feat(deps): pnpm 11 migration + frontend major refresh (Vite 8 · TS 6 · Node 24) - #1095
Merged
Merged
Conversation
…ontend dep refresh) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Contributor
📝 WalkthroughWalkthroughMigrates the repo to pnpm and Node 24, updates GitHub Actions, caching, and PR workflows, rewrites Dockerfiles for pnpm workspaces, refreshes docs/scripts, regenerates webapp API client/types, replaces framer-motion with motion, and adjusts UI exports and icons. ChangesPnpm and Node 24 migration across repo
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Poem
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
|
…jobs Without checkout the preview job cannot resolve the ./.github/actions/setup-pnpm-node composite. Sparse-checkout fetches only the composite + .node-version so the runner does not download the full repo for a Surge deploy. Splitting the matrix into build-preview / build-production avoids spinning a runner on the idle flavor. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…ook manager @hey-api/openapi-ts 0.90→0.97 produces a slightly different sdk/transformers shape (idiomatic-modules path renames). Regenerated to keep CI's openapi-sync gate happy. The Storybook manager imported lodash/startCase, but lodash was never a declared webapp dep — npm's hoisting masked it; pnpm's strict resolution exposes it. Replace with a six-line inline implementation; no need to pull ~600 KB of lodash into the manager bundle. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…teardown actions/setup-node@v6 with cache: pnpm needs the lockfile present to compute the cache key, even if the job never runs pnpm install. Without it the preview deploy + teardown fail with "Dependencies lock file is not found". Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Contributor
📚 Documentation Preview
|
…npm comment corepack prepare --activate (no version) needs a packageManager field in cwd, which doesn't exist before COPY package.json. Pin the version explicitly to keep the layer cacheable independent of source. The committed schema.mmd had a stale 'npm run' comment; the regen script already emits 'pnpm run', so CI's drift check fails. Hand-syncing matches what the next regen will produce. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The webhook Dockerfile now references workspace-root files (pnpm-lock.yaml, pnpm-workspace.yaml, other workspace package.json files) to run `pnpm install --filter webhook-ingest...`. Set docker-context to repo root. pi-coding-agent install via `pnpm add -g` requires \$PNPM_HOME/bin in PATH (pnpm 11 uses a /bin layout, not the v10 flat layout). Add both \$PNPM_HOME and \$PNPM_HOME/bin to PATH so corepack can find pnpm and pnpm can find its own globals. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
TS 6 requires explicit rootDir when the inferred common source directory collapses to a single subtree. In the Docker build context only src/ is COPYed (no test/), so tsc infers rootDir=./src and refuses to emit unless told so explicitly. Split: tsconfig.json now only includes src/ (compilation entry), and a new tsconfig.test.json overlays src/ + test/ + *.config.ts for tsc --noEmit. The typecheck script points at the test config so test code keeps being checked at PR time. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
13 tasks
… audit vulns Removes the last two "pragmatic backoff" pins: - lucide-react 0.577.0 → 1.16.0. v1 dropped GitHub/GitLab brand icons for licensing reasons; added webapp/src/components/icons/brand.tsx exporting drop-in `GithubIcon`/`GitlabIcon`/`Github` with the Lucide API surface (size/className/forwardRef/aria) over inline SVG paths. 7 callsites updated. - recharts 2.15.4 → 3.8.1. webapp/src/components/ui/chart.tsx rewritten against the shadcn v3 wrapper (Tooltip/Legend payload types reworked upstream, TooltipContentProps is now the carrier for runtime-injected payload/label, LegendProps no longer carries payload). Security audit goes from 10 → 0 vulnerabilities via four pnpm overrides (moved overrides + peerDependencyRules to pnpm-workspace.yaml — pnpm 11's documented home, package.json#pnpm.overrides was a no-op for transitives): - dompurify 3.4.4 (was 3.2.7/3.4.3 via monaco-editor + mermaid; GHSA-crv5-9vww-q3g8 et al.) - lodash + lodash-es 4.18.1 (was 4.17.21 via java-parser/chevrotain; proto-pollution CVEs) - serialize-javascript 7.0.5 (was 6.x via @Docusaurus copy-webpack-plugin; GHSA-1113686, GHSA-1115723 XSS via __proto__) Plus small drift: @tanstack/react-router 1.170.3→1.170.4, @tanstack/router-plugin 1.168.5→1.168.6. Biome schema URLs bumped from 2.4.4 → 2.4.15 to match the installed runtime. Renovate `packageRule` gating lucide/recharts majors removed — no longer needed. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 14
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (5)
.opencode/commands/land-pr.md (1)
26-27:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winUpdate lockfile trigger to
pnpm-lock.yaml.The component mapping still keys on
package-lock.json, which is stale after pnpm migration and can misclassify lockfile-only changes.Suggested doc fix
-- `package.json` OR `package-lock.json` OR `.node-version` → webapp + webhook changed +- `package.json` OR `pnpm-lock.yaml` OR `.node-version` → webapp + webhook changed🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.opencode/commands/land-pr.md around lines 26 - 27, The component mapping still checks for the old lockfile name `package-lock.json`; update the trigger text and any mapping keys to use `pnpm-lock.yaml` instead (e.g., replace occurrences of "`package-lock.json`" in the line "`package.json` OR `package-lock.json` OR `.node-version` → webapp + webhook changed" and any other references) so lockfile-only changes are correctly classified after migrating to pnpm.docs/README.md (1)
17-21:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winKeep Quick Start package manager consistent (replace remaining
npm start).This block mixes pnpm and npm; after migration, the docs-dir command should also use pnpm.
Suggested doc fix
-# Or from docs directory -cd docs && npm start +# Or from docs directory +cd docs && pnpm start🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/README.md` around lines 17 - 21, Replace the mixed package manager command in the README: change the docs directory start command that currently uses "npm start" to use pnpm (e.g., "cd docs && pnpm start") so the Quick Start consistently uses pnpm alongside the existing "pnpm run docs:dev" example; update the line in the block showing the docs-dir command accordingly.AGENTS.md (1)
20-20:⚠️ Potential issue | 🟠 Major | ⚡ Quick winFix stale toolchain prerequisites (still npm/Node 22).
This line conflicts with the migration in this PR (pnpm + Node 24), so the top-level onboarding guidance is currently contradictory.
