0.0-dev.20260406.1 to ^7.0.0-dev.20260407.1 - Updated acpx from ^0.5.1 to ^0.5.2 - Updated agentcash from ^0.13.6 to ^0.13.7 - Updated openclaw from ^2026.4.5 to ^2026.4.7 - Updated portless from ^0.9.6 to ^0.10.1 - Updated turbo from ^2.9.4 to ^2.9.5 - Updated vite from ^8.0.5 to ^8.0.7
Update project dependencies
Summary by cubic
Added
@getgrit/cliand updated dependencies (e.g.,@anthropic-ai/claude-code,vite,turbo,openclaw) to the latest patches, refreshingbun.lock.Also added
~/ghq/github.com/GoogleCloudPlatform/scion/scionto.local-binaries.txt, introduceddotagents, and expanded.gitignoreto ignore Nix build/config artifacts (result-1,target,objectstore).Written for commit 542dfa3. Summary will update on new commits.