chore(deps): audit and clean up dependencies#4529
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
PR SummaryMedium Risk Overview Docs and app styling is adjusted by removing widespread Backend/UI logic is lightly hardened by switching many null checks to optional chaining (e.g., Reviewed by Cursor Bugbot for commit 1944ad7. Configure here. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
@greptile |
|
@cursor review |
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 1944ad7. Configure here.
| animation-duration: 0.01ms; | ||
| animation-iteration-count: 1; | ||
| transition-duration: 0.01ms; | ||
| scroll-behavior: auto; |
There was a problem hiding this comment.
Reduced-motion accessibility rule ineffective without !important
High Severity
The prefers-reduced-motion block uses the universal selector * which has zero specificity (0,0,0). Without !important, any class-based animation rule (specificity ≥ 0,1,0) overrides it. This makes the accessibility rule ineffective against every animation in the file — .landing-loop-animated-dash, .loading-dot, .loading-placeholder::placeholder, .status-indicator.streaming::before, and others — as well as any inline animation styles set by JavaScript. The WCAG 2.3.3 technique (C39) explicitly requires !important for this pattern to work.
Reviewed by Cursor Bugbot for commit 1944ad7. Configure here.
| padding-right: 0 !important; | ||
| margin-right: 0 !important; | ||
| padding-right: 0; | ||
| margin-right: 0; |
There was a problem hiding this comment.
Scroll-lock layout shift prevention defeated without !important
Medium Severity
The comment explicitly states the purpose is to "Prevent modals/dialogs from shifting layout via scroll-lock compensation." Scroll-lock libraries (used by Radix UI / Fumadocs search dialog) add inline padding-right styles to the body. Inline styles have specificity (1,0,0,0) and always beat regular CSS declarations. Without !important, these padding-right: 0 and margin-right: 0 rules cannot override inline styles, so the layout shift they were designed to prevent will now occur when dialogs open.
Reviewed by Cursor Bugbot for commit 1944ad7. Configure here.
Greptile SummaryLarge dependency audit that removes ~12 unused packages, aligns all
Confidence Score: 3/5The dependency cleanup is mostly clean, but the biome-driven removal of The Workday SOAP replacement is well-structured and SSRF-safe, with the only gaps being dead code and a missing apps/sim/app/_styles/globals.css (the Important Files Changed
Reviews (1): Last reviewed commit: "fix(ui): restore leading spaces in condi..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| */ | ||
| .react-flow__selection { | ||
| background: rgba(51, 180, 255, 0.08) !important; | ||
| border: 1px solid var(--brand-secondary) !important; | ||
| background: rgba(51, 180, 255, 0.08); | ||
| border: 1px solid var(--brand-secondary); | ||
| } | ||
|
|
||
| .react-flow__nodesselection-rect, | ||
| .react-flow__nodesselection { | ||
| background: transparent !important; | ||
| border: none !important; | ||
| pointer-events: none !important; | ||
| background: transparent; | ||
| border: none; | ||
| pointer-events: none; |
There was a problem hiding this comment.
!important removal from React Flow class selectors may regress selection visuals
.react-flow__selection and .react-flow__nodesselection-rect/.react-flow__nodesselection share the same CSS specificity (0,1,0) as React Flow's own internal stylesheet. Without !important, whichever rule appears later in the final style sheet wins. Next.js injects third-party library CSS after global styles, so React Flow's default background (rgba(0, 89, 220, 0.08)) and transparent/no-border values will silently override the brand-colored and pointer-events overrides added here. The original !important declarations were necessary to win the specificity battle; removing them for lint compliance reverts these visual customisations.
