fix(security): close all 90 open JS alerts across the scenario workspaces - #873
fix(security): close all 90 open JS alerts across the scenario workspaces#873langwatch-agent wants to merge 1 commit into
Conversation
langwatch-agent
added
the
dependabot-scout
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Included review availability: Your plan includes up to 4 reviews per rolling hour; 2 remain after this review. WalkthroughThe pull request updates dependency overrides and minimum versions in workspace configuration, the JavaScript package, and the Lovable template. It removes local overrides from the OpenAI realtime demo. ChangesDependency Override Updates
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
the
low-risk-change
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
javascript/package.json (1)
145-152: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winDocument the dependency override policy.
Add or update workspace documentation for each new
overridesandpnpm.overridesselector. State the matched range, replacement version or floor, default behavior, environment variables (none), and one example. Keeppackage.jsonmachine-readable.As per coding guidelines, JavaScript JSON/YAML configuration options must document each parameter, default values, environment variables, and configuration examples.
Also applies to: 166-196
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@javascript/package.json` around lines 145 - 152, Document every newly added dependency override selector in the relevant workspace documentation, including the matched version range, replacement version or minimum floor, default behavior, environment variables as none, and one usage example; cover both overrides sections referenced by the comment. Keep the package.json overrides unchanged and valid machine-readable JSON.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@javascript/package.json`:
- Line 166: Remove the duplicate selector declarations from the pnpm.overrides
object, keeping exactly one declaration for each repeated liquidjs, fast-uri,
postcss, brace-expansion, and `@opentelemetry/propagator-jaeger` key while
preserving the intended override values.
- Around line 146-149: The brace-expansion override currently permits version 5,
whose Node requirement excludes Node 18. In javascript/package.json lines
146-149 and docs/pnpm-workspace.yaml lines 22-24, narrow the
brace-expansion@>=3.0.0 override to a compatible 4.x range (or document and
enforce the required Node version), preserving minimatch@9.x compatibility for
Node 18 consumers.
In `@python/examples/lovable_clone/template/package.json`:
- Around line 114-118: Add an explicit pnpm packageManager declaration to the
template package.json, using the targeted pnpm version required to apply the
listed dependency overrides. Ensure the configuration aligns with the existing
pnpm.lockfile overrides and prevents the npm install path from being the only
documented installation route.
---
Nitpick comments:
In `@javascript/package.json`:
- Around line 145-152: Document every newly added dependency override selector
in the relevant workspace documentation, including the matched version range,
replacement version or minimum floor, default behavior, environment variables as
none, and one usage example; cover both overrides sections referenced by the
comment. Keep the package.json overrides unchanged and valid machine-readable
JSON.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 70cdae03-d040-4499-9183-2b9b75307987
⛔ Files ignored due to path filters (6)
docs/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamljavascript/examples/openai-realtime-demo/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamljavascript/package-lock.jsonis excluded by!**/package-lock.jsonjavascript/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlpython/examples/lovable_clone/template/package-lock.jsonis excluded by!**/package-lock.jsonpython/examples/lovable_clone/template/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (4)
docs/pnpm-workspace.yamljavascript/examples/openai-realtime-demo/package.jsonjavascript/package.jsonpython/examples/lovable_clone/template/package.json
| "js-yaml@>=4.0.0 <4.3.0": "4.3.0", | ||
| "yaml@>=2.0.0 <2.8.3": ">=2.8.3", | ||
| "brace-expansion@>=5.0.0 <5.0.6": ">=5.0.6", | ||
| "brace-expansion@<1.1.16": "1.1.16", | ||
| "brace-expansion@>=3.0.0 <5.0.8": "5.0.8", | ||
| "postcss@<8.5.18": ">=8.5.18", |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n --hidden \
--glob 'package.json' \
--glob 'pnpm-workspace.yaml' \
--glob 'pnpm-lock.yaml' \
--glob '.npmrc' \
--glob '.tool-versions' \
--glob '.node-version' \
--glob 'Dockerfile*' \
'"packageManager"\s*:|pnpm\s*:|lockfileVersion' .
