You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Deps: refresh vulnerable transitives, eslint 9 in the bare example - #185
One lock refresh for the vulnerable transitives, instead of seven separate Dependabot PRs, plus a root fix for the eslint 8 chain.
body-parser 2.4.0, joi 17.13.9, launch-editor 2.14.2, node-forge 1.4.2, undici 8.12.3, fast-uri 3.1.9, qs (body-parser's copy) 6.17.1. All inside their parents' declared ranges; @react-native-community/cli 20.2.0 is already the latest, so there is no newer root to take.
…example
Move body-parser, joi, launch-editor, node-forge, undici, fast-uri and qs to
patched versions inside their parents' ranges (one lock refresh instead of
seven Dependabot PRs), and take the bare example from eslint 8 to 9, which
@react-native/eslint-config supports (it does not support 10). That removes the
@humanwhocodes, rimraf 3 and eslint 8 advisories.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
yarn.lock is excluded by !**/yarn.lock, !**/*.lock
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 8ef615c4-4d8a-44cf-96b6-df38f7937a7f
You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.
Use the checkbox below for a quick retry:
Trigger review
No actionable comments were generated in the recent review.
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 658dafda-3417-49d7-b88b-e56bbfa44ac4
Commits
Reviewing files that changed from the base of the PR and between 53ce873 and c94e96a.
Files ignored due to path filters: 1
yarn.lock is excluded by !**/yarn.lock, !**/*.lock
Files selected for processing: 1
examples/bare/package.json
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
Summary
Summary by CodeRabbit
Chores
Updated the linting tool version used by the bare example. The change affects development-time lint checks only; it does not change the example’s user-facing behavior or public API. No other user-visible changes are included in this update.
The bare example’s ESLint development dependency range changed from ^8.19.0 to ^9.39.0.
Possibly related PRs
bugsee/bugsee-react-native#175: Changes the same dependency to ESLint 10, which conflicts with this PR’s ESLint 9 range.
The dependency update is ready to merge based on the supplied review context.
Pre-merge checks: 5
Check name
Status
Explanation
Title check
The title "Deps: refresh vulnerable transitives, eslint 9 in the bare example" matches the changeset. The raw summary shows one change in examples/bare/package.json, which bumps the eslint devDependen…
Description check
The description is closely related to the changeset. It explains the lockfile refresh of vulnerable transitive dependencies, the eslint 8 to 9 bump in examples/bare, the audit results before and after…
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title "Deps: refresh vulnerable transitives, eslint 9 in the bare example" matches the changeset. The raw summary shows one change in examples/bare/package.json, which bumps the eslint devDependency from ^8.19.0 to ^9.39.0. The objectives also describe the lockfile refresh of vulnerable transitive dependencies. The title is slightly broader than the visible diff because the lockfile change is excluded from review, but the main change is clearly identified.
Full details: Description check
Explanation
The description is closely related to the changeset. It explains the lockfile refresh of vulnerable transitive dependencies, the eslint 8 to 9 bump in examples/bare, the audit results before and after, the packages still open, and the local test results. It matches the raw summary and objectives.
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Finishing Touches
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Read the PR diff (examples/bare/package.json, yarn.lock)
Checked eslint 9 against the bare example and the root lint setup
Spot-checked the lock entries against the versions in the PR description
Posted findings
What I checked:
eslint 9 in examples/bare: There is no .eslintrc* or eslint.config.* in that directory. The root eslint.config.mjs already covers examples/** and notes that the old template .eslintrc.js linted nothing. Moving to ESLint 9, which uses flat config by default, therefore doesn't break any lint config there.
Peer range:@react-native/eslint-config 0.87.1 is still in the lock.
Dual eslint versions: The root keeps eslint ^10.10.0 and the bare example now resolves eslint 9.39.5. Both are in the lock (eslint@npm:^10.10.0 and eslint@npm:^9.39.0), so there is no resolution conflict.
Security transitives: The lock matches the description: body-parser 2.4.0, joi 17.13.9, launch-editor 2.14.2, node-forge 1.4.2, undici 8.12.3, fast-uri 3.1.9, and qs 6.17.1 for body-parser's copy. The removed @humanwhocodes/*, rimraf 3 and eslint 8 packages are gone from the lock.
What I did not do: I did not run yarn install --immutable, Jest, typecheck or lint. Yarn 4 isn't set up in this runner, so the "pass locally" claims in the PR are unverified by me.
Findings
One P3, posted inline on yarn.lock:4598: the lock also moves @stryker-mutator/* from 10.0.0 to 10.1.1 (within ^10.0.0), and the PR description doesn't mention it. This can affect the mutation gates, so I'd either note it in the description or confirm those gates are green.
Summary
Overall risk: Low
Merge recommendation: Approve once CI is green. The mutation gates and the bare example builds are the checks worth watching.
Most important issue: The unmentioned Stryker 10.0.0 → 10.1.1 bump (P3).
Positives:
Everything stays within declared semver ranges.
Moving to ESLint 9 instead of 10 respects the peer range of @react-native/eslint-config.
The "still open" list is clear about which advisories need a major root bump.
The reason will be displayed to describe this comment to others. Learn more.
Severity: P3 Low Problem: The lock refresh also moves the whole Stryker family (core, api, instrumenter, jest-runner, util) from 10.0.0 to 10.1.1. The PR description lists only the security transitives and the eslint change, so this bump isn't called out. Impact: The repo has mutation gates (see the mutate:* scripts and the sharded cost-balancing in 2ca6a48). A tool bump can shift mutant counts, timeouts or scores, so a mutation-gate failure after merge would be hard to attribute to this "deps-only" PR. Scenario: The next mutation CI run reports different scores or shard timing, and the cause isn't obvious because the PR text says nothing about Stryker. Fix: Either mention the Stryker bump in the PR description (it is within ^10.0.0), or confirm the mutation gates are green on this branch before merging. I did not run them.
The reason will be displayed to describe this comment to others. Learn more.
Fixed in the latest push: I regenerated yarn.lock from main and redid only the intended refresh, so @stryker-mutator/* stays at 10.0.0 (it had floated to 10.1.1 as a side effect).
Overall risk: Low Merge recommendation: Approve — no P0–P3 findings. GitHub CI (including mutation, because yarn.lock is an all-gates trigger) was still in flight at review time; locally yarn install --immutable, yarn lint, and yarn test already pass.
Intent
One lock refresh for the vulnerable transitives (instead of Dependabot #167, #179, #180, #181, #183, #184) plus taking the bare example off eslint 8, which @react-native/eslint-config 0.87.1 does not allow to go to 10 (#171/#175).
These packages are not in the published @bugsee/react-native runtime. They sit under RN CLI / Metro, Expo CLI, node-gyp, Stryker, and leftover example-dev tooling.
Root lint is eslint 10 via eslint.config.mjs (nmHoistingLimits: workspaces), so the example’s eslint 9 does not replace it. The example has no lint script and no RN .eslintrc / flat config; the root config already lints examples/**.
Unmentioned lock float: @stryker-mutator/* 10.0.0 → 10.1.1 (root ^10.0.0). 10.1.1 is the provenance re-release of 10.1.0. Jest-relevant change is the runner shared-cache race fix; no listed breaking change. Mutation plan vs shard counts are computed from the same instrumenter, so a 10.0→10.1 mutant-count shift would not fail the merge equality check — only break: 95 could, and there is no evidence it will.
yarn npm audit --all --recursive — claimed packages are gone. Remaining set matches the PR body (qs 6.15.1 via typed-rest-client@2.3.1, zod/glob/decode-uri-component/uuid/jsdom stack, deepmerge, inflight/minimatch).
Residuals (not blocking)
New YN0060:examples/bare provides eslint 9.39.5, which does not satisfy eslint-plugin-ft-flow@2.0.3’s peer ^8.1.0 (the rest of @react-native/eslint-config 0.87.1 does accept 9). Yarn still exits 0; CI install will too. The example never loads that config. I ran yarn workspace bugsee-example-bare exec eslint .: eslint 9.39.5 walks up to root eslint.config.mjs and reports 124 files / 0 errors. Dropping the unused eslint + @react-native/eslint-config pair from the example would also drop the eslint 8/9 advisory chain and this warning; keeping them as RN-template leftovers is consistent with the PR’s stated choice.
qs@6.15.1 remains an exact pin of typed-rest-client@2.3.1 (Stryker only). Documented.
Audit still flags zod 4.6.5 (<4.6.6) via Stryker’s mutation-server-protocol@0.4.1 (^4.1.12) in addition to Expo’s 3.25.76. Pre-existing range; not introduced uniquely by this refresh.
eslint 9 itself still appears as an npm “no longer supported” deprecation. That is why 10 is the root, and why 9 is the ceiling for the example.