Suggested doc fix
-- **Node.js**: Use the exact version from `.node-version` (currently 22.10.0). Stick with npm—the repo maintains `package-lock.json` and uses npm workspaces. The webapp and webhook-ingest are TypeScript packages that use npm. +- **Node.js**: Use the exact version from `.node-version` (currently Node 24). Use pnpm via Corepack—the repo is managed with `pnpm-lock.yaml` and pnpm workspaces. The webapp and webhook-ingest are TypeScript packages managed through pnpm.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@AGENTS.md` at line 20, Update the AGENTS.md onboarding line that currently instructs using npm and Node 22 (references the text ".node-version" and the phrase "npm workspaces") to reflect the repository's migration: state that the project uses pnpm and Node 24 (remove/replace the instruction about `.node-version` pointing to 22.10.0 and the recommendation to use npm), and include a short note to follow the repo's toolchain files (e.g., pnpm-lock.yaml and .nvmrc/.node-version if updated) for exact versions so the doc is consistent with the PR migration.pnpm-workspace.yaml (1)
1-77:⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift
pnpm-workspace.yamlintroduces pnpm-only workspace behavior against repo policy.This file makes pnpm a required part of dependency resolution and install behavior, which conflicts with the repository rule to stay on npm with Node
22.10.0.As per coding guidelines: "Use the exact Node.js version from
.node-version(currently 22.10.0) and stick with npm for dependency management".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pnpm-workspace.yaml` around lines 1 - 77, The PR added a pnpm-specific workspace file (pnpm-workspace.yaml) which enforces pnpm-only behavior and violates the repo policy to use Node 22.10.0 and npm; remove or revert the pnpm-workspace.yaml addition and any references to pnpm-only keys (publicHoistPattern, overrides, peerDependencyRules, supportedArchitectures, allowBuilds) so the repository remains npm-compatible, and if you need to preserve overrides/locks convert them into npm-compatible artifacts (package.json overrides or documented npm instructions) and ensure .node-version (22.10.0) remains authoritative.webapp/src/api/core/types.gen.ts (1)
52-57:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winDo not hand-edit
webapp/src/api/core/types.gen.ts—regenerate the API types instead.Line 56 contains
| unknownin the header value union, which widens the type tounknownand undermines type safety. Since this is an auto-generated file (.gen.ts), regenerate it usingpnpm run generate:api:application-server:clientrather than manually editing.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@webapp/src/api/core/types.gen.ts` around lines 52 - 57, The generated type for the headers field (`headers?: RequestInit['headers'] | Record<string, string | number | boolean | (string | number | boolean)[] | null | undefined | unknown>`) incorrectly includes `| unknown`, weakening type safety; do not edit `types.gen.ts` by hand — regenerate the API types so the union is correctly generated (removing the `unknown`) by running the project generator: run `pnpm run generate:api:application-server:client` and commit the regenerated output so the `headers` type is fixed in `types.gen.ts`.
🧹 Nitpick comments (2)
webapp/src/components/ui/progress.tsx (1)
64-64: 💤 Low valueClarify rationale for shadcn/ui export reordering across multiple files.
Export lists were reordered in 7 shadcn/ui component files (
field.tsx,hover-card.tsx,input-group.tsx,item.tsx,menubar.tsx,navigation-menu.tsx,progress.tsx) with no functional changes. As per coding guidelines, files insrc/components/ui/should not be modified without approval.Was this reordering intentional or a side-effect of automated tooling during the migration? If cosmetic-only, consider reverting to minimize diff surface in generated UI primitives.
As per coding guidelines: "Never edit files in
src/components/ui/(shadcn/ui primitives)" and "Do not modify shadcn/ui primitives without asking first"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@webapp/src/components/ui/progress.tsx` at line 64, The export reordering in shadcn/ui primitive files (e.g., exports like Progress, ProgressIndicator, ProgressLabel, ProgressTrack, ProgressValue in progress.tsx and similar lists in field.tsx, hover-card.tsx, input-group.tsx, item.tsx, menubar.tsx, navigation-menu.tsx) appears cosmetic; revert these files to their original export ordering from the upstream shadcn/ui sources (or restore them from your last approved commit) so the component primitives remain unmodified, or if the reorder was intentional, add a short comment at the top of each affected file and a note in the PR description explaining the tooling change and obtain approval before committing; in short, either restore original exports for all seven files or explicitly document and get sign-off.webapp/src/routes/_authenticated/workspaces/new/index.tsx (1)
3-6: ⚡ Quick winGeneralize
Provider.iconandPROVIDER_META.iconaway fromLucideIconfor library decoupling.Both files currently type icons as
LucideIconwhile actually assigning brand-specific icons (GithubIcon,GitlabIcon) that are typed asBrandIcon. Both usages render icons with only aclassNameprop, making a minimal generic shape safer and clearer.Refactor both locations to accept
ComponentType<{ className?: string }>:♻️ Proposed changes
webapp/src/routes/_authenticated/workspaces/new/index.tsx (lines 3–21):
-import type { LucideIcon } from "lucide-react"; +import type { ComponentType } from "react"; import { ArrowLeftIcon, OctagonXIcon } from "lucide-react"; import { getProvidersOptions } from "`@/api/`@tanstack/react-query.gen"; import { GithubIcon, GitlabIcon } from "`@/components/icons/brand`"; +type ProviderIcon = ComponentType<{ className?: string }>; + interface Provider { id: string; name: string; description: string; - icon: LucideIcon; + icon: ProviderIcon; to: string; }webapp/src/components/settings/LinkedAccountsSection.tsx (line 19):
-const PROVIDER_META: Record<string, { icon: LucideIcon; label: string }> = { +type ProviderIcon = ComponentType<{ className?: string }>; +const PROVIDER_META: Record<string, { icon: ProviderIcon; label: string }> = {🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@webapp/src/routes/_authenticated/workspaces/new/index.tsx` around lines 3 - 6, Update the icon types to be library-agnostic by replacing LucideIcon with React's ComponentType<{ className?: string }> for the Provider.icon field and the PROVIDER_META.icon entries (e.g., where GithubIcon and GitlabIcon are assigned); import ComponentType from React, change the Provider type and PROVIDER_META declaration to use ComponentType<{ className?: string }>, and ensure all render sites (the component that renders Provider.icon and any usages of PROVIDER_META.icon) pass only a className prop so the new generic signature matches existing usage.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/skills/fix-ci/SKILL.md:
- Around line 73-82: The SKILL.md allowlist currently only permits Bash(npm *)
so pnpm commands used elsewhere fail; update the allowlist entry in
.claude/skills/fix-ci/SKILL.md to permit pnpm (either add a new Bash(pnpm *)
entry or broaden the pattern to Bash((npm|pnpm) .*)), and apply the same change
to the other occurrences referenced (around the blocks noted at 96-97, 104-107,
121-122, 128-129) so all prescribed pnpm commands can run in the skill runtime.
