build(deps): resolve open dependency PRs — @babel/parser 8 (+compat), supabase-js floor; hold TypeScript 7#1014
Conversation
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
📝 WalkthroughWalkthroughUpdates Babel and package dependency versions, removes the obsolete import-attributes parser plugin, and adapts architecture-boundary parsing to support Babel’s current dynamic import AST representations. ChangesBabel parser compatibility
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
CI triageCI failed on this PR. Automated classification of the 2 failed job(s):
Compared with main CI run #4129 (success). Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger. |
…se-js floor Resolves two open Dependabot dependency PRs. @babel/parser ^7.29.7 → ^8.0.4 (dev, PR #991) - Babel 8 models dynamic `import(...)` as an ESTree-aligned ImportExpression (specifier in `source`, attributes in `options`) instead of a CallExpression whose callee is an `Import` node. Teach the architecture-boundaries import graph both shapes so dynamic-import edges keep resolving. - Babel 8 parses import attributes by default and removed the standalone "importAttributes" parser plugin (now a type error). Drop it from the two test parsers; attribute parsing behaviour is unchanged. @supabase/supabase-js ^2.108.2 → ^2.110.7 (prod, supersedes PR #945) - 2.110.7 is already the resolved/installed version under the old floor; this only lifts the declared floor to match reality. The client-bundle secret scanner already masks matches and already ignores supabase-js's bare `sb_secret_` prefix literal (its regex requires a 20+ char token), so the stale scanner rewrite in PR #945 is intentionally not taken — it would regress the newer masking on main. Lockfile is regenerated with the repo-pinned npm@11.17.0 (packageManager) so platform-optional entries (@emnapi/core, @emnapi/runtime) are preserved; an older npm prunes them and breaks `npm ci` in CI. Verification (offline): typecheck, full unit suite (no new failures vs the pre-existing pdf-extraction-budget sandbox flake), lint, knip, production build + client-bundle-secrets scan, and `npm@11.17.0 ci --dry-run` all green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TVVgc9PtHfj1aUQX387P8y
efd51e1 to
2f92eed
Compare
…audit gate The repo's "Dependency audit (blocking on dependency changes)" CI step runs `npm audit --omit=dev --audit-level=high` and hard-blocks only when a PR touches the manifest/lockfile. main carries a pre-existing high-severity brace-expansion advisory (GHSA-3jxr-9vmj-r5cp, ReDoS) ungated, but any dependency PR — including this one — must clear it to merge. Fix surgically via per-major overrides so each consumer keeps its major and only takes the security patch (no cross-major upgrade, minimal regression surface): - brace-expansion@1 1.1.14 -> 1.1.16 - brace-expansion@2 2.1.0 -> 2.1.2 `npm audit --omit=dev --audit-level=high` now reports 0 vulnerabilities. Lockfile regenerated with the pinned npm@11.17.0 (optional @emnapi/* deps retained). typecheck and the full unit suite are unchanged (no new failures vs the pre-existing pdf-extraction-budget sandbox flake). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TVVgc9PtHfj1aUQX387P8y
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Around line 205-208: Remove the uuid 11 override from the package dependency
overrides, while retaining the existing brace-expansion overrides at their
patched versions. Do not change the ExcelJS usage in the document extractor or
sample-generation script.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 2e2aa0eb-1d9b-417b-92c9-416066b5b7f4
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (3)
package.jsontests/architecture-boundaries.test.tstests/client-secret-surface.test.ts
| "uuid": "^11.1.1", | ||
| "brace-expansion@1": "^1.1.16", | ||
| "brace-expansion@2": "^2.1.2" | ||
| }, |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
npm ls --all brace-expansion uuid
node - <<'NODE'
const fs = require("node:fs");
const lock = JSON.parse(fs.readFileSync("package-lock.json", "utf8"));
for (const [key, value] of Object.entries(lock.packages ?? {})) {
if (/(^|\/)(brace-expansion|uuid)$/.test(key)) {
console.log(key, value.version);
}
}
NODERepository: BigSimmo/Database
Length of output: 1106
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== uuid/brac-expansion usages in repo ==\n'
rg -n --hidden --glob '!package-lock.json' --glob '!node_modules' '\buuid\b|brace-expansion' .
