Repository navigation
chore: update dependencies for Node.js - #216
Merged
Abhijeet Prasad (AbhiPrasad) merged 6 commits intoOct 26, 2026
Merged
Conversation
Pin Node to the patched 24.22.1 release and bump undici past the October 15 advisories (cursor 7.30.1, pi 8.12.2 via a workspace override). Centralize tool versions in a root .tool-versions (node, pnpm, rust) that every workflow reads, pin Rust instead of floating on stable, and add a local-only mise.toml whose postinstall hook runs `make install-deps`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Abhijeet Prasad (AbhiPrasad)
changed the title
Abhijeet Prasad (AbhiPrasad)
changed the title
Stephen Belanger (Qard)
approved these changes
Oct 23, 2026
Stephen Belanger (Qard)
left a comment
Stephen Belanger (Qard)
left a comment
Collaborator
There was a problem hiding this comment.
Generally LGTM, but I have some questions.
Comment on lines
+44
to
+56
| - name: Check packageManager matches .tool-versions | ||
| shell: bash | ||
| run: | | ||
| expected="pnpm@$(awk '$1 == "pnpm" { print $2 }' .tool-versions)" | ||
| status=0 | ||
| for manifest in src/plugins/opencode/content/package.json src/plugins/pi/content/package.json; do | ||
| actual="$(node -p 'require(process.argv[1]).packageManager' "$PWD/$manifest")" | ||
| if [ "$actual" != "$expected" ]; then | ||
| echo "::error file=$manifest::packageManager is $actual; .tool-versions pins $expected" | ||
| status=1 | ||
| fi | ||
| done | ||
| exit "$status" |
Collaborator
There was a problem hiding this comment.
Is this necessary? If so, why not make it part of the setup-node-pnpm action?
| # CI reads .tool-versions directly and does not use mise. | ||
|
|
||
| [tools] | ||
| "npm:vite-plus" = "0.2.9" |
Collaborator
There was a problem hiding this comment.
This can't go in .tool-versions too?
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude Code 2.1.310 retries after the mock's deterministic 400, so the fourth request hit the mock's panic arm instead of the expected error. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Abhijeet Prasad (AbhiPrasad)
deleted the
update-deps-node-security-7da6dc24
branch
October 26, 2026 16:32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Responds to the Node.js October 21, 2026 security releases and centralizes tool versions so the next bump is a one-line change.
Security updates
24/22, which can resolve to an older cached runner version). Covers the Node CVEs plus bundled c-ares, OpenSSL, and CA-cert updates.7.30.0→7.30.1(dev-only, via cheerio).8.10.2→8.12.2via apnpm-workspace.yamloverride, following fix(pi): update transitive dependencies #183.8.12.3is blocked byminimumReleaseAge;8.12.2is the first patched 8.x.One source for tool versions
.tool-versionspinsnode,pnpm, andrust(1.99.1, the current stable, instead of floatingstable).actions/setup-nodewithnode-version-file, used by the cursor release and Codex smoke test..github/actions/setup-node-pnpmreplaces five duplicated pnpm and Node blocks in CI..github/actions/setup-rustreplaces threerustup ... stablesteps.node_versionat the root file.packageManagerdrifts from.tool-versions..tool-versionsfiles are removed. They pinned vite-plus0.2.1while the packages lock0.2.9.Local dev with mise
mise.tomlholds local-onlynpm:vite-plus 0.2.9and apostinstallhook that runs the newmake install-deps, the same layout as braintrust-sdk-python.Notes
.tool-versions.npm auditon cursor still flags unrelated dev-only deps (ajv, braces, markdown-it, underscore). They're left for a separate PR.Test plan
make testpasses locally. Grok validation can't run here: there's a stand-ingrokcommand on PATH but no real CLI.npm ci,tsc, andnpm audit --omit=devare clean.--frozen-lockfilepasses.mise installresolves all tools and runsmake install-deps.🤖 Generated with Claude Code