In @.claude/skills/land-pr/SKILL.md:
- Around line 46-47: The workflow now uses pnpm but the allowed-tools whitelist
still only permits Bash(npm *), so update the allowed-tools entry in
.claude/skills/land-pr/SKILL.md to include pnpm (e.g., add Bash(pnpm *) or
include pnpm alongside npm) so the pnpm commands such as the occurrences around
the lines with "pnpm run format" (and other pnpm usages noted at lines ~55-56,
65-67, 72-74, 81-82, 93-94, 99-100, 115-117, 126-128) are permitted; modify the
allowed-tools block to whitelist pnpm and ensure the pattern matches the pnpm
command invocations used in the file.
In @.node-version:
- Line 1: Replace the pinned Node.js runtime value "24.15.0" in the
.node-version file with the repository-mandated version "22.10.0" so local and
CI toolchains match; update the single-line value to 22.10.0 and commit the
change (ensure no other files override this setting).
In `@package.json`:
- Line 4: The package manifest currently switches the repo to pnpm and updates
Node to >=24.0; revert the packageManager field from "pnpm@11.1.2" back to npm
(e.g. "packageManager": "npm@<appropriate-version>" or simply
"npm@<repo-standard>") and set the Node engine to the exact version from
.node-version by updating the engines.node field to "22.10.0" (or add engines:{
"node":"22.10.0" } if missing); ensure any other occurrences that changed Node
range (the node/engines entry) are replaced with the exact "22.10.0" value.
In `@scripts/codex-maintenance.sh`:
- Line 101: Update the stale status message in scripts/codex-maintenance.sh:
replace the echo that prints "ℹ️ Refreshing npm dependencies..." with language
matching the actual package manager (e.g., "ℹ️ Refreshing pnpm dependencies..."
or a neutral "ℹ️ Refreshing project dependencies...") so the output reflects
the command now using pnpm; locate the echo string "ℹ️ Refreshing npm
dependencies..." and modify it accordingly in the script.
- Line 102: The pnpm install invocation in scripts/codex-maintenance.sh uses
unsupported flags (--no-fund and --no-audit) that cause pnpm 11.1.2 to fail;
edit the command string "(cd \"$ROOT_DIR\" && pnpm install --prefer-offline
--no-fund --no-audit >/dev/null)" to remove the --no-fund and --no-audit flags,
keeping --prefer-offline and the subshell and redirection intact so the
dependency refresh step succeeds.
In `@scripts/codex-setup.sh`:
- Around line 146-147: The setup message and the installer command are
inconsistent: the echo line prints "Installing npm dependencies..." while the
script runs (cd "$ROOT_DIR" && pnpm install); update one so they match. Either
change the echo string to mention pnpm (e.g., "Installing pnpm dependencies...")
or replace the installer command with the npm equivalent (e.g., npm install) so
the echo and the command (the echo line and the (cd "$ROOT_DIR" && pnpm install)
command) are consistent.
In `@scripts/jean-setup.sh`:
- Around line 32-33: Update the echo log so it accurately reflects the package
manager used: change the install message that currently prints "Installing npm
dependencies..." to reference pnpm (e.g., "Installing pnpm dependencies..." or
"Installing dependencies with pnpm...") so the log matches the subsequent pnpm
install command in the script (the echo invocation and the pnpm install line).
In `@webapp/src/components/icons/brand.tsx`:
- Around line 15-29: The icon wrapper currently always exposes icons to AT via
role="img" and a <title>; change it to be decorative by default and only expose
an accessible name when props["aria-label"] (or children) is provided: compute
label = props["aria-label"] ?? displayName, and if label exists render
role="img" plus <title>{label}>, otherwise set aria-hidden="true" (or
role="presentation") and omit the <title>; update the SVG attributes near ref,
viewBox, width/height and the title/path rendering so that
role/title/aria-hidden are conditional based on label.
In `@webapp/src/components/ui/accordion.tsx`:
- Line 69: The change only reorders the export statement for Accordion
primitives (Accordion, AccordionContent, AccordionItem, AccordionTrigger) in the
shadcn/ui file and should not be modified; revert this file to its original
state by undoing the export reordering (restore the previous export line for the
Accordion primitives) so that no edits remain in the protected src/components/ui
shadcn primitive files.
In `@webapp/src/components/ui/carousel.tsx`:
- Around line 222-230: You modified shadcn/ui primitive exports (Carousel,
CarouselApi, CarouselContent, CarouselItem, CarouselNext, CarouselPrevious,
useCarousel); before any further edits, confirm the change has explicit prior
approval per repo policy—if approval is not present, revert this file to the
upstream/shadcn-provided version (restore original exports and implementation)
and remove your modifications; if approval exists, add a one-line PR note citing
the approver and policy exemption and keep only minimal, documented adjustments
to the Carousel-related symbols to match that approved design.
In `@webapp/src/components/ui/chart.tsx`:
- Around line 272-297: Legend rendering is including payload entries with
non-user-facing metadata (type === "none"); update the rendering in the
payload.map loop to skip/filter out items where item.type === "none" (e.g.,
filter payload before mapping or return null for those entries) so
getPayloadConfigFromPayload/itemConfig and the JSX (icons, label) only render
for visible series; use the existing symbols payload, nameKey,
getPayloadConfigFromPayload, itemConfig and hideIcon to implement the filter.
- Around line 170-238: The tooltip renderer currently iterates payload.map(...)
and renders entries whose payload.type === "none", producing invalid rows;
update the iteration to skip non-display entries by filtering payload first
(e.g., replace payload.map(...) with payload.filter(p => p.type !==
"none").map(...)) or early-return null for items with item.type === "none"; keep
existing logic around getPayloadConfigFromPayload, indicator/hideIndicator
handling, and keys (key={String(item.dataKey ?? item.name ?? index)}) so only
displayable payload entries are rendered.
