chore(docs): bump Blume to 1.4.2 - #221
Conversation
Pin Blume 1.4.2, drop undici and obsolete audit overrides, add nanoid/ js-yaml pins from the hub canary, and ignore unfixed image-size highs in CI until a patched release exists.
|
📝 WalkthroughWalkthroughThe pull request updates the ChangesDependency and audit maintenance
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Around line 131-132: Update the dependency-maintenance documentation to
describe the purpose of the js-yaml and nanoid overrides and include an example
for each. Keep these explanations outside package.json so its JSON remains
valid, and ensure the documented examples match the configured override
versions.
- Around line 131-132: Document package.json root overrides with examples for
js-yaml, nanoid, hono, path-to-regexp, and qs, and inspect the current bun.lock
to confirm removed root overrides for brace-expansion, fast-uri, ip-address, and
undici are not reintroduced through other dependency consumers; adjust the
dependency configuration or lockfile as needed to preserve that validation.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: f5ff12a5-0e2a-48f5-b0ea-391cf8cd0fec
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (3)
.github/workflows/ci.ymlapps/docs/package.jsonpackage.json
| "js-yaml": "4.3.1", | ||
| "nanoid": "3.3.18", |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Document the changed override configuration.
Add the purpose and an example for the js-yaml and nanoid overrides in the dependency-maintenance documentation. Keep package.json valid JSON; do not add comments.
As per coding guidelines: Document all configuration options with examples.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` around lines 131 - 132, Update the dependency-maintenance
documentation to describe the purpose of the js-yaml and nanoid overrides and
include an example for each. Keep these explanations outside package.json so its
JSON remains valid, and ensure the documented examples match the configured
override versions.
Source: Coding guidelines
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
pattern='"(blume|js-yaml|nanoid|brace-expansion|fast-uri|ip-address|undici)"'
echo "Workspace manifests:"
while IFS= read -r file; do
rg -n -C 3 "$pattern" "$file" || true
done < <(fd -a -t f 'package.json' -E node_modules -E .git)
echo "Resolved lockfile entries:"
rg -n -C 3 "$pattern" bun.lockRepository: stainless-code/codemap
Length of output: 233
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Repository files list snippets:"
git ls-files | sed -n '1,80p'
echo
echo "package.json relevant sections:"
if [ -f package.json ]; then
cat -n package.json | sed -n '1,190p'
fi
echo
echo "Find package.json files:"
fd -a -t f 'package\.json$' -E node_modules -E .git || trueRepository: stainless-code/codemap
Length of output: 9591
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "All package.json files:"
fd -a -t f 'package\.json$' -E node_modules -E .git
echo
echo "apps/package.json:"
cat -n apps/package.json 2>/dev/null || true
echo
echo "apps/docs package.json:"
cat -n apps/docs/package.json 2>/dev/null || true
echo
echo "fixtures/minimal package.json:"
cat -n fixtures/minimal/package.json 2>/dev/null || true
echo
echo "Target occurrences in tracked manifests (case-insensitive names):"
python3 - <<'PY'
import json,n(pathlib as PATH)
from pathlib import Path
targets={'blume','js-yaml','nanoid','brace-expansion','fast-uri','ip-address','undici'}
for p in sorted(Path('.').glob('**/package.json')):
path=str(p)
if any(part in {'node_modules','.git'} for part in Path(path).parts): continue
try: data=json.loads(path.read_text())
except Exception: continue
print(f'--- {path} ---')
for key, value in data.get('dependencies',{}).items():
if key.lower() in targets: print(f'dependency {key}: {value}')
for key, value in data.get('devDependencies',{}).items():
if key.lower() in targets: print(f'devDependency {key}: {value}')
for key in data.get('overrides',{}):
if key.lower() in targets: print(f'override {key}: {data["overrides"][key]}')
PY
echo
echo "Target references outside manifests in tracked files:"
rg -n -i --glob '!node_modules/**' --glob '!fixtures/**' '(\b(blume|js-yaml|nanoid|brace-expansion|fast-uri|ip-address|undici)\b)' . || trueRepository: stainless-code/codemap
Length of output: 1358
🏁 Script executed:
#!/bin/bash
set -u
echo "bun.lock target entries:"
rg -n -C 3 '(^|["'\''])@(blume|js-yaml|nanoid|brace-expansion|fast-uri|ip-address|undici)(?:@|["'\''": ]|/)' bun.lock || true
echo
echo "Python manifest scan:"
python3 - <<'PY'
import json
from pathlib import Path
targets={'blume','js-yaml','nanoid','brace-expansion','fast-uri','ip-address','undici'}
for p in sorted(Path('.').glob('**/package.json')):
if {'node_modules','.git'}.intersection(p.parts): continue
data=json.loads(p.read_text())
print(f'--- {p} ---')
for sec in ('dependencies','devDependencies','overrides'):
vals=data.get(sec,{})
print(sec, {k:vals.get(k) for k in vals if k.lower() in targets})
PY
echo
echo "Package references outside manifests:"
rg -n -i --glob '!node_modules/**' --glob '!fixtures/**' '\b(blume|js-yaml|nanoid|brace-expansion|fast-uri|ip-address|undici)\b' . || trueRepository: stainless-code/codemap
Length of output: 22701
Add examples for the root overrides and validate their removed overrides against the current lockfile.
Package options in package.json, including the new js-yaml and nanoid overrides and any remaining hono, path-to-regexp, or qs overrides, should be documented with examples. The lockfile also shows a prior root override section was removed; ensure brace-expansion, fast-uri, ip-address, and undici are not reinstalled through other consumers by the current bun.lock.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` around lines 131 - 132, Document package.json root overrides
with examples for js-yaml, nanoid, hono, path-to-regexp, and qs, and inspect the
current bun.lock to confirm removed root overrides for brace-expansion,
fast-uri, ip-address, and undici are not reintroduced through other dependency
consumers; adjust the dependency configuration or lockfile as needed to preserve
that validation.
1 participant
Summary
blume1.3.1 → 1.4.2 inapps/docs.undici; keep product pins +path-to-regexp; pinjs-yaml/nanoidfor remaining highs.bun auditignores Blume's unpatchedimage-sizeGHSAs until a release ships.Test plan
bun run validate/check/build/auditinapps/docs(0 errors)bun audit --ignore=…— no high/critical