⬆️(dependencies) update back and front dependencies#500
Merged
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughBumps backend and frontend dependencies, removes ChangesDependency Management and Code Updates
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@bin/yarn-outdated-dates`:
- Around line 91-93: The RECENT detection fails because released_epoch is set
using BSD-only date flags; modify the parsing logic around released_epoch to try
a portable fallback: first attempt the existing BSD parse (date -j -f
"%Y-%m-%dT%H:%M:%S" "$clean" +%s) and if it fails, re-run with GNU-style parsing
(date -d "$clean" +%s) or another portable parser (python -c or perl) so
released_epoch becomes correct on Linux; keep the subsequent comparison against
CUTOFF_EPOCH and setting of flag="RECENT (<${COOLDOWN_DAYS}d)" unchanged so
RECENT detection works cross-platform.
- Around line 46-49: The satisfies() fallback currently uses a substring check
when SEMVER_NODE_PATH is empty which yields incorrect upgrade decisions; change
satisfies() so that if SEMVER_NODE_PATH is not set it returns an explicit
"unknown" status (e.g., a distinct exit code or sentinel output) instead of
true/false, and update the logic that computes the upgrade? flag (the code that
uses ! satisfies "$declared" "$latest") to treat the "unknown" result as
non-actionable (suppress or render upgrade? as unknown) rather than marking it
as an upgrade; refer to the satisfies() function and the place where upgrade? is
derived from ! satisfies "$declared" "$latest" to implement this flow.
In `@src/backend/pyproject.toml`:
- Line 50: Tighten the dependency spec for mozilla-django-oidc in
src/backend/pyproject.toml by replacing the loose constraint
"mozilla-django-oidc<5.0.0" with the specific version resolved in the lock
(e.g., "mozilla-django-oidc==4.0.1" or a narrow range like
"mozilla-django-oidc>=4.0.1,<4.1.0"); after changing the dependency line,
regenerate the lock (run your project’s lock sync command) so
src/backend/uv.lock and pyproject.toml stay consistent.
In `@src/frontend/packages/eslint-config-conversations/package.json`:
- Around line 9-10: Update the pinned version of the Next ESLint plugin in
src/frontend/packages/eslint-config-conversations/package.json by changing the
dependency "`@next/eslint-plugin-next`" from "15.3.3" to "16.2.6" so the ruleset
matches the Next.js version used by the app; edit the package.json entry for
"`@next/eslint-plugin-next`" in the eslint-config-conversations package and run
your package manager (install) to refresh lockfiles.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 2a7f5d16-771b-402e-b4cb-68e656e744b4
⛔ Files ignored due to path filters (2)
src/backend/uv.lockis excluded by!**/*.locksrc/frontend/yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (9)
CHANGELOG.mdbin/yarn-outdated-datessrc/backend/conversations/settings.pysrc/backend/pyproject.tomlsrc/frontend/apps/conversations/package.jsonsrc/frontend/apps/e2e/package.jsonsrc/frontend/package.jsonsrc/frontend/packages/eslint-config-conversations/package.jsonsrc/frontend/packages/i18n/package.json
💤 Files with no reviewable changes (1)
- src/backend/conversations/settings.py
providenz
force-pushed
the
providenz/update-deps
branch
from
c2e792a to
c44b629
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (2)
src/backend/pyproject.toml (2)
50-50: ⚡ Quick winReconsider loosening the
mozilla-django-oidcconstraint.A previous review suggested tightening this dependency to an exact pin (e.g.,
==4.0.1) or a narrow range (e.g.,>=4.0.1,<4.1.0) based on whatuv.lockresolves. The current change to<5.0.0creates a very wide constraint that allows the solver to pick any 4.x version on future lock refreshes, which may introduce unexpected behavior or security issues.If the intent is to allow patch updates while maintaining stability, consider using a tighter constraint like
mozilla-django-oidc>=4.0.1,<4.1.0instead.🔒 Suggested tighter constraint
- "mozilla-django-oidc<5.0.0", + "mozilla-django-oidc>=4.0.1,<4.1.0",🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/backend/pyproject.toml` at line 50, The dependency constraint for mozilla-django-oidc in pyproject.toml is too loose ("<5.0.0"); tighten it to match what uv.lock resolved (either pin to the exact resolved version or a narrow compatible range) by replacing the "<5.0.0" specifier with a specific pin like "==4.0.1" or a narrow range such as ">=4.0.1,<4.1.0" so future lock updates won't unexpectedly pick any 4.x release.