In `@webapp/src/integrations/feature-flags/hooks.ts`:
- Line 9: Update the docstring in webapp/src/integrations/feature-flags/hooks.ts
to use the repo-standard regeneration command: replace the current instruction
"pnpm run openapi-ts" with "pnpm run generate:api:application-server" so the
comment reads along the lines of "Regenerate API client with pnpm run
generate:api:application-server when OpenAPI schema changes"; locate the
docstring in this file (the top comment block referenced around the existing
openapi-ts line) and make the substitution so future developers run the correct
command.
---
Outside diff comments:
In @.opencode/commands/land-pr.md:
- Around line 26-27: The component mapping still checks for the old lockfile
name `package-lock.json`; update the trigger text and any mapping keys to use
`pnpm-lock.yaml` instead (e.g., replace occurrences of "`package-lock.json`" in
the line "`package.json` OR `package-lock.json` OR `.node-version` → webapp +
webhook changed" and any other references) so lockfile-only changes are
correctly classified after migrating to pnpm.
In `@AGENTS.md`:
- Line 20: Update the AGENTS.md onboarding line that currently instructs using
npm and Node 22 (references the text ".node-version" and the phrase "npm
workspaces") to reflect the repository's migration: state that the project uses
pnpm and Node 24 (remove/replace the instruction about `.node-version` pointing
to 22.10.0 and the recommendation to use npm), and include a short note to
follow the repo's toolchain files (e.g., pnpm-lock.yaml and .nvmrc/.node-version
if updated) for exact versions so the doc is consistent with the PR migration.
In `@docs/README.md`:
- Around line 17-21: Replace the mixed package manager command in the README:
change the docs directory start command that currently uses "npm start" to use
pnpm (e.g., "cd docs && pnpm start") so the Quick Start consistently uses pnpm
alongside the existing "pnpm run docs:dev" example; update the line in the block
showing the docs-dir command accordingly.
In `@pnpm-workspace.yaml`:
- Around line 1-77: The PR added a pnpm-specific workspace file
(pnpm-workspace.yaml) which enforces pnpm-only behavior and violates the repo
policy to use Node 22.10.0 and npm; remove or revert the pnpm-workspace.yaml
addition and any references to pnpm-only keys (publicHoistPattern, overrides,
peerDependencyRules, supportedArchitectures, allowBuilds) so the repository
remains npm-compatible, and if you need to preserve overrides/locks convert them
into npm-compatible artifacts (package.json overrides or documented npm
instructions) and ensure .node-version (22.10.0) remains authoritative.
In `@webapp/src/api/core/types.gen.ts`:
- Around line 52-57: The generated type for the headers field (`headers?:
RequestInit['headers'] | Record<string, string | number | boolean | (string |
number | boolean)[] | null | undefined | unknown>`) incorrectly includes `|
unknown`, weakening type safety; do not edit `types.gen.ts` by hand — regenerate
the API types so the union is correctly generated (removing the `unknown`) by
running the project generator: run `pnpm run
generate:api:application-server:client` and commit the regenerated output so the
`headers` type is fixed in `types.gen.ts`.
---
Nitpick comments:
In `@webapp/src/components/ui/progress.tsx`:
- Line 64: The export reordering in shadcn/ui primitive files (e.g., exports
like Progress, ProgressIndicator, ProgressLabel, ProgressTrack, ProgressValue in
progress.tsx and similar lists in field.tsx, hover-card.tsx, input-group.tsx,
item.tsx, menubar.tsx, navigation-menu.tsx) appears cosmetic; revert these files
to their original export ordering from the upstream shadcn/ui sources (or
restore them from your last approved commit) so the component primitives remain
unmodified, or if the reorder was intentional, add a short comment at the top of
each affected file and a note in the PR description explaining the tooling
change and obtain approval before committing; in short, either restore original
exports for all seven files or explicitly document and get sign-off.
In `@webapp/src/routes/_authenticated/workspaces/new/index.tsx`:
- Around line 3-6: Update the icon types to be library-agnostic by replacing
LucideIcon with React's ComponentType<{ className?: string }> for the
Provider.icon field and the PROVIDER_META.icon entries (e.g., where GithubIcon
and GitlabIcon are assigned); import ComponentType from React, change the
Provider type and PROVIDER_META declaration to use ComponentType<{ className?:
string }>, and ensure all render sites (the component that renders Provider.icon
and any usages of PROVIDER_META.icon) pass only a className prop so the new
generic signature matches existing usage.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: fe2e421a-29c1-4d21-8f97-89b4caa47b4d
⛔ Files ignored due to path filters (3)
docs/package-lock.jsonis excluded by!**/package-lock.jsonpackage-lock.jsonis excluded by!**/package-lock.jsonpnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (136)