printf '\n== package-lock entries ==\n'
node - <<'NODE'
const fs = require("node:fs");
const lock = JSON.parse(fs.readFileSync("package-lock.json", "utf8"));
for (const [key, value] of Object.entries(lock.packages ?? {})) {
if (/(^|\/)(brace-expansion|uuid)$/.test(key)) {
console.log(`${key} ${value.version}`);
}
}
NODERepository: BigSimmo/Database
Length of output: 50374
🌐 Web query:
brace-expansion vulnerability patched versions 1.x 2.x 5.x uuid 11 breaking changes older API
💡 Result:
For the brace-expansion library, two primary denial-of-service (DoS) vulnerabilities have been identified: 1. Zero-step sequence vulnerability (CVE-2026-33750): A brace pattern with a zero step value (e.g., {1..2..0}) causes infinite loops and memory exhaustion [1][2][3]. Patched versions include 1.1.13, 2.0.3, 3.0.2, and 5.0.5 [1][2][3]. 2. Exponential-time expansion vulnerability (CVE-2026-13149): Consecutive non-expanding {} brace groups cause exponential CPU consumption [4][5][6]. Patched versions include 1.1.16, 2.1.2, and 5.0.7 [4]. For the uuid library, version 11 introduced significant breaking changes [7][8][9]. Key changes include: - Migration to TypeScript: The library is now written in TypeScript; users should remove @types/uuid from dependencies [10]. - ESM Migration: The codebase transitioned to ECMAScript Modules (ESM) [7][9]. - API Changes: - Default export (v4) is removed [7][9]. - Deep imports (e.g., require('uuid/v4')) are no longer supported [7][9]. - Changes in options handling for v1, v6, and v7: Passing an options argument now explicitly disables internal state utilization for uniqueness, applying defaults instead [11][10]. - Binary UUIDs are now returned as Uint8Array, which may affect callers of parse or stringify [10]. - Support Changes: Support for Node.js versions below 16 and certain older browsers (like IE 11) was dropped [7][8][9]. The minified UMD build was also removed [9].
Citations:
- 1: GHSA-f886-m6hf-6m8v
- 2: https://osv.dev/vulnerability/CVE-2026-33750
- 3: https://nvd.nist.gov/vuln/detail/CVE-2026-33750
- 4: GHSA-3jxr-9vmj-r5cp
- 5: https://nvd.nist.gov/vuln/detail/CVE-2026-13149
- 6: https://www.seal.security/blog/brace-yourself-denial-of-service-in-a-billion-download-dependency
- 7: https://github.com/uuidjs/uuid/blob/v11.1.1/CHANGELOG.md
- 8: https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md
- 9: https://newreleases.io/project/npm/uuid/release/11.0.0
- 10: uuidjs/uuid@v10.0.0...v11.0.1
- 11: https://www.npmjs.com/package/uuid?activeTab=versions
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== direct npm-package uuid references ==\n'
rg -n --hidden --glob '!package-lock.json' --glob '!node_modules' --glob '!supabase/**' \
'from ["'\'']uuid["'\'']|require\(["'\'']uuid["'\'']\)|uuid/v[0-9]|`@types/uuid`' \
package.json ./**/*.js ./**/*.jsx ./**/*.ts ./**/*.tsx ./**/*.mjs ./**/*.cjs || true
printf '\n== package.json uuid-related entries ==\n'
node - <<'NODE'
const pkg = JSON.parse(require("node:fs").readFileSync("package.json", "utf8"));
for (const [k, v] of Object.entries({dependencies: pkg.dependencies, devDependencies: pkg.devDependencies, overrides: pkg.overrides})) {
if (!v) continue;
for (const [name, ver] of Object.entries(v)) {
if (name.includes('uuid') || name.includes('brace-expansion')) {
console.log(k, name, ver);
}
}
}
NODERepository: BigSimmo/Database
Length of output: 383
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== package-lock uuid consumers ==\n'
node - <<'NODE'
const fs = require('node:fs');
const lock = JSON.parse(fs.readFileSync('package-lock.json', 'utf8'));
for (const [path, pkg] of Object.entries(lock.packages ?? {})) {
if (path === 'node_modules/exceljs' || /(^|\/)uuid$/.test(path) || /(^|\/)brace-expansion$/.test(path) || /(^|\/)minimatch$/.test(path)) {
const deps = pkg.dependencies || {};
console.log(path || '<root>', 'version=' + (pkg.version ?? ''), 'deps=' + JSON.stringify(deps));
}
}
NODE
printf '\n== source imports of uuid/exceljs ==\n'
git ls-files | rg '\.(js|jsx|ts|tsx|mjs|cjs|json|yml|yaml)$' | xargs rg -n '\b(uuid|exceljs)\b' || trueRepository: BigSimmo/Database
Length of output: 40598
🌐 Web query:
exceljs source uuid usage v4 named import uuid 11 compatibility
💡 Result:
ExcelJS currently pins the uuid dependency to ^8.3.0 in version 4.4.0 [1][2]. While the library uses uuid's v4 method internally via the named CommonJS import const {v4: uuidv4} = require('uuid') [1], it does not natively support or officially bundle uuid 11 or later [2]. Users encountering security advisories or requiring compatibility with newer uuid versions typically address this by using package manager overrides (npm) or resolutions (yarn) to force the transitive dependency to a newer version, such as uuid 14.0.0 [1][3]. Because ExcelJS consumes uuid via a simple, common v4 call, this override is generally compatible and effective without requiring changes to ExcelJS source code [1][3]. If you are using modern Node.js environments, you can apply this override in your package.json to resolve security vulnerabilities or compatibility issues: For npm: "overrides": { "exceljs": { "uuid": "^14.0.0" } } For yarn: "resolutions": { "exceljs/uuid": "^14.0.0" } Note that uuid 11 and later versions are ESM-only, which can cause issues if your environment or older build tools (like older versions of Jest or specific CommonJS setups) expect the older CommonJS structure [3][4]. Using a recent version of Node.js (e.g., 22+) is recommended to avoid module compatibility errors [3].
Citations:
- 1: chore(deps): override transitive exceljs uuid to clear npm-audit advisory wonderwhy-er/DesktopCommanderMCP#513
- 2: Update uuid and tmp dependencies to fix security vulnerabilities exceljs/exceljs#3055
- 3: [BUG] Security Vulnerability in "uuid" transitive dependency in exceljs latest version 4.4.0 exceljs/exceljs#3041
- 4: [BUG] problem with exports modules exceljs/exceljs#1542
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== ExcelJS call sites ==\n'
rg -n 'ExcelJS|exceljs' src scripts tests --glob '!**/node_modules/**' --glob '!package-lock.json' || true
printf '\n== src/lib/extractors/document.ts (selected lines) ==\n'
sed -n '1,220p' src/lib/extractors/document.ts
printf '\n== scripts/generate-sample-documents.ts (selected lines) ==\n'
sed -n '1,220p' scripts/generate-sample-documents.tsRepository: BigSimmo/Database
Length of output: 18604
Drop the uuid 11 override exceljs@4.4.0 still pulls uuid through a CommonJS require, and the codebase uses ExcelJS in src/lib/extractors/document.ts and scripts/generate-sample-documents.ts. The brace-expansion edges are already on patched releases (1.1.16, 2.1.2, 5.0.7).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` around lines 205 - 208, Remove the uuid 11 override from the
package dependency overrides, while retaining the existing brace-expansion
overrides at their patched versions. Do not change the ExcelJS usage in the
document extractor or sample-generation script.
2 participants
Summary
Triages the three open Dependabot dependency PRs and lands the ones that verify clean without regression, with the smallest safe compatibility changes. One major is deliberately held because it is incompatible with the toolchain.
