chore(deps): batch upgrade safe dependabot bumps#1533
Conversation
Bundles the four green dependabot bumps that pass type-check and dev server boot, plus the biome 2.4.13 lint auto-fix it requires: - lefthook 1.13.6 -> 2.1.6 (PR #1514, dev-only) - decode-formdata 0.8.0 -> 0.9.0 (PR #1527; type-only diff) - @faker-js/faker 9.9.0 -> 10.4.0 (PR #1525; test/storybook only) - @biomejs/biome 2.4.12 -> 2.4.13 + @tanstack/react-start & router-plugin patches (PR #1524) Biome 2.4.13 strengthened lint/complexity/noExtraBooleanCast so the auto-fix removes two redundant `!!` casts: - TriggerObjectDetail.tsx:79 - ReviewScreeningMatch.tsx:103 Excluded from this branch: - react-i18next 15 -> 17 (PR #1526): blocked, needs i18next core bumped from 23 to >= 26 (peer dep). Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis pull request updates dependencies across the monorepo and simplifies redundant boolean coercions in two component render conditions. Lefthook and workspace package dependencies are bumped to newer patch/minor versions, and boolean checks in React component conditionals are streamlined from explicit ChangesMaintenance Updates
Estimated Code Review Effort🎯 2 (Simple) | ⏱️ ~8 minutes Suggested Labels
Suggested Reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/ui-design-system/package.json`:
- Line 18: Add a root package.json "engines" entry to enforce a minimum Node.js
version compatible with `@faker-js/faker` v10 (e.g., "node": ">=20.19.0") so CI
and developer machines use a supported runtime; update any CI config to use that
Node version if needed. Confirm the project remains ESM-compatible (no CommonJS
entry points) and that the dependency "@faker-js/faker" in package.json is
intentionally ESM-only. Ensure the engines policy is documented in
CONTRIBUTING/README if present.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 5763bd04-c598-4666-b900-b8c9230d3d0a
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (5)
package.jsonpackages/app-builder/package.jsonpackages/app-builder/src/components/Decisions/TriggerObjectDetail.tsxpackages/app-builder/src/components/Screenings/ReviewScreeningMatch.tsxpackages/ui-design-system/package.json
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: check / main
- GitHub Check: e2e
🧰 Additional context used
📓 Path-based instructions (4)
**/*.{ts,tsx,js,jsx,json,css}
📄 CodeRabbit inference engine (CLAUDE.md)
Run
bun run format:writeto format all files according to Biome standards
Files:
package.jsonpackages/app-builder/src/components/Screenings/ReviewScreeningMatch.tsxpackages/ui-design-system/package.jsonpackages/app-builder/src/components/Decisions/TriggerObjectDetail.tsxpackages/app-builder/package.json
**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.{ts,tsx}: Import internal app-builder models using the path alias@app-builder/models/*
Import UI components fromui-design-systemusing direct imports likeimport { Button, Modal, Select, cn } from 'ui-design-system'
Use TanStack Query hooks for server state management, importing from@app-builder/queries/*
Use TanStack Form for form handling
Use Zod for schema validation
Files:
packages/app-builder/src/components/Screenings/ReviewScreeningMatch.tsxpackages/app-builder/src/components/Decisions/TriggerObjectDetail.tsx
packages/app-builder/src/components/**/*.tsx
📄 CodeRabbit inference engine (CLAUDE.md)
Organize app-builder source code into feature-specific component folders (Cases/, Decisions/, etc.) within the components directory
Files:
packages/app-builder/src/components/Screenings/ReviewScreeningMatch.tsxpackages/app-builder/src/components/Decisions/TriggerObjectDetail.tsx
packages/app-builder/src/**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
Run
bun run type-checkin app-builder and ui-design-system packages to verify TypeScript types
Files:
packages/app-builder/src/components/Screenings/ReviewScreeningMatch.tsxpackages/app-builder/src/components/Decisions/TriggerObjectDetail.tsx
🧠 Learnings (1)
📚 Learning: 2026-05-11T13:00:53.337Z
Learnt from: william-schlegel
Repo: checkmarble/marble-frontend PR: 1503
File: packages/app-builder/src/components/ContinuousScreening/context/ListAndTopicDatasetConfigurationBridge.tsx:13-20
Timestamp: 2026-05-11T13:00:53.337Z
Learning: In checkmarble/marble-frontend, calls to `createSharp` from the `sharpstate` library should be treated as if they were a React hook. In React `.tsx` components, call `createSharp` unconditionally at the top level of the component function body (not inside conditionals or nested functions). Do not place `createSharp` inside `useMemo`, `useCallback`, `useEffect`, or any other hook, and do not suggest wrapping it in `useMemo`—that is incorrect and should be flagged during review.
Applied to files:
packages/app-builder/src/components/Screenings/ReviewScreeningMatch.tsxpackages/app-builder/src/components/Decisions/TriggerObjectDetail.tsx
🔇 Additional comments (4)
packages/app-builder/src/components/Decisions/TriggerObjectDetail.tsx (1)
79-79: LGTM!packages/app-builder/src/components/Screenings/ReviewScreeningMatch.tsx (1)
103-103: LGTM!Fair prince, this change doth please me well indeed,
For what was once made doubly boolean cast
Now stands in simple truth, as nature planned.
The whitelist form shall render just the same—
When status speaks of 'no_hit' and identifier
Doth hold a truthy value in its keep.package.json (1)
9-9: ⚡ Quick winLefthook v2 does have breaking changes—but this project's config should be fine.
The leap from v1.13.0 to v2.1.6 does introduce breaking changes: the
excludeoption no longer supports regex (only globs),skip_outputwas dropped in favor ofoutput, CLI arguments were renamed, and the command executor changed to Bourne Shell on Windows. However, your lefthook.yml uses straightforward features (globfor patterns, simpleruncommands,stage_fixedfor staging) that aren't affected by these changes. No action needed unless you customize the config later.packages/app-builder/package.json (1)
98-98: ⚡ Quick winVerify the decode-formdata upgrade doesn't alter form data parsing behavior.
The library is used across critical server functions (cases.ts, data.ts) for parsing FormData with array configurations. Though Zod schemas provide validation, no public changelog documents the 0.8.0 → 0.9.0 changes, and no tests specifically verify decode-formdata behavior. Consider adding tests that compare parsing results across versions or confirming the upgrade in a staging environment before deployment. In the words of the Bard: "To trust or not to trust the unseen change—that is the question."
Adds a root `engines.node` field that mirrors @faker-js/faker v10's own requirement: ^20.19.0 || ^22.13.0 || ^23.5.0 || >=24.0.0. The looser ">=20.19.0" sometimes recommended in tooling output is inaccurate — faker explicitly excludes 21.x and 22.0–22.12 — so the field stays in lock-step with the upstream constraint. CI already uses `.tool-versions` (nodejs 22.18.0) which falls inside this range, so no workflow changes are needed. A short pointer was added to README to make the policy discoverable. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
This reverts commit 2197fe3.
2 participants
Bundles the four green dependabot bumps that pass type-check and dev server boot, plus the biome 2.4.13 lint auto-fix it requires:
Biome 2.4.13 strengthened lint/complexity/noExtraBooleanCast so the auto-fix removes two redundant
!!casts:Excluded from this branch:
Summary by CodeRabbit
Chores
Refactor