.claude/skills/fix-ci/SKILL.md.claude/skills/land-pr/SKILL.md.claude/skills/react-best-practices/AGENTS.md.claude/skills/react-best-practices/rules/rendering-svg-precision.md.dockerignore.github/PULL_REQUEST_TEMPLATE.md.github/actions/setup-caches/action.yml.github/actions/setup-pnpm-node/action.yml.github/copilot-environment.yml.github/instructions/tsx.instructions.md.github/prompts/fix-ci.prompt.md.github/prompts/land-pr.prompt.md.github/workflows/cd-docs-teardown.yml.github/workflows/cd-docs.yml.github/workflows/ci-docker-build.yml.github/workflows/ci-quality-gates.yml.github/workflows/ci-tests.yml.github/workflows/cicd.yml.github/workflows/openapi-autocommit.yml.github/workflows/pull-request.yml.husky/commit-msg.husky/pre-push.node-version.npmrc.opencode/commands/fix-ci.md.opencode/commands/land-pr.mdAGENTS.mdMIGRATION.mddocker/agents/pi/Dockerfiledocs/README.mddocs/contributor/ai-agent-workflow.mdxdocs/contributor/ci-cd.mdxdocs/contributor/coding-guidelines.mdxdocs/contributor/database-migration.mdxdocs/contributor/database-schema.mdxdocs/contributor/dockerless-postgres.mdxdocs/contributor/erd/schema.mmddocs/contributor/local-development.mdxdocs/contributor/testing.mdxdocs/package.jsondocs/tsconfig.jsonpackage.jsonpnpm-workspace.yamlrenovate.jsonscripts/README.mdscripts/codex-maintenance.shscripts/codex-setup.shscripts/db-utils.shscripts/generate-mermaid-erd.tsscripts/install-platform-binaries.mjsscripts/jean-setup.shscripts/update-github-schema.tsscripts/update-gitlab-schema.tsserver/application-server/AGENTS.mdserver/application-server/agent-extensions/package.jsonserver/webhook-ingest/AGENTS.mdserver/webhook-ingest/Dockerfileserver/webhook-ingest/README.mdserver/webhook-ingest/biome.jsonserver/webhook-ingest/package.jsonserver/webhook-ingest/src/logger.tsserver/webhook-ingest/tsconfig.jsonserver/webhook-ingest/tsconfig.test.jsonwebapp/.storybook/manager.tswebapp/AGENTS.mdwebapp/Dockerfilewebapp/README.mdwebapp/biome.jsonwebapp/package.jsonwebapp/public/env-config.jswebapp/src/api/client/client.gen.tswebapp/src/api/client/types.gen.tswebapp/src/api/client/utils.gen.tswebapp/src/api/core/auth.gen.tswebapp/src/api/core/bodySerializer.gen.tswebapp/src/api/core/params.gen.tswebapp/src/api/core/pathSerializer.gen.tswebapp/src/api/core/queryKeySerializer.gen.tswebapp/src/api/core/serverSentEvents.gen.tswebapp/src/api/core/types.gen.tswebapp/src/api/core/utils.gen.tswebapp/src/api/sdk.gen.tswebapp/src/api/transformers.gen.tswebapp/src/components/achievements/storyMockData.tswebapp/src/components/icons/brand.tsxwebapp/src/components/info/about/AboutCallToActionSection.tsxwebapp/src/components/info/about/ProjectManagerCard.tsxwebapp/src/components/info/landing/LandingFAQSection.tsxwebapp/src/components/leaderboard/TimeframeFilter.tsxwebapp/src/components/mentor/Greeting.tsxwebapp/src/components/mentor/Message.tsxwebapp/src/components/mentor/MessageReasoning.tsxwebapp/src/components/mentor/Messages.tsxwebapp/src/components/mentor/MultimodalInput.tsxwebapp/src/components/profile/ProfileTimeframePicker.tsxwebapp/src/components/settings/LinkedAccountsSection.tsxwebapp/src/components/surveys/posthog-survey-widget.tsxwebapp/src/components/surveys/survey-notification-button.stories.tsxwebapp/src/components/surveys/survey-notification-button.tsxwebapp/src/components/ui/accordion.tsxwebapp/src/components/ui/alert.tsxwebapp/src/components/ui/avatar.tsxwebapp/src/components/ui/breadcrumb.tsxwebapp/src/components/ui/calendar.tsxwebapp/src/components/ui/card.tsxwebapp/src/components/ui/carousel.tsxwebapp/src/components/ui/chart.tsxwebapp/src/components/ui/collapsible.tsxwebapp/src/components/ui/command.tsxwebapp/src/components/ui/context-menu.tsxwebapp/src/components/ui/drawer.tsxwebapp/src/components/ui/dropdown-menu.tsxwebapp/src/components/ui/empty.tsxwebapp/src/components/ui/field.tsxwebapp/src/components/ui/hover-card.tsxwebapp/src/components/ui/input-group.tsxwebapp/src/components/ui/input-otp.tsxwebapp/src/components/ui/item.tsxwebapp/src/components/ui/menubar.tsxwebapp/src/components/ui/navigation-menu.tsxwebapp/src/components/ui/progress.tsxwebapp/src/components/ui/resizable.tsxwebapp/src/components/ui/sheet.tsxwebapp/src/components/ui/table.tsxwebapp/src/components/ui/tabs.tsxwebapp/src/components/ui/tooltip.tsxwebapp/src/integrations/auth/index.tswebapp/src/integrations/auth/keycloak.tswebapp/src/integrations/feature-flags/hooks.tswebapp/src/integrations/sentry/index.tswebapp/src/integrations/theme/index.tswebapp/src/routes/_authenticated/workspaces/new/github.tsxwebapp/src/routes/_authenticated/workspaces/new/index.tsxwebapp/tsconfig.jsonwebapp/vite.config.tswebapp/vitest.config.storybook.ts
💤 Files with no reviewable changes (2)
- webapp/tsconfig.json
- scripts/install-platform-binaries.mjs
Comment on lines
+73
to
+82
| | 1 | Formatting | "Formatting failed", biome/prettier diff | `pnpm run format` | | ||
| | 2 | Lint | Biome lint errors | `pnpm run check:fix` | | ||
| | 3 | TypeScript | TS2xxx errors, type mismatch | Fix the type error in source | | ||
| | 4 | Build failure | Compilation errors, missing exports | Fix imports/exports, verify with `npm run build:webhook-ingest` | | ||
| | 5 | Webapp tests | "FAIL" in webapp test output | Fix test or source, verify with `npm run test:webapp` | | ||
| | 4 | Build failure | Compilation errors, missing exports | Fix imports/exports, verify with `pnpm run build:webhook-ingest` | | ||
| | 5 | Webapp tests | "FAIL" in webapp test output | Fix test or source, verify with `pnpm run test:webapp` | | ||
| | 5 | App server tests | Maven test failures, assertion errors | Fix test or source, verify with `cd server/application-server && ./mvnw test -Dsurefire.includedGroups="unit" -Dmaven.test.skip=false -T 2C --batch-mode -q` | | ||
| | 5 | Webhook tests | Vitest failures in webhook-ingest | Fix test or source, verify with `npm run test:webhook-ingest` | | ||
| | 6 | OpenAPI sync | "OpenAPI out of sync" | `npm run generate:api` | | ||
| | 6 | DB schema | "Schema drift detected" | `npm run db:draft-changelog` | | ||
| | 6 | DB ERD | "ERD outdated" | `npm run db:generate-erd-docs` | | ||
| | 5 | Webhook tests | Vitest failures in webhook-ingest | Fix test or source, verify with `pnpm run test:webhook-ingest` | | ||
| | 6 | OpenAPI sync | "OpenAPI out of sync" | `pnpm run generate:api` | | ||
| | 6 | DB schema | "Schema drift detected" | `pnpm run db:draft-changelog` | | ||
| | 6 | DB ERD | "ERD outdated" | `pnpm run db:generate-erd-docs` | |
Contributor
There was a problem hiding this comment.