82-82: ⚡ Quick winRemove extra space in version specifier.
The version constraint has an unusual space after the
==operator:"drf-spectacular-sidecar== 2026.5.1". While this may be accepted by pip/uv, standard Python dependency specifications don't include spaces around operators.✨ Normalize the version specifier
- "drf-spectacular-sidecar== 2026.5.1", + "drf-spectacular-sidecar==2026.5.1",🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/backend/pyproject.toml` at line 82, The dependency line for drf-spectacular-sidecar contains an extra space after the "==" operator; edit the pyproject.toml dependency entry for drf-spectacular-sidecar to remove the space so the version specifier has no whitespace around the equality operator (update the drf-spectacular-sidecar version constraint to use the standard "==version" format).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@src/backend/pyproject.toml`:
- Line 50: The dependency constraint for mozilla-django-oidc in pyproject.toml
is too loose ("<5.0.0"); tighten it to match what uv.lock resolved (either pin
to the exact resolved version or a narrow compatible range) by replacing the
"<5.0.0" specifier with a specific pin like "==4.0.1" or a narrow range such as
">=4.0.1,<4.1.0" so future lock updates won't unexpectedly pick any 4.x release.
- Line 82: The dependency line for drf-spectacular-sidecar contains an extra
space after the "==" operator; edit the pyproject.toml dependency entry for
drf-spectacular-sidecar to remove the space so the version specifier has no
whitespace around the equality operator (update the drf-spectacular-sidecar
version constraint to use the standard "==version" format).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: c63cdd7c-d2ff-46e4-9eef-d7a2d33e702d
⛔ Files ignored due to path filters (2)
src/backend/uv.lockis excluded by!**/*.locksrc/frontend/yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (18)
CHANGELOG.mdsrc/backend/conversations/settings.pysrc/backend/pyproject.tomlsrc/frontend/apps/conversations/package.jsonsrc/frontend/apps/conversations/src/api/helpers.tsxsrc/frontend/apps/conversations/src/cunningham/useCunninghamTheme.tsxsrc/frontend/apps/conversations/src/features/chat/api/useCreateProject.tsxsrc/frontend/apps/conversations/src/features/chat/api/useRemoveConversation.tsxsrc/frontend/apps/conversations/src/features/chat/api/useRemoveProject.tsxsrc/frontend/apps/conversations/src/features/chat/api/useRenameConversation.tsxsrc/frontend/apps/conversations/src/features/chat/api/useUpdateProject.tsxsrc/frontend/apps/conversations/src/features/left-panel/components/__tests__/ModalRenameConversation.test.tsxsrc/frontend/apps/conversations/src/features/left-panel/components/__tests__/SimpleConversationItem.test.tsxsrc/frontend/apps/conversations/src/services/PosthogAnalytic.tsxsrc/frontend/apps/e2e/package.jsonsrc/frontend/package.jsonsrc/frontend/packages/eslint-config-conversations/package.jsonsrc/frontend/packages/i18n/package.json
💤 Files with no reviewable changes (2)
- src/frontend/apps/conversations/src/services/PosthogAnalytic.tsx
- src/backend/conversations/settings.py
✅ Files skipped from review due to trivial changes (5)
- src/frontend/apps/e2e/package.json
- src/frontend/apps/conversations/src/cunningham/useCunninghamTheme.tsx
- src/frontend/apps/conversations/src/api/helpers.tsx
- src/frontend/apps/conversations/src/features/left-panel/components/tests/ModalRenameConversation.test.tsx
- CHANGELOG.md
providenz
force-pushed
the
providenz/update-deps
branch
5 times, most recently
from
41fcb5e to
ffa6642
Compare
providenz
force-pushed
the
providenz/update-deps
branch
from
ffa6642 to
702c70a
Compare
maxenceh
reviewed
May 28, 2026
providenz
force-pushed
the
providenz/update-deps
branch
3 times, most recently
from
d5477b6 to
4c7cafc
Compare
Update outdated packages and remove unused ones
providenz
force-pushed
the
providenz/update-deps
branch
from
4c7cafc to
3ba131e
Compare
|
maxenceh
approved these changes
May 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Routine maintenance bump of backend and frontend dependencies, plusremoval of packages that are no longer imported anywhere in thecodebase.
Proposal
#505
Summary by CodeRabbit
Chores
Improvements
Bug Fixes / Tests
Style