sed -n '108,122p' python/examples/lovable_clone/template/package.jsonRepository: langwatch/scenario
Length of output: 1054
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf 'Files under python/examples/lovable_clone:\n'
git ls-files python/examples/lovable_clone | sed -n '1,120p'
printf '\nAll pnpm/package manager references under python/examples/lovable_clone:\n'
rg -n --hidden \
--glob 'package.json' \
--glob 'pnpm-workspace.yaml' \
--glob '.npmrc' \
--glob '.tool-versions' \
--glob '.node-version' \
--glob 'Dockerfile*' \
--glob '*.md' \
--glob '*.txt' \
--glob '*.sh' \
'packageManager|pnpm@|pnpm |pnpm-workspace.yaml|lockfileVersion|npm|yarn|npmrc' python/examples/lovable_clone || true
printf '\nRelevant template package.json tail and pnpm field if present:\n'
python3 - <<'PY'
import json, pathlib, re
p=pathlib.Path('python/examples/lovable_clone/template/package.json')
txt=p.read_text()
pat=re.search(r'^\s*"packageManager"\s*:\s*"[^"\n]+"\s*[,}]', txt, re.M)
print('packageManager:', pat.group(0) if pat else 'not found')
lines=txt.splitlines()
for i in range(108, min(len(lines),125)+1):
print(f'{i:4}: {lines[i-1]}')
print(json.loads(txt)['pnpm']['overrides'] if 'pnpm' in json.loads(txt) else {})
PY
printf '\nDiff/stat for this file:\n'
git diff --stat -- python/examples/lovable_clone/template/package.json || true
git diff -- python/examples/lovable_clone/template/package.json | sed -n '1,220p' || trueRepository: langwatch/scenario
Length of output: 7038
Add an explicit supported pnpm path for these package.json overrides.
This template uses npm install, but package.json still depends on pnpm overrides in pnpm.lockfile. Add a packageManager entry for the pnpm version that must be used, or install with the targeted pnpm version, otherwise users may not apply these security overrides consistently.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@python/examples/lovable_clone/template/package.json` around lines 114 - 118,
Add an explicit pnpm packageManager declaration to the template package.json,
using the targeted pnpm version required to apply the listed dependency
overrides. Ensure the configuration aligns with the existing pnpm.lockfile
overrides and prevents the npm install path from being the only documented
installation route.
Source: MCP tools
langwatch-agent
added
the
hound-checked
langwatch-agent
added
the
ci-green
8f15d88 to
6eae1eb
Compare
github-actions
Bot
removed
the
low-risk-change
|
Rebased onto main and substantially expanded: floors raised to current, now 105 of the 110 open JS alerts instead of 37. Two structural findings are written up in the description (an entire example's overrides were inert because it is a workspace member, and |
6eae1eb to
ee6a35d
Compare
|
Added the react-router 7 migration for the This PR now closes 110 of the 110 open JS alerts in scenario, up from 105. Nothing on the JS side is left behind after it merges. I had previously written these five off as "a v6 to v7 migration, which is a different kind of change from a floor bump". That was too quick a judgement. The template only ever used the v7-compatible subset of the API:
All four are still exported by
Verified in a browser, not just on the build, since a passing build says nothing about whether routes actually resolve:
|
8daa1d4 to
11d2965
Compare
|
Rebased onto current main, which added the Re-ran the closure check across the whole scenario inbox afterwards. All 148 open alerts are live (no stale manifests in this repo), and this PR plus #857 close every one of them: 110 here, 38 there, 0 left over. The only two entries the checker cannot see a resolved version for are Ready for human review. |
11d2965 to
df36631
Compare
langwatch-agent
changed the title
df36631 to
b2c733f
Compare
|
CI caught a real regression in the first push of this branch, and it is fixed in
The cause was my own override selector. I had written the floors as Main's original selectors had lower bounds ( Every selector this PR touches now carries one, I only added bounds to the selectors this PR introduces or raises. Pre-existing entries are untouched, deliberately: Re-verified after the fix: closure still 90 of 90; Two failures remain on this branch that are not from it, both reproduced on an untouched |
|
Second CI finding, and this one is not from this branch: Same file, same error, same Cause. Fix. Declare the same Verified locally. The import-time TypeError is gone; the suite now gets into the test body and stops at Alert closure is unchanged at 90 of 90. Worth flagging separately: this went red on main and stayed red. If the intent is for |
…aces Raises the transitive override floors in the three files that own them and retires two lockfiles that nothing installs from. Every selector carries an explicit lower bound, `pkg@>=N.0.0 <fix`. A bare `pkg@<fix` also matches every lower major, so a floor written for one line silently captures the others: `brace-expansion@<5.0.7` matches 1.1.14 too, which handed minimatch 3.1.5 a brace-expansion 5 and made eslint die with `TypeError: expand is not a function`. With the bounds the tree keeps brace-expansion 1.1.18 and 5.0.9 side by side, and js-yaml 3.15.1, 4.3.1 and 5.2.2, each patched within its own line. Where main already carried a floor it is raised in place rather than added alongside. pnpm matches only the first selector for a package name, so a second entry would have been shadowed by the stale one: docs had an unscoped `hono: '>=4.12.25'` sitting in front of the advisory floor, and dompurify, js-yaml, mermaid, postcss, liquidjs and fast-uri were all pinned below their current advisory ranges. Targets are capped as well as bounded; javascript/pnpm-lock.yaml had resolved fast-uri 4.1.2 off an uncapped floor and now resolves 3.1.5. javascript/package-lock.json is removed. Every workflow installs with `pnpm install --frozen-lockfile`, nothing in the repo reads the npm lock, and its only commits are release version bumps, so it had drifted far enough that regenerating it moved @openai/agents 0.3.9 to 0.16.1 and dropped 53 packages. It was carrying 28 alerts on a file no install touches. The pnpm lockfile beside it resolves the same packages safely. javascript/examples/openai-realtime-demo/ is a declared member of the javascript workspace, so its pnpm.overrides block is inert and its lockfile is an orphan that pnpm never writes. Six of its seven floors were already superseded at the root; the seventh, ajv, moves there. The lovable_clone template moves to react-router 7. react-router-dom #551 has no patched release in the 6.x line, so leaving 6.x was the only way to close it. The template uses only the v7-compatible surface, BrowserRouter/Routes/Route in App.tsx and useLocation in NotFound.tsx, so no code changed. @remix-run/router disappears from both lockfiles because v7 folded it in, which also retires the overrides that pinned it. postcss is a direct devDependency of the template, and npm refuses an override that conflicts with one, so its floor is carried by the direct pin instead. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
d20e19d to
ae7184a
Compare
|
Rebased onto current main. Two notes on state. Main absorbed the zod fix from this branch. The red on this PR is not from this PR.
So |
langwatch-agent
removed
the
ci-green
|
Automated low-risk assessment This PR was evaluated against the repository's Low-Risk Pull Requests procedure and does not qualify as low risk.
This PR requires a manual review before merging. |
1 participant
What
Closes all 90 open JavaScript alerts across the scenario workspaces. With #857 (the 38 on
python/uv.lock) that is the entire scenario inbox, 128 of 128.javascript/package-lock.jsondocs/pnpm-lock.yamldocs/pnpm-workspace.yamljavascript/examples/openai-realtime-demo/pnpm-lock.yamlpython/examples/lovable_clone/template/pnpm-lock.yamlpython/examples/lovable_clone/template/package-lock.jsonjavascript/pnpm-lock.yamljavascript/package.jsonRaising in place, not adding alongside
pnpm matches only the first selector for a package name, so adding a correctly-scoped floor next to a stale one leaves the stale one in charge. Main had exactly that shape:
docs/pnpm-workspace.yamlcarried an unscopedhono: '>=4.12.25', which would have sat in front of anything new. Six entries were raised in place there, five injavascript/package.json's pnpm block, four in its npm block, and three in the template.Every selector is scoped to one major line (
"pkg@<fix": ">=fix <next"). Two packages needed more than one because the tree carries parallel majors:brace-expansion(1.x, 2.x and 5.x) andjs-yaml(3.x and 4.x). Targets are capped so a floor cannot float across a major, which was not academic here:javascript/pnpm-lock.yamlhad resolved fast-uri 4.1.2 off an uncappedfast-uri@<=3.1.1 -> >=3.1.2, and now resolves 3.1.5.Two lockfiles removed
javascript/package-lock.jsoncarried the largest single share of the inbox, 28 alerts, and nothing installs from it. Every workflow usespnpm install --frozen-lockfile; there is nonpm ciornpm installanywhere in.github/; nothing in the repo references the file; and its entire commit history is release version bumps. It had drifted far enough that regenerating it moved@openai/agents0.3.9 to 0.16.1 and removed 53 packages, and it cannot be regenerated at all without--legacy-peer-deps(a pre-existing zod peer conflict that reproduces on main untouched). Committing that would be shipping a lock nothing validates. Thepnpm-lock.yamlbeside it resolves the same packages at safe versions.javascript/examples/openai-realtime-demo/pnpm-lock.yamlis an orphan. The directory is a declared member of the javascript workspace, so pnpm ignores itspnpm.overridesand writes the parent lock instead. Six of its seven floors were already superseded at the root; the seventh,ajv, moves there. Checked before removing.react-router 7 in the lovable_clone template
react-router-dom#551 has no patched release in the 6.x line, so leaving 6.x was the only way to close it. The template uses only the v7-compatible surface (BrowserRouter,Routes,Routeinsrc/App.tsx;useLocationinsrc/pages/NotFound.tsx), so no application code changed.@remix-run/routerdisappears from both lockfiles because v7 folded it in, which is why alerts #613 and #616 close by the package no longer existing.postcssis a direct devDependency there and npm rejects an override that conflicts with a direct dependency, so its floor is carried by the direct pin.Verified
vulnerableVersionRange: 0 of 90 left openpnpm install --frozen-lockfileexit 0 injavascript/,docs/and the templatetsc --noEmitexit 0,pnpm buildexit 0/renders,/definitely-not-a-routerenders the 404 with its intentionalconsole.errorcarrying the pathname (souseLocation()resolves), the "Return to Home" link client-side navigates, and browser-back returns to the 404docs:pnpm buildexit 0Pre-existing failures, not from this PR
pnpm typecheckinjavascript/anddocs/fails withTS2688: Cannot find type definition file for 'yauzl'. Confirmed identical on a clean checkout oforigin/main, so it predates this change. Filed separately.