Add pnpm to the skill tool allowlist.
These sections now require pnpm, but the allowlist still only permits Bash(npm *) (Line 11). In this state, the prescribed commands cannot be executed by the skill runtime.
Suggested patch
allowed-tools:
- Bash(gh *)
- Bash(git *)
+ - Bash(pnpm *)
- Bash(npm *)
- Bash(mvn *)
- Read
- Grep
- GlobAlso applies to: 96-97, 104-107, 121-122, 128-129
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.claude/skills/fix-ci/SKILL.md around lines 73 - 82, The SKILL.md allowlist
currently only permits Bash(npm *) so pnpm commands used elsewhere fail; update
the allowlist entry in .claude/skills/fix-ci/SKILL.md to permit pnpm (either add
a new Bash(pnpm *) entry or broaden the pattern to Bash((npm|pnpm) .*)), and
apply the same change to the other occurrences referenced (around the blocks
noted at 96-97, 104-107, 121-122, 128-129) so all prescribed pnpm commands can
run in the skill runtime.
Comment on lines
+46
to
47
| pnpm run format | ||
| ``` |
Contributor
There was a problem hiding this comment.
Whitelist pnpm in allowed-tools to match the migrated commands.
This workflow now relies on pnpm, but allowed-tools still only grants Bash(npm *) (Line 10). That blocks execution of the updated steps.
Suggested patch
allowed-tools:
- Bash(gh *)
- Bash(git *)
+ - Bash(pnpm *)
- Bash(npm *)
- Bash(mvn *)
- Read
- Grep
- GlobAlso applies to: 55-56, 65-67, 72-74, 81-82, 93-94, 99-100, 115-117, 126-128
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.claude/skills/land-pr/SKILL.md around lines 46 - 47, The workflow now uses
pnpm but the allowed-tools whitelist still only permits Bash(npm *), so update
the allowed-tools entry in .claude/skills/land-pr/SKILL.md to include pnpm
(e.g., add Bash(pnpm *) or include pnpm alongside npm) so the pnpm commands such
as the occurrences around the lines with "pnpm run format" (and other pnpm
usages noted at lines ~55-56, 65-67, 72-74, 81-82, 93-94, 99-100, 115-117,
126-128) are permitted; modify the allowed-tools block to whitelist pnpm and
ensure the pattern matches the pnpm command invocations used in the file.
| @@ -1 +1 @@ | |||
| 22.22.0 | |||
| 24.15.0 | |||
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat .node-versionRepository: ls1intum/Hephaestus
Length of output: 71
Revert the Node.js runtime pin to the repository-mandated version.
Line 1 sets 24.15.0, which conflicts with the coding guidelines requiring version 22.10.0. This version mismatch can desynchronize local and CI toolchains.
🔧 Proposed fix
-24.15.0
+22.10.0📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| 24.15.0 | |
| 22.10.0 |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.node-version at line 1, Replace the pinned Node.js runtime value "24.15.0"
in the .node-version file with the repository-mandated version "22.10.0" so
local and CI toolchains match; update the single-line value to 22.10.0 and
commit the change (ensure no other files override this setting).
| "server/webhook-ingest", | ||
| "server/application-server/agent-extensions" | ||
| ], | ||
| "packageManager": "pnpm@11.1.2", |
Contributor
There was a problem hiding this comment.
Root manifest now violates the package-manager and Node version policy.
Line 4 and Lines 8-57 switch the repo to pnpm, and Line 80 moves Node to >=24.0. This conflicts with the repository rule for this file to use npm and the exact Node version from .node-version (22.10.0).
As per coding guidelines: "Use the exact Node.js version from .node-version (currently 22.10.0) and stick with npm for dependency management".
Also applies to: 8-57, 80-80
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` at line 4, The package manifest currently switches the repo to
pnpm and updates Node to >=24.0; revert the packageManager field from
"pnpm@11.1.2" back to npm (e.g. "packageManager": "npm@<appropriate-version>" or
simply "npm@<repo-standard>") and set the Node engine to the exact version from
.node-version by updating the engines.node field to "22.10.0" (or add engines:{
"node":"22.10.0" } if missing); ensure any other occurrences that changed Node
range (the node/engines entry) are replaced with the exact "22.10.0" value.
| @@ -99,7 +99,7 @@ fi | |||
|
|
|||
| if [[ -d "$ROOT_DIR" ]]; then | |||
| echo "ℹ️ Refreshing npm dependencies..." | |||
Contributor
There was a problem hiding this comment.
Status message is stale after the package-manager switch.
Line 101 still says “npm dependencies” while the command now runs pnpm.
✏️ Proposed fix
- echo "ℹ️ Refreshing npm dependencies..."
+ echo "ℹ️ Refreshing pnpm dependencies..."📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| echo "ℹ️ Refreshing npm dependencies..." | |
| echo "ℹ️ Refreshing pnpm dependencies..." |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/codex-maintenance.sh` at line 101, Update the stale status message in
scripts/codex-maintenance.sh: replace the echo that prints "ℹ️ Refreshing npm
dependencies..." with language matching the actual package manager (e.g., "ℹ️
Refreshing pnpm dependencies..." or a neutral "ℹ️ Refreshing project
dependencies...") so the output reflects the command now using pnpm; locate the
echo string "ℹ️ Refreshing npm dependencies..." and modify it accordingly in
the script.
| } | ||
|
|
||
| export { Accordion, AccordionItem, AccordionTrigger, AccordionContent }; | ||
| export { Accordion, AccordionContent, AccordionItem, AccordionTrigger }; |
Contributor
There was a problem hiding this comment.
Avoid modifying shadcn primitive files in src/components/ui.
This export reorder is a no-op but still changes a protected primitive file. Please revert and keep these files untouched unless explicit approval was granted.
As per coding guidelines webapp/src/components/ui/**/*.{ts,tsx}: “Never edit files in src/components/ui/ (shadcn/ui primitives)”.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@webapp/src/components/ui/accordion.tsx` at line 69, The change only reorders
the export statement for Accordion primitives (Accordion, AccordionContent,
AccordionItem, AccordionTrigger) in the shadcn/ui file and should not be
modified; revert this file to its original state by undoing the export
reordering (restore the previous export line for the Accordion primitives) so
that no edits remain in the protected src/components/ui shadcn primitive files.