chore(deps-dev): bump @babel/parser from 7.29.7 to 8.0.4 #991 —
@babel/parser^7.29.7→^8.0.4(dev, major): TAKEN + migrated.import(...)as an ESTree-alignedImportExpression(specifier insource, attributes inoptions) instead of Babel 7'sCallExpressionwith anImportcallee. Thearchitecture-boundariesruntime-graph parser is taught both shapes so dynamic-import edges keep resolving (a[]regression otherwise)."importAttributes"parser plugin (now a type error). Dropped it from the two test parsers; attribute parsing is unchanged.@babel/parseris bumped to 8 at the top level; the Babel toolchain's own transitive@babel/parserstays at 7.@babel/parseris a dev-only, test-infra dependency (Next builds with SWC), so no runtime/product surface is touched.chore(deps): bump @supabase/supabase-js from 2.110.2 to 2.110.7 #945 —
@supabase/supabase-js→2.110.7(prod, patch): superseded.2.110.7is already the resolved/installed version onmainunder the old^2.108.2range, so this only lifts the declared floor to^2.110.7to match reality.scripts/check-client-bundle-secrets.mjsis intentionally not taken:mainhas since evolved that scanner to mask matched values, and its regex (/\bsb_secret_[A-Za-z0-9_-]{20,}\b/) already ignores supabase-js's baresb_secret_prefix-check literal (verified: bare-prefix → no match, real key → match). Taking the stale rewrite would regress the newer masking. No source/scanner change is needed here.chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 #990 —
typescript^6.0.0→^7.0.2(dev, major): HELD (incompatible).typescriptpackage no longer exposes the classic programmatic compiler API (ts.createProgram/ts.transpileModuleareundefined).typescript-eslint(viaeslint-config-next) needs that API and crashes at lint time:TypeError: Cannot read properties of undefined (reading 'Cjs')in@typescript-eslint/typescript-estree. Nativetsc --noEmitalone passes, but lint is hard-broken.@typescript/typescript6for compiler-API consumers. Bumping thetypescriptpeer to 7 breaks the type-aware lint toolchain. Kept at^6.0.0per the "newest compatible version" rule; revisit oncetypescript-eslint+eslint-config-nextsupport the native port.Two CI-driven follow-ups (in this PR)
npm@11.17.0. An older npm (11.6.2, this session's default) pruned two platform-optional packages (@emnapi/core,@emnapi/runtime— the wasm fallback forunrs-resolver's native binding) when regenerating the lock, which broke CI's strictnpm ci(EUSAGE: Missing @emnapi/* from lock file). Regenerating with the pinned npm keeps the optional entries and restoresnpm cisync.brace-expansionReDoS advisory (GHSA-3jxr-9vmj-r5cp) remediated. CI's "Dependency audit (blocking on dependency changes)" step (npm audit --omit=dev --audit-level=high) hard-blocks only when a PR touches the manifest/lockfile — somaincarries this pre-existing high-severity advisory ungated, but this dependency PR must clear it. Fixed surgically via per-major overrides (brace-expansion@11.1.14 → 1.1.16,brace-expansion@22.1.0 → 2.1.2) so each consumer keeps its major and takes only the security patch.npm audit --omit=dev --audit-level=highnow reports 0 vulnerabilities.Verification
Offline gates on the delivered state (Babel 8 + supabase floor + brace-expansion patch, TypeScript pinned at 6):
npm run typecheck— passnpm run test(full unit suite) — 3028 passed, no new failures vs. baseline. The single failure (tests/pdf-extraction-budget.test.ts"terminates the Python child tree") is a pre-existing, deterministic sandbox-only failure (process-group kill behaves differently here); it fails identically on unmodifiedmain.npm run lint— passnpm run check:knip(dependency graph) — passcheck:client-bundle-secretsagainst a real bundle — passnpm@11.17.0 ci --dry-run(lock/manifest sync) — passnpm audit --omit=dev --audit-level=high— 0 vulnerabilitiesRisk and rollout
@babel/parserto^7.29.7/@supabase/supabase-jsto^2.108.2and drop thebrace-expansionoverrides inpackage.json, then regenerate the lockfile.Clinical Governance Preflight
Not applicable — no change to ingestion, answer generation, search/ranking, source rendering, document access, privacy, production env, or clinical output. (The one privacy-adjacent file touched,
tests/client-secret-surface.test.ts, only had the Babel 8 parser-plugin line updated; the secret scanner logic is unchanged.)Notes
main). chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 #990 (TypeScript 7) should stay held or be closed until the lint toolchain supports the native port.brace-expansionremediation here also clears one of the pre-existing high-severity Dependabot alerts on the default branch.Summary by CodeRabbit
Chores
Tests