Skip to content

chore: patch direct dependency vulnerabilities#145

Open
thinkdj wants to merge 1 commit intomainfrom
agentcursor/dependency-updates-plan-b040
Open

chore: patch direct dependency vulnerabilities#145
thinkdj wants to merge 1 commit intomainfrom
agentcursor/dependency-updates-plan-b040

Conversation

@thinkdj
Copy link
Copy Markdown
Owner

@thinkdj thinkdj commented Mar 24, 2026

Summary

  • patch direct dependency versions for Next homepage runtime and root tooling
  • align shared workspace catalog versions for Storybook, localflare, wrangler, and workers types
  • remove deprecated @types/diff and fix the Next theme demo to keep the upgraded build green

Affected packages/apps

  • apps/ottabase-template-app-nextjs-homepage
  • apps/ottabase-template-app-tanstack
  • workspace root (package.json, pnpm-workspace.yaml, pnpm-lock.yaml, README.md)

Testing

  • pnpm install
  • pnpm --filter @ottabase/ottabase-template-app-nextjs-homepage build
  • pnpm --filter @ottabase/ottabase-template-app-nextjs-homepage test -- --run
  • pnpm --filter @ottabase/ottabase-template-app-tanstack test -- --run
  • pnpm audit --json
  • pnpm outdated -r --no-table

Notes

  • pnpm --filter @ottabase/ottabase-template-app-nextjs-homepage type-check previously failed on a stale config.themeBase reference in app/theme-demo/page.tsx; this PR updates that page to use a supported field so the build/type-check path remains green.
  • pnpm --filter @ottabase/ottabase-template-app-tanstack type-check still reports pre-existing repo issues unrelated to these dependency changes, so verification for that app relied on its passing Vitest suite instead.
  • Remaining audit findings are primarily transitive dev-tooling issues, notably through localflare and the TanStack app's Vite/esbuild chain, and were intentionally left out of this minimal safe tranche.
Open in Web Open in Cursor 

@thinkdj thinkdj marked this pull request as ready for review March 25, 2026 06:13
Copilot AI review requested due to automatic review settings March 25, 2026 06:13
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates workspace and app dependencies to address direct vulnerability advisories, aligns shared catalog versions, and keeps the Next.js homepage theme demo compatible with the upgraded dependencies.

Changes:

  • Bump workspace catalog/tooling versions (Storybook ecosystem, localflare, wrangler, workers types) and root pnpm version metadata
  • Update Next.js homepage app dependencies (Next, OpenNext Cloudflare, eslint-config-next)
  • Remove deprecated @types/diff and adjust the theme demo page to avoid a stale config field

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file
File Description
pnpm-workspace.yaml Aligns shared catalog dependency versions across the monorepo.
package.json Updates pinned pnpm version and packageManager metadata.
apps/ottabase-template-app-tanstack/package.json Removes deprecated @types/diff dependency.
apps/ottabase-template-app-nextjs-homepage/package.json Upgrades Next/OpenNext-related dependencies for the homepage app.
apps/ottabase-template-app-nextjs-homepage/app/theme-demo/page.tsx Adjusts theme demo display to use a supported config field.
README.md Updates pnpm prerequisite and adds corepack setup instruction.

Comment on lines 10 to +11
const { config } = useBrand();
const themeName = config?.brandName || 'Current theme';
Copy link

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using || will replace valid falsy values (e.g., an intentionally-empty brandName of "") with the fallback. If the intent is only to fall back when the value is null/undefined, prefer nullish coalescing (??) or compute after the if (!config) guard and use config.brandName with ??.

Copilot uses AI. Check for mistakes.
</div>

<h1 className="font-heading text-4xl font-bold text-foreground">Theme Demo: {config.themeBase}</h1>
<h1 className="font-heading text-4xl font-bold text-foreground">Theme Demo: {themeName}</h1>
Copy link

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using || will replace valid falsy values (e.g., an intentionally-empty brandName of "") with the fallback. If the intent is only to fall back when the value is null/undefined, prefer nullish coalescing (??) or compute after the if (!config) guard and use config.brandName with ??.

Copilot uses AI. Check for mistakes.
Comment thread README.md

- **Node.js**: `>=24.0.0`
- **pnpm**: `>=10.0.0`
- **pnpm**: `10.32.1`
Copy link

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The README now pins pnpm to an exact version, but the repo metadata still allows a broader range (engines.pnpm is >=10.0.0). To avoid confusing setup instructions, consider aligning these: either keep README as a minimum requirement (and rely on packageManager for the exact version), or update engines.pnpm to match the documented/pinned version. Also, corepack enable pnpm enables pnpm but doesn’t ensure the specific pnpm version is activated; consider documenting the Corepack step that activates the repo’s packageManager version explicitly.

Copilot uses AI. Check for mistakes.
Comment thread README.md

```bash
# Install
corepack enable pnpm
Copy link

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The README now pins pnpm to an exact version, but the repo metadata still allows a broader range (engines.pnpm is >=10.0.0). To avoid confusing setup instructions, consider aligning these: either keep README as a minimum requirement (and rely on packageManager for the exact version), or update engines.pnpm to match the documented/pinned version. Also, corepack enable pnpm enables pnpm but doesn’t ensure the specific pnpm version is activated; consider documenting the Corepack step that activates the repo’s packageManager version explicitly.

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants