chore(deps): apply security and in-range upgrades - #369
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
There was a problem hiding this comment.
🟢 Approval recommended
The changes are dependency-only, the updated versions resolve cleanly in the lockfile, and the PR’s stated verification covers typecheck, lint, build, and the full test suite.
Pull request overview
Updates project dependencies (runtime + dev tooling) to pick up security fixes (including Supabase CLI tar advisory fixes) and reduce pnpm audit findings, while keeping the dependency set within declared version ranges.
Changes:
- Bumped a broad set of runtime dependencies (e.g.,
@supabase/supabase-js,react-hook-form,zod,framer-motion) to newer in-range versions. - Upgraded development/test/tooling dependencies (e.g.,
supabaseCLI,@playwright/test,typescript,vite,vitest,oxlint,prettier).
File summaries
| File | Description |
|---|---|
| package.json | Updates dependency and devDependency version ranges to newer in-range/security-fixed versions (including Supabase CLI). |
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
There was a problem hiding this comment.
🔵 Needs a closer look
It upgrades a large number of dependencies/tooling at once, which can introduce subtle runtime or build behavior changes that warrant a final human review despite reported passing checks.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
There was a problem hiding this comment.
🟡 Changes recommended
The PR description claims the Supabase CLI was bumped, but the shown diff does not update the supabase devDependency, so the PR intent needs to be clarified or the change completed.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 1
- Review effort level: Lite
Playwright test results
Details
Failed testschromium › navigation.spec.ts › Navigation › should navigate to different pages |
Playwright test results
Details
Failed testschromium › navigation.spec.ts › Navigation › should navigate to different pages Flaky testsMobile Safari › not-found-routes.spec.ts › Invalid festival/edition slugs › shows edition-specific not found UI for an invalid edition slug |
There was a problem hiding this comment.
🔵 Needs a closer look
The repo contains a committed package-lock.json that is now clearly out of sync with the updated pnpm-managed dependencies, which can cause inconsistent installs and misleading dependency/security scanning.
Review details
Suppressed comments (1)
Previously missed (1) — in code that hasn't changed since the last review.
package.json:65
package-lock.jsonis checked in but now diverges from the pnpm-managed dependency set (e.g., it still lists@supabase/supabase-js: ^2.105.0whilepackage.jsonis now^2.112.3). This can lead to inconsistent installs and misleading dependency/security scanning; consider removingpackage-lock.json(and ignoring it) or regenerating it so it stays in sync with the chosen package manager.
"@radix-ui/react-tooltip": "^1.2.16",
"@supabase/supabase-js": "^2.112.3",
"@tailwindcss/line-clamp": "^0.4.4",
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
There was a problem hiding this comment.
🟡 Changes recommended
The PR description claims dependency changes were reverted to match main, but the current package.json still includes many version bumps, so the PR intent and actual changes are inconsistent.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 1
- Review effort level: Lite
There was a problem hiding this comment.
🔵 Needs a closer look
The PR description claims vite is excluded from this batch, but package.json includes a vite upgrade, so the code and description need to be reconciled.
Review details
Suppressed comments (1)
package.json:133
- PR description says
viteis excluded from this upgrade batch pending individual verification, butpackage.jsonbumpsviteto^7.3.6. To keep the PR description accurate, either revert theviteversion in this batch or update the PR description to includeviteamong the verified upgrades.
"vite": "^7.3.6",
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
There was a problem hiding this comment.
🟢 Approval recommended
The changes are limited to dependency version bumps and the PR description indicates CI/typecheck/tests are passing for this batch.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
Bumps supabase CLI (2.70.0 -> 2.115.0) to fix tar/node-tar advisories, and updates all in-range devDependencies/dependencies via pnpm update (postcss, oxlint, posthog-js, vitest, playwright, prettier, etc.), resolving 40 of 45 pnpm audit findings.
The prettier bump to 3.9.6 changed formatting rules and would have reformatted 14 files; reverting to 3.6.2 here so this PR stays scoped to dependency version bumps. Formatting migration can be a separate PR. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014JqTa7k1smvXm4AbVzBhqt
The 2.70.0 -> 2.115.0 bump appears to change `supabase db reset` seed behavior, causing the Edge Function Tests CI job to fail with "No festival edition found". Reverting to keep this PR's CI green; the CLI security fix needs its own PR once the seeding regression is diagnosed against a reproducible Supabase environment. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014JqTa7k1smvXm4AbVzBhqt
1.54.1 -> 1.62.1 causes navigation.spec.ts and not-found-routes.spec.ts to consistently fail on a router-timing race (asserting on a URL that the client has already navigated past). Reverting to unblock this PR; the playwright upgrade can be redone once the timing issue is fixed or the tests are made more robust to it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014JqTa7k1smvXm4AbVzBhqt
Reverts package.json/pnpm-lock.yaml back to main's versions. The supabase CLI and prettier bumps were already reverted for breaking db reset seeding and reformatting 14 files; the remaining in-range bumps also turned out to break navigation.spec.ts/not-found-routes.spec.ts e2e smoke tests (a router-redirect timing issue) even after reverting the playwright bump, and the root cause needs more investigation than fits in this PR. Redo the dependency upgrade as a separate, more carefully tested change. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014JqTa7k1smvXm4AbVzBhqt
Bumps application and dev dependencies unrelated to build tooling (react-hook-form, framer-motion, radix supporting libs, testing-library, typescript, oxlint, etc). Excludes vite, vite-plugin-pwa, playwright, prettier, and the supabase CLI, which broke CI in earlier attempts and are being verified individually. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014JqTa7k1smvXm4AbVzBhqt
Isolated from the earlier combined bump to verify individually against CI's e2e suite, since that combination previously broke navigation timing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014JqTa7k1smvXm4AbVzBhqt
Isolated bump reproduced the single-edition auto-redirect e2e failure (navigation.spec.ts, not-found-routes.spec.ts) that we previously saw on a combined bump. vite is implicated in the regression; reverting here and will investigate separately before reattempting.
The e2e navigation/not-found-routes failure reproduced again on the prior commit even after reverting vite, proving vite wasn't the actual cause. It's the same pre-existing flake already confirmed to reproduce on main itself (byte-identical commit 58fdc18). Re-applying the vite bump since it isn't implicated.
f2e565b to
f1aa249
Compare
There was a problem hiding this comment.
🟢 Approval recommended
The changes are limited to dependency version bumps and a gitignore addition, and no concrete issues were found in the updated manifests.
Review details
- Files reviewed: 1/3 changed files
- Comments generated: 0 new
- Review effort level: Lite
Applying in-range dependency upgrades incrementally, one batch/package at a time, verifying CI between each after several combined bumps broke things (supabase CLI seed regression, prettier reformatting, an e2e router-redirect timing issue). Currently: low-risk app/dev dependency bumps (react-hook-form, framer-motion, radix support libs, testing-library, typescript, oxlint, etc) plus
vite(^7.2.7→^7.3.6). The navigation/not-found-routes e2e failure (/festivals/reveal-test,/festivals/test/editions/...) is a pre-existing flake — it reproduces identically onmainitself (confirmed on byte-identical commit 58fdc18) and also reproduced after reverting vite, so it isn't caused by this PR. Still excluded pending individual verification: vite-plugin-pwa, playwright, prettier, and the supabase CLI.Verification
pnpm run typecheckpassespnpm run format:checkpassespnpm test run— 515/515 tests pass