chore: update deps - #1844
Conversation
… and general updates
Code Review: PR #1844 - Dependency UpdatesOverviewThis PR updates project dependencies with a version bump from 2.24.0 to 2.25.0. The changes include major version updates to dev tooling and security-related package overrides. ✅ Positive Aspects
|
| Aspect | Score | Notes |
|---|---|---|
| Security | ⭐⭐⭐⭐⭐ | Excellent - addresses multiple CVEs |
| Type Safety | ⭐⭐⭐⭐⭐ | Improved with explicit types |
| Browser Compat | ⭐⭐⭐⭐⭐ | Better Buffer handling |
| CI Status | ⭐⭐ | Failing - needs fixes |
| Breaking Changes | ⭐⭐⭐ | Major updates need careful testing |
✏️ Minor Suggestions
- Consider adding a migration guide for the ESLint v9 changes
- Document any new linting rules that developers should be aware of
- Test the form-data update thoroughly for IPFS uploads
- Verify all transitive dependency security overrides are actually being applied
Overall Assessment: This is a valuable security and modernization update, but should not be merged until lint and build failures are resolved. The code changes themselves are good, but the tooling migration needs completion.
The changes align with Cannon's development standards and improve overall code quality once CI issues are addressed.
Pull Request Review: Dependency UpdatesSummaryThis PR updates numerous dependencies across the monorepo, with 176 files changed (+8,939/-13,984 lines). The changes primarily consist of:
Key Changes Reviewed1. Root Package Dependencies
2. Code Quality ObservationsPOSITIVES:
CONCERNS:
3. Security and PerformanceGOOD:
REVIEW NEEDED:
4. Breaking Change PotentialHIGH RISK AREAS:
Recommendations
Test Coverage VerificationGiven the scope of changes, please confirm:
Overall AssessmentScope: Large-scale dependency update The dependency updates are necessary for security and keeping the project modern. The systematic approach is good, but the major version jumps (especially ESLint v9 and TypeScript-ESLint v8) require careful verification. |
Pull Request Review: chore: update depsSummaryThis PR updates project dependencies and applies automated code formatting across 176 files with 8,939 additions and 13,984 deletions. The changes are primarily:
Code Quality & Best PracticesPositive Observations:
Configuration Changes:
Potential Issues & ConcernsBreaking Changes:
Missing Items:
Security ConcernsGood:
To Verify:
Performance ConsiderationsPositive:
Concerns:
Test CoverageGood:
Recommendations:
RecommendationsCritical (Should Address Before Merge):
Recommended:
Nice to Have:
VerdictRecommendation: REQUEST CHANGES While the code formatting is excellent and dependency updates are generally good, the missing ESLint 9 configuration and lack of verification testing make this PR risky to merge as-is. Action Items:
Once these items are addressed, this will be a great modernization update for the codebase! |
had to update lodash and fix zod issues
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
website builds, needed to remove SEO and EIP-7412
- Add .npmrc with onlyBuiltDependencies for cypress, esbuild, sharp, etc. - Remove duplicate alter and fetch command registrations (fixes commander crash) - Remove useless try/catch wrapper on fetch command - Fix unused imports in template.ts (isArray, mapValues, isFunction, entries, last) - Fix missing getBlockRetried import in helpers.test.ts - Fix generateSchema.js: add missing imports for zodToJsonSchema and cannonfileFragmentSchema - Fix unused vars in ethereum.ts: prefix with underscore - Fix prefer-const in packages.ts - Remove stale eslint-disable comments - Fix ActionKinds type-only usage in builder.ts - Prettier formatting fixes
.npmrc format wasn't being picked up by pnpm in CI. Using the pnpm.onlyBuiltDependencies field in package.json is the canonical way to approve build scripts in pnpm v10+. Regenerated lockfile to include the approved builds config.
pnpm v10 requires onlyBuiltDependencies to be in both package.json and the lockfile settings section. Without it in the lockfile, Vercel's frozen-lockfile install fails with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH.
Regenerated lockfile from scratch with pnpm 10.34.2 to resolve ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. onlyBuiltDependencies is now properly declared in both package.json and lockfile settings.
The onlyBuiltDependencies config was causing ERR_PNPM_LOCKFILE_CONFIG_MISMATCH on Vercel. Removed it entirely — it's not needed for production builds. The GH Actions cypress issue can be handled separately in the workflow.
Tells Vercel to use corepack, which respects the packageManager field and will use pnpm 10.34.2 instead of defaulting to pnpm 9.x.
3 participants
No description provided.