Rule Used: Avoid editing the globals.css file unless absolute... (source)
Learned From
simstudioai/sim#367
| const WD_OPERATIONS = { | ||
| Get_Workers: { service: 'humanResources', soapAction: 'Get_Workers' }, | ||
| Get_Organizations: { service: 'humanResources', soapAction: 'Get_Organizations' }, | ||
| Put_Applicant: { service: 'recruiting', soapAction: 'Put_Applicant' }, | ||
| Hire_Employee: { service: 'staffing', soapAction: 'Hire_Employee' }, | ||
| Change_Job: { service: 'staffing', soapAction: 'Change_Job' }, | ||
| Terminate_Employee: { service: 'staffing', soapAction: 'Terminate_Employee' }, | ||
| Change_Personal_Information: { | ||
| service: 'humanResources', | ||
| soapAction: 'Change_Personal_Information', | ||
| }, | ||
| Put_Onboarding_Plan_Assignment: { | ||
| service: 'humanResources', | ||
| soapAction: 'Put_Onboarding_Plan_Assignment', | ||
| }, | ||
| } as const satisfies Record<string, { service: WorkdayServiceKey; soapAction: string }> |
There was a problem hiding this comment.
service field in WD_OPERATIONS may mislead future maintainers
Each entry in WD_OPERATIONS carries a service field (e.g. 'recruiting' for Put_Applicant, 'staffing' for Hire_Employee), but callOperation — and the bind helper in createWorkdaySoapClient — never reads it. The endpoint is determined solely by the service argument passed to createWorkdaySoapClient at call time. A developer reading this table could reasonably assume these fields drive per-operation routing; instead they are silently ignored. If a caller ever creates a single client and calls an operation from a different service, the request will silently hit the wrong Workday endpoint and likely return a SOAP fault with no clear explanation.
| function serializeAttributes(attrs?: Record<string, string>): string { | ||
| if (!attrs) return '' | ||
| let out = '' | ||
| for (const [k, v] of Object.entries(attrs)) { | ||
| if (v === undefined || v === null) continue | ||
| out += ` ${k}="${escapeXml(String(v))}"` | ||
| } | ||
| return out |
There was a problem hiding this comment.
serializeAttributes
The value of each attribute is passed through escapeXml, but the key k is emitted verbatim. Currently all attribute keys originate from hardcoded JS object literals (e.g. { 'wd:type': idType }), so there is no real exposure today. However, if any future caller passes a key containing ", >, or whitespace — or if args objects ever include user-derived keys — the resulting SOAP envelope would be malformed XML that the Workday endpoint would reject with an opaque parse error rather than a clear validation message.
| const svc = WORKDAY_SERVICES[service] | ||
| const baseUrl = (validation.sanitized ?? tenantUrl).replace(/\/$/, '') | ||
| return `${baseUrl}/ccx/service/${tenant}/${svc.name}/${svc.version}?wsdl` | ||
| return `${baseUrl}/ccx/service/${tenant}/${svc.name}/${svc.version}` |
There was a problem hiding this comment.
tenant value is interpolated directly into the URL path without encodeURIComponent. A tenant string containing /, ?, or # would alter the URL structure and silently send the SOAP request to an unintended path on the Workday host. While Workday tenant identifiers are normally alphanumeric, a defensive URL-encode here is low cost.
| return `${baseUrl}/ccx/service/${tenant}/${svc.name}/${svc.version}` | |
| return `${baseUrl}/ccx/service/${encodeURIComponent(tenant)}/${svc.name}/${svc.version}` |
- Remove unused: chalk, chart.js, dotenv, encoding, entities, thread-stream, uuid, @opentelemetry/exporter-jaeger, critters, marked, redis, soap - Replace soap with hand-rolled Workday SOAP client - Migrate marked to unified pipeline for inbox responses - Bump zustand v5, @react-email/* - Align all @aws-sdk/* to 3.1032.0 - Move type-only deps to devDependencies - Remove duplicate drizzle-orm/postgres overrides
waleedlatif1
force-pushed
the
waleedlatif1/audit-deps
branch
from
64691dd to
2710879
Compare
|
Closing in favor of a tighter PR — scope is much smaller now (just the dep cleanup + soap rewrite + marked migration). |
1 participant
Summary
soapwith a hand-rolled Workday SOAP client (XXE-safe XML parser, WS-Security UsernameToken)markedto a unified/remark/rehype pipeline for inbox response renderingconcurrentlyto root, type-only deps to devDependenciesType of Change
Testing
Tested manually — type-check and lint pass across the monorepo.
Checklist