Positive
Lockfile matches the claimed patched versions; parents’ declared ranges hold; eslint 8 internals are actually gone; node-forge landed on 1.4.2 rather than stopping at 1.4.1; remaining issues are listed instead of claimed fixed. Avoiding Dependabot’s eslint 10 for the example is the right call given the RN config peer.
Most important issues to fix: none for merge. Optional follow-up: drop the unused eslint / @react-native/eslint-config pair from examples/bare if you do not intend to lint there with the RN config.
The lock refresh floated @stryker-mutator/* to 10.1.1 as a side effect. Regenerate
the lock from main so only the security transitives and eslint 9 move.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Re-review of PR #185 after 5dc6f2d ("Deps: keep Stryker at 10.0.0")
Read the new commit and the full diff against origin/main
Checked whether the earlier P3 finding is fixed
Re-checked the lock entries against the PR description
Checked CI status
Earlier P3 (Stryker 10.0.0 → 10.1.1) looks fixed. The @stryker-mutator/* entries are back at 10.0.0 (api@npm:10.0.0, core@npm:^10.0.0 → 10.0.0). A diff of yarn.lock against origin/main shows no Stryker version changes, and yarn.lock has no 10.1.1 strings left. The mutation gates therefore run on the same tool version as main.
Rest of the diff is unchanged in substance. Only examples/bare/package.json (eslint ^8.19.0 → ^9.39.0) and yarn.lock move. The lock shows these changes:
body-parser 2.3.0 → 2.4.0
joi 17.13.8 → 17.13.9
launch-editor 2.14.1 → 2.14.2
node-forge 1.4.0 → 1.4.2
undici 8.10.2 → 8.12.3
fast-uri 3.1.8 → 3.1.9
qs for body-parser 6.16.0 → 6.17.1
eslint 8.57.1 → 9.39.5
These match the PR description. typed-rest-client 2.3.1 still pins qs 6.15.1, as the description says.
What I did not do: I did not run yarn install --immutable, Jest, typecheck, lint or the audit. CI was still queued or in progress when I checked. The "pass locally" claims are not verified by me.
Findings
None. I have no new findings and nothing to add inline.
Summary
Overall risk: Low
Merge recommendation: Approve once CI is green. The bare example builds and the mutation gates are the checks to watch. yarn.lock triggers all gates.
Most important issues to fix: None blocking. One optional follow-up from the Cursor review: examples/bare has no lint script and no config of its own. You could drop the unused eslint and @react-native/eslint-config pair there. That would also remove the new YN0060 peer warning from eslint-plugin-ft-flow.
Positives:
Every bump stays inside its parent's declared range.
The Stryker float was reverted, so the PR now does only what it says.
ESLint 9 respects the @react-native/eslint-config peer range.
The "still open" advisory list is honest about what needs a major root bump.
· Branch: chore/deps-security-refresh
Overall risk: Low Merge recommendation: Approve — no P0–P3 findings.
Re-review after 5dc6f2d (Deps: keep Stryker at 10.0.0). The previous look at c94e96a had no blocking issues; the only residual was the lockfile also floating @stryker-mutator/* 10.0.0 → 10.1.1. That commit regenerates the lock from main and re-applies only the intended refresh. Diff vs c94e96a is only those five Stryker packages back to 10.0.0. Every claimed security pin is still present.
Intent
One lock refresh for the vulnerable transitives (instead of Dependabot #167, #179, #180, #181, #183, #184) plus taking the bare example off eslint 8, which @react-native/eslint-config 0.87.1 does not allow to go to 10 (#171/#175).
These packages are not in the published @bugsee/react-native runtime. They sit under RN CLI / Metro, Expo CLI, node-gyp, Stryker, and leftover example-dev tooling.
Root lint is eslint 10 via eslint.config.mjs (nmHoistingLimits: workspaces), so the example’s eslint 9 does not replace it. The example has no lint script and no RN .eslintrc / flat config; the root config already lints examples/**.
Stryker stays 10.0.0 (root ^10.0.0). Mutation plan vs shard counts are therefore the same instrumenter main already runs.
yarn workspace bugsee-example-bare exec eslint . --max-warnings=0 — eslint 9.39.5, exit 0 (walks up to root eslint.config.mjs).
yarn npm audit --all --recursive — claimed packages are gone. Remaining set matches the PR body (qs 6.15.1 via typed-rest-client@2.3.1, zod/glob/decode-uri-component/uuid/jsdom stack, deepmerge, inflight/minimatch).