Comment on lines
222
to
230
| export { | ||
| type CarouselApi, | ||
| Carousel, | ||
| type CarouselApi, | ||
| CarouselContent, | ||
| CarouselItem, | ||
| CarouselPrevious, | ||
| CarouselNext, | ||
| CarouselPrevious, | ||
| useCarousel, | ||
| }; |
Contributor
There was a problem hiding this comment.
Confirm approval before modifying shadcn/ui primitive files.
This file is under src/components/ui/, and the PR edits it. Please confirm this change had prior approval per repo policy.
As per coding guidelines: webapp/src/components/ui/**/*.{ts,tsx}: Never edit files in src/components/ui/ (shadcn/ui primitives).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@webapp/src/components/ui/carousel.tsx` around lines 222 - 230, You modified
shadcn/ui primitive exports (Carousel, CarouselApi, CarouselContent,
CarouselItem, CarouselNext, CarouselPrevious, useCarousel); before any further
edits, confirm the change has explicit prior approval per repo policy—if
approval is not present, revert this file to the upstream/shadcn-provided
version (restore original exports and implementation) and remove your
modifications; if approval exists, add a one-line PR note citing the approver
and policy exemption and keep only minimal, documented adjustments to the
Carousel-related symbols to match that approved design.
Comment on lines
+170
to
+238
| {payload.map((item, index) => { | ||
| const key = `${nameKey || item.name || item.dataKey || "value"}`; | ||
| const itemConfig = getPayloadConfigFromPayload(config, item, key); | ||
| const indicatorColor = | ||
| color || (item.payload as { fill?: string } | undefined)?.fill || item.color; | ||
|
|
||
| return ( | ||
| <div | ||
| key={String(item.dataKey ?? item.name ?? index)} | ||
| className={cn( | ||
| "[&>svg]:text-muted-foreground flex w-full flex-wrap items-stretch gap-2 [&>svg]:h-2.5 [&>svg]:w-2.5", | ||
| indicator === "dot" && "items-center", | ||
| )} | ||
| > | ||
| {formatter && item.value !== undefined && item.name ? ( | ||
| formatter(item.value, item.name, item, index, item.payload) | ||
| ) : ( | ||
| <> | ||
| {itemConfig?.icon ? ( | ||
| <itemConfig.icon /> | ||
| ) : ( | ||
| !hideIndicator && ( | ||
| <div | ||
| className={cn( | ||
| "shrink-0 rounded-[2px] border-(--color-border) bg-(--color-bg)", | ||
| { | ||
| "h-2.5 w-2.5": indicator === "dot", | ||
| "w-1": indicator === "line", | ||
| "w-0 border-[1.5px] border-dashed bg-transparent": | ||
| indicator === "dashed", | ||
| "my-0.5": nestLabel && indicator === "dashed", | ||
| }, | ||
| )} | ||
| style={ | ||
| { | ||
| "--color-bg": indicatorColor, | ||
| "--color-border": indicatorColor, | ||
| } as React.CSSProperties | ||
| } | ||
| /> | ||
| ) | ||
| )} | ||
| <div | ||
| className={cn( | ||
| "flex flex-1 justify-between leading-none", | ||
| nestLabel ? "items-end" : "items-center", | ||
| )} | ||
| <div | ||
| className={cn( | ||
| "flex flex-1 justify-between leading-none", | ||
| nestLabel ? "items-end" : "items-center", | ||
| )} | ||
| > | ||
| <div className="grid gap-1.5"> | ||
| {nestLabel ? tooltipLabel : null} | ||
| <span className="text-muted-foreground"> | ||
| {itemConfig?.label || item.name} | ||
| </span> | ||
| </div> | ||
| {item.value && ( | ||
| <span className="text-foreground font-mono font-medium tabular-nums"> | ||
| {item.value.toLocaleString()} | ||
| </span> | ||
| )} | ||
| > | ||
| <div className="grid gap-1.5"> | ||
| {nestLabel ? tooltipLabel : null} | ||
| <span className="text-muted-foreground"> | ||
| {itemConfig?.label || item.name} | ||
| </span> | ||
| </div> | ||
| </> | ||
| )} | ||
| </div> | ||
| ); | ||
| })} | ||
| {item.value !== undefined && item.value !== null && ( | ||
| <span className="text-foreground font-mono font-medium tabular-nums"> | ||
| {Array.isArray(item.value) | ||
| ? item.value.join(", ") | ||
| : typeof item.value === "number" | ||
| ? item.value.toLocaleString() | ||
| : item.value} | ||
| </span> | ||
| )} | ||
| </div> | ||
| </> | ||
| )} | ||
| </div> | ||
| ); | ||
| })} |
Contributor
There was a problem hiding this comment.
Restore filtering for non-display tooltip payload entries.
payload.map(...) now renders all entries, including type === "none", which can introduce extra/invalid tooltip rows.
Proposed fix
- {payload.map((item, index) => {
+ {payload
+ .filter((item) => item.type !== "none")
+ .map((item, index) => {
const key = `${nameKey || item.name || item.dataKey || "value"}`;
const itemConfig = getPayloadConfigFromPayload(config, item, key);
const indicatorColor =
color || (item.payload as { fill?: string } | undefined)?.fill || item.color;
@@
- })}
+ })}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@webapp/src/components/ui/chart.tsx` around lines 170 - 238, The tooltip
renderer currently iterates payload.map(...) and renders entries whose
payload.type === "none", producing invalid rows; update the iteration to skip
non-display entries by filtering payload first (e.g., replace payload.map(...)
with payload.filter(p => p.type !== "none").map(...)) or early-return null for
items with item.type === "none"; keep existing logic around
getPayloadConfigFromPayload, indicator/hideIndicator handling, and keys
(key={String(item.dataKey ?? item.name ?? index)}) so only displayable payload
entries are rendered.
