chore: update dependencies - #1627
Conversation
|
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
📝 WalkthroughSummary by CodeRabbit
WalkthroughThis PR updates dependency version ranges in Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 0/1 reviews remaining, refill in 60 minutes.Comment |
Mesa DescriptionTL;DRUpdate package dependencies. What changed?File summaries are not available, so specific changes cannot be listed. Description generated by Mesa. Update settings |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
package.json (1)
14-74:⚠️ Potential issue | 🟠 MajorRegenerate
bun.lockto include these dependency changes.The repository commits
bun.lock, but it was not updated alongside thepackage.jsonchanges in this PR. Without regenerating the lockfile, dependency resolution in CI and reproducible installs will use the outdated locked versions. Runbun installto regeneratebun.lockand include it in this PR.Additionally, consider pinning
@typescript/native-previewto an exact version instead of the floating caret range (^7.0.0-dev.20260430.1), as snapshot/dev versions should typically be locked to specific builds to avoid unexpected changes in subsequent installs.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@package.json` around lines 14 - 74, The PR updated dependencies in package.json but did not regenerate bun.lock; run bun install to regenerate bun.lock, stage and include the updated bun.lock in this PR so CI uses the new resolved versions; also change the `@typescript/native-preview` entry in package.json from a caret range (^7.0.0-dev.20260430.1) to an exact version (remove the ^) to pin that dev snapshot and re-run bun install to ensure the lockfile reflects the pinned `@typescript/native-preview`.
🧹 Nitpick comments (1)
package.json (1)
44-44: Pin the preview TypeScript snapshot exactly.The range
^7.0.0-dev.20260430.1matches any version ≥ 7.0.0-dev.20260430.1 and < 8.0.0.0, including future dev snapshots with later timestamps (e.g., 7.0.0-dev.20260501.2). Since@typescript/native-previewreleases daily, clean installs may silently upgrade to newer dev versions that haven't been validated, risking unexpected breakage. Exact pinning ensures reproducible builds.Suggested change
- "@typescript/native-preview": "^7.0.0-dev.20260430.1", + "@typescript/native-preview": "7.0.0-dev.20260430.1",🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@package.json` at line 44, Replace the floating semver for the `@typescript/native-preview` dependency by pinning it to the exact snapshot instead of a range: change the entry "@typescript/native-preview": "^7.0.0-dev.20260430.1" to use the exact version string (e.g., "@typescript/native-preview": "7.0.0-dev.20260430.1") so installs cannot pick up newer daily dev snapshots; after changing the package.json run your package manager to update the lockfile.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@package.json`:
- Around line 14-74: The PR updated dependencies in package.json but did not
regenerate bun.lock; run bun install to regenerate bun.lock, stage and include
the updated bun.lock in this PR so CI uses the new resolved versions; also
change the `@typescript/native-preview` entry in package.json from a caret range
(^7.0.0-dev.20260430.1) to an exact version (remove the ^) to pin that dev
snapshot and re-run bun install to ensure the lockfile reflects the pinned
`@typescript/native-preview`.
---
Nitpick comments:
In `@package.json`:
- Line 44: Replace the floating semver for the `@typescript/native-preview`
dependency by pinning it to the exact snapshot instead of a range: change the
entry "@typescript/native-preview": "^7.0.0-dev.20260430.1" to use the exact
version string (e.g., "@typescript/native-preview": "7.0.0-dev.20260430.1") so
installs cannot pick up newer daily dev snapshots; after changing the
package.json run your package manager to update the lockfile.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: d0dd3bd6-447b-4a14-8812-0f70c9241153
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (1)
package.json
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates numerous dependencies across package.json and bun.lock. The reviewer identified several instances of dependency duplication and version fragmentation resulting from these updates. Specifically, bumps to @mariozechner/pi-coding-agent, @openai/codex, openclaw, oxfmt, and oxlint conflict with the versions required by other packages in the tree. There is also a concern regarding a potential regression in the @anthropic-ai/sdk version. It is recommended to utilize the overrides field to unify these dependencies and ensure project-wide consistency.
| "@kaitranntt/ccs": "^7.74.0", | ||
| "@mariozechner/pi-coding-agent": "^0.70.2", | ||
| "@kaitranntt/ccs": "^7.75.0", | ||
| "@mariozechner/pi-coding-agent": "^0.71.0", |
There was a problem hiding this comment.
Updating @mariozechner/pi-coding-agent to ^0.71.0 while openclaw (updated to ^2026.4.29) still resolves to version 0.70.6 for its internal dependencies creates version fragmentation. This is visible in the bun.lock changes where multiple versions of the pi-agent ecosystem are now present. Consider using overrides to unify these versions.
| "@oh-my-pi/pi-natives": "^14.5.12", | ||
| "@oh-my-pi/swarm-extension": "^13.17.0", | ||
| "@openai/codex": "^0.125.0", | ||
| "@openai/codex": "^0.128.0", |
There was a problem hiding this comment.
Updating @openai/codex to ^0.128.0 while leaving other related packages (like @openai/codex-sdk) on older versions leads to dependency duplication in the lockfile. Version 0.125.0 is still being pulled in as a sub-dependency. Consider using overrides to enforce a single version across the project.
| "oxfmt": "^0.46.0", | ||
| "oxlint": "^1.61.0", | ||
| "paperclipai": "^2026.416.0", | ||
| "openclaw": "^2026.4.29", |
There was a problem hiding this comment.
The update to openclaw@^2026.4.29 introduces a downgrade of the nested @anthropic-ai/sdk dependency to 0.90.0 (from 0.91.1 previously used in the project). This may lead to regressions or missing features in the AI components. Consider using overrides to ensure the latest version of the SDK is used consistently.
| "oxfmt": "^0.47.0", | ||
| "oxlint": "^1.62.0", |
There was a problem hiding this comment.
The update of oxfmt to ^0.47.0 and oxlint to ^1.62.0 results in duplication because vite-plus (even at version 0.1.20) still pulls in the previous versions (0.46.0 and 1.61.0). This increases the project's footprint and can cause subtle bugs if these tools expect singleton behavior. Using overrides in package.json can help deduplicate these.
1 participant
Update package dependencies