fix(ci): remove broken npm self-install and remediate CVEs#567
fix(ci): remove broken npm self-install and remediate CVEs#567
Conversation
The publish-or-pr job used `npm install npm@latest -g` which fails on Node 22.22.2 due to missing promise-retry module. The setup action already handles this via corepack — these lines were redundant. Also bumps effect (^3.20.0), vite (^7.3.2) catalogs and adds pnpm overrides for path-to-regexp (^8.4.0) and picomatch (^4.0.4/^2.3.2) to resolve Mend-flagged CVEs.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthroughRemoved npm install/version-print steps from the publish workflow; added pnpm overrides for picomatch versions and kept undici pinned; bumped effect and vite versions in the pnpm workspace catalog. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Possibly related issues
Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
View your CI Pipeline Execution ↗ for commit 13b0ee2
☁️ Nx Cloud last updated this comment at |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
package.json (1)
136-138: Consider scoping overrides to target major versions explicitly as a preventive best practice.The overrides on lines 136–138 use broad selectors (
path-to-regexpglobally, andpicomatch@<3) that could unintentionally force major version jumps for older API requesters. Current lockfile inspection shows all active requests align with the specified overrides (path-to-regexp major 8, picomatch majors 2–4), so there is no immediate breakage. However, to guard against future transitive dependency additions that might request older major versions, prefer explicitly scoped selectors:Suggested approach
"pnpm": { "overrides": { "rollup": "^4.59.0", "undici@^7": "^7.24.0", - "path-to-regexp": "^8.4.0", + "path-to-regexp@^8": "^8.4.0", "picomatch@>=4": "^4.0.4", - "picomatch@<3": "^2.3.2" + "picomatch@^2": "^2.3.2" } }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@package.json` around lines 136 - 138, The overrides in package.json use broad selectors ("path-to-regexp", "picomatch@>=4", "picomatch@<3") which can accidentally match future major-version requests; narrow them to explicit major-range selectors to avoid forcing larger major bumps—for example change the override key "path-to-regexp" to "path-to-regexp@^8" and split the picomatch entries into explicit major targets like "picomatch@^4" and "picomatch@^2" (or other specific major ranges you intend) so only those major versions are overridden rather than any future older/newer majors.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@package.json`:
- Around line 136-138: The overrides in package.json use broad selectors
("path-to-regexp", "picomatch@>=4", "picomatch@<3") which can accidentally match
future major-version requests; narrow them to explicit major-range selectors to
avoid forcing larger major bumps—for example change the override key
"path-to-regexp" to "path-to-regexp@^8" and split the picomatch entries into
explicit major targets like "picomatch@^4" and "picomatch@^2" (or other specific
major ranges you intend) so only those major versions are overridden rather than
any future older/newer majors.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: ea32ffae-3db7-4af1-8fac-aefdd779190a
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (3)
.github/workflows/publish.ymlpackage.jsonpnpm-workspace.yaml
💤 Files with no reviewable changes (1)
- .github/workflows/publish.yml
The blanket `"path-to-regexp": "^8.4.0"` override forced all transitive consumers (Express v0.1.x, MSW v6.x) to v8 — a major breaking change that removed regex syntax support. The original versions (0.1.12, 6.3.0) were already patched for CVE-2024-45296 and not vulnerable.
![nx-cloud[bot]](https://avatars.githubusercontent.com/in/80458?s=60&v=4){kind=small}
There was a problem hiding this comment.
Important
At least one additional CI pipeline execution has run since the conclusion below was written and it may no longer be applicable.
Nx Cloud has identified a possible root cause for your failed CI:
This CI failure appears to be related to the environment or external dependencies rather than your code changes.
No code changes were suggested for this issue.
Trigger a rerun:
🎓 Learn more about Self-Healing CI on nx.dev
Codecov Report✅ All modified and coverable lines are covered by tests. ❌ Your project status has failed because the head coverage (14.89%) is below the target coverage (40.00%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## main #567 +/- ##
===========================================
- Coverage 70.90% 14.89% -56.02%
===========================================
Files 53 153 +100
Lines 2021 26299 +24278
Branches 377 1067 +690
===========================================
+ Hits 1433 3916 +2483
- Misses 588 22383 +21795 🚀 New features to boost your workflow:
|
@forgerock/davinci-client
@forgerock/device-client
@forgerock/journey-client
@forgerock/oidc-client
@forgerock/protect
@forgerock/sdk-types
@forgerock/sdk-utilities
@forgerock/iframe-manager
@forgerock/sdk-logger
@forgerock/sdk-oidc
@forgerock/sdk-request-middleware
@forgerock/storage
commit: |
|
Deployed c4df415 to https://ForgeRock.github.io/ping-javascript-sdk/pr-567/c4df4155d0066c8375f564c88ad9c32b6133773b branch gh-pages in ForgeRock/ping-javascript-sdk |
📦 Bundle Size Analysis📦 Bundle Size Analysis🚨 Significant Changes🔻 @forgerock/device-client - 0.0 KB (-9.7 KB, -100.0%) 📊 Minor Changes📉 @forgerock/device-client - 9.7 KB (-0.0 KB) ➖ No Changes➖ @forgerock/oidc-client - 24.9 KB 14 packages analyzed • Baseline from latest Legend🆕 New package ℹ️ How bundle sizes are calculated
🔄 Updated automatically on each push to this PR |
2 participants
JIRA Ticket
N/A
Description
The publish-or-pr job used
npm install npm@latest -gwhich fails on Node 22.22.2 due to missing promise-retry module. The setup action already handles this via corepack — these lines were redundant.Also bumps effect (^3.20.0), vite (^7.3.2) catalogs and adds pnpm overrides for path-to-regexp (^8.4.0) and picomatch (^4.0.4/^2.3.2) to resolve Mend-flagged CVEs.
Summary by CodeRabbit