GitHub CI on this SHA already green for lint/typecheck/unit, expo prebuild, pack install (0.81–0.87), rn compat, playground JS, CodeQL, and mutation scope. Mutation shards and native/playground builds were still running at review time (yarn.lock is an all-gates trigger). Prior c94e96a mutation was 50/50 SUCCESS on Stryker 10.1.1; this SHA restores 10.0.0.
Residuals (not blocking)
YN0060:examples/bare provides eslint 9.39.5, which does not satisfy eslint-plugin-ft-flow@2.0.3’s peer ^8.1.0. Combined requested range collapses to ^8.57.0 because ft-flow does not allow 9, even though @react-native/eslint-config 0.87.1 itself peers ^8 \|\| ^9. Yarn still exits 0; CI install did too. The example never loads that config. Dropping the unused eslint + @react-native/eslint-config pair from the example would also drop the eslint 8/9 advisory chain and this warning; keeping them as RN-template leftovers is consistent with the PR’s stated choice.
qs@6.15.1 remains an exact pin of typed-rest-client@2.3.1 (Stryker only). Documented. The PR body still names the parent as 10.1.1; it is 10.0.0 again. The advisory itself is unchanged.
Audit still flags zod 4.6.5 (<4.6.6) via Stryker’s mutation-server-protocol@0.4.1 (^4.1.12) in addition to Expo’s 3.25.76. Pre-existing range; not introduced uniquely by this refresh.
eslint 9 itself still appears as an npm “no longer supported” deprecation. That is why 10 is the root, and why 9 is the ceiling for the example.
Positive
Lockfile matches the claimed patched versions; parents’ declared ranges hold; eslint 8 internals are actually gone; node-forge landed on 1.4.2 rather than stopping at 1.4.1; Stryker was put back so this is not an unmentioned mutation-tool bump; remaining issues are listed instead of claimed fixed. Avoiding Dependabot’s eslint 10 for the example is the right call given the RN config peer.
Most important issues to fix: none for merge. Optional follow-up: drop the unused eslint / @react-native/eslint-config pair from examples/bare if you do not intend to lint there with the RN config.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesPull requests that update a dependency filejavascriptPull requests that update javascript code
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
coderabbitai
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Summary
One lock refresh for the vulnerable transitives, instead of seven separate Dependabot PRs, plus a root fix for the eslint 8 chain.
body-parser2.4.0,joi17.13.9,launch-editor2.14.2,node-forge1.4.2,undici8.12.3,fast-uri3.1.9,qs(body-parser's copy) 6.17.1. All inside their parents' declared ranges;@react-native-community/cli20.2.0 is already the latest, so there is no newer root to take.examples/bare:eslint8 → 9.@react-native/eslint-configpeers^8 || ^9, so 10 (Dependabot Build(deps-dev): bump eslint from 9.39.5 to 10.14.0 #171/Build(deps-dev): bump eslint from 9.39.5 to 10.14.0 in /examples/bare #175) is not an option there. This drops@humanwhocodes/*,rimraf3 and the eslint 8 advisories.Supersedes Dependabot #167, #179, #180, #181, #183, #184.
Audit (
yarn npm audit --all --recursive)21 advisory packages before, 12 after. Fixed: body-parser, joi, launch-editor, node-forge, undici, fast-uri, @humanwhocodes/*, rimraf 3, eslint 8.
Still open, needs a major root bump
zod3.25.76 (high) andglob13.0.6:@expo/cli57 (latest 57.x) pins them; Expo SDK 58 is the fix.decode-uri-component0.2.2 (high):expo-router57 →query-string7.abab,domexception,whatwg-encoding:jest-expo57.0.6 →jest-environment-jsdom29.uuid7.0.3:xcode3.0.1 via@expo/config-plugins57.qs6.15.1:@stryker-mutator/core10.1.1 (latest) →typed-rest-client2.3.1 pins it.glob7 /minimatch3 /inflight: Jest 29 toolchain.deepmerge: no patched release.Testing
yarn install --immutable, Jest (4640 passed), typecheck, lint: pass locally. CI will cover the example builds.🤖 Generated with Claude Code