Comment on lines
+272
to
297
| {payload.map((item, index) => { | ||
| const key = `${nameKey || item.dataKey || "value"}`; | ||
| const itemConfig = getPayloadConfigFromPayload(config, item, key); | ||
|
|
||
| return ( | ||
| <div | ||
| key={item.value ?? index} | ||
| className={cn( | ||
| "[&>svg]:text-muted-foreground flex items-center gap-1.5 [&>svg]:h-3 [&>svg]:w-3", | ||
| )} | ||
| > | ||
| {itemConfig?.icon && !hideIcon ? ( | ||
| <itemConfig.icon /> | ||
| ) : ( | ||
| <div | ||
| className="h-2 w-2 shrink-0 rounded-[2px]" | ||
| style={{ | ||
| backgroundColor: item.color, | ||
| }} | ||
| /> | ||
| )} | ||
| {itemConfig?.label} | ||
| </div> | ||
| ); | ||
| })} | ||
| </div> |
Contributor
There was a problem hiding this comment.
Filter legend payload entries with type === "none".
Legend rendering now includes all payload entries, which can surface non-user-facing series metadata.
Proposed fix
- {payload.map((item, index) => {
+ {payload.filter((item) => item.type !== "none").map((item, index) => {
const key = `${nameKey || item.dataKey || "value"}`;
const itemConfig = getPayloadConfigFromPayload(config, item, key);📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| {payload.map((item, index) => { | |
| const key = `${nameKey || item.dataKey || "value"}`; | |
| const itemConfig = getPayloadConfigFromPayload(config, item, key); | |
| return ( | |
| <div | |
| key={item.value ?? index} | |
| className={cn( | |
| "[&>svg]:text-muted-foreground flex items-center gap-1.5 [&>svg]:h-3 [&>svg]:w-3", | |
| )} | |
| > | |
| {itemConfig?.icon && !hideIcon ? ( | |
| <itemConfig.icon /> | |
| ) : ( | |
| <div | |
| className="h-2 w-2 shrink-0 rounded-[2px]" | |
| style={{ | |
| backgroundColor: item.color, | |
| }} | |
| /> | |
| )} | |
| {itemConfig?.label} | |
| </div> | |
| ); | |
| })} | |
| </div> | |
| {payload.filter((item) => item.type !== "none").map((item, index) => { | |
| const key = `${nameKey || item.dataKey || "value"}`; | |
| const itemConfig = getPayloadConfigFromPayload(config, item, key); | |
| return ( | |
| <div | |
| key={item.value ?? index} | |
| className={cn( | |
| "[&>svg]:text-muted-foreground flex items-center gap-1.5 [&>svg]:h-3 [&>svg]:w-3", | |
| )} | |
| > | |
| {itemConfig?.icon && !hideIcon ? ( | |
| <itemConfig.icon /> | |
| ) : ( | |
| <div | |
| className="h-2 w-2 shrink-0 rounded-[2px]" | |
| style={{ | |
| backgroundColor: item.color, | |
| }} | |
| /> | |
| )} | |
| {itemConfig?.label} | |
| </div> | |
| ); | |
| })} | |
| </div> |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@webapp/src/components/ui/chart.tsx` around lines 272 - 297, Legend rendering
is including payload entries with non-user-facing metadata (type === "none");
update the rendering in the payload.map loop to skip/filter out items where
item.type === "none" (e.g., filter payload before mapping or return null for
those entries) so getPayloadConfigFromPayload/itemConfig and the JSX (icons,
label) only render for visible series; use the existing symbols payload,
nameKey, getPayloadConfigFromPayload, itemConfig and hideIcon to implement the
filter.
| * Feature flag name type derived from the generated OpenAPI types. | ||
| * Adding a new flag to the backend FeatureFlag enum + FeatureFlagsDTO | ||
| * and running `npm run openapi-ts` automatically updates this type. | ||
| * and running `pnpm run openapi-ts` automatically updates this type. |
Contributor
There was a problem hiding this comment.
Use the repo-standard API client regeneration command in this docstring.
Line 9 points to pnpm run openapi-ts, but the documented team workflow uses pnpm run generate:api:application-server. Please align this comment to avoid drift.
Based on learnings: Regenerate API client with pnpm run generate:api:application-server when OpenAPI schema changes.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@webapp/src/integrations/feature-flags/hooks.ts` at line 9, Update the
docstring in webapp/src/integrations/feature-flags/hooks.ts to use the
repo-standard regeneration command: replace the current instruction "pnpm run
openapi-ts" with "pnpm run generate:api:application-server" so the comment reads
along the lines of "Regenerate API client with pnpm run
generate:api:application-server when OpenAPI schema changes"; locate the
docstring in this file (the top comment block referenced around the existing
openapi-ts line) and make the substitution so future developers run the correct
command.
Collaborator
Author
|
🎉 This PR is included in version 0.67.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrates the JS/TS toolchain from npm workspaces to pnpm 11, refreshes ~50 frontend dependencies including 12 bleeding-edge majors, and lands the toolchain at 0 known security vulnerabilities (down from 10). Resolves the bulk of the Renovate dependency dashboard (#709).
Fixes #709
What it does, in one screen
@vitejs/plugin-react@4@vitejs/plugin-react@6+reactCompilerPreset()via@rolldown/plugin-babel@sentry/react@9framer-motion@12motion@12(renamed upstream; all 8 callsites swapped tomotion/react)react-day-picker@9autoFocusrename)react-resizable-panels@3resizable.tsxrewritten forGroup/Separator/orientation)lucide-react@0.5xxwebapp/src/components/icons/brand.tsxfor GitHub/GitLab marks (v1 dropped brand glyphs for licensing)recharts@2chart.tsxrewritten for the v3 Tooltip/Legend payload types)biome 2.4.4pnpm auditPlus the long tail of minor/patch bumps Renovate flagged: TanStack 5.100/1.170, Tailwind 4.3,
@sentry/react10.53,@hono/node-server2.0.2 (security),uuid14,streamdown2.5,@hey-api/openapi-ts0.97,chromatic16,@chromatic-com/storybook5,@commitlint21,jsdom29,dotenv-expand13,@base-ui/react1.4,@primer/primitives11,dorny/test-reporterv3, etc.What users will notice
Nothing visible. Storybook + Chromatic snapshots in CI cover the regression surface; all 148 webapp + 73 webhook-ingest tests pass. The only surface that shifted is internal: shadcn
resizable.tsxandchart.tsxgot rewritten for the new upstream APIs (no API surface change to callers — same exported names, same prop shapes).Security: 10 → 0 audit advisories
Four targeted
pnpm.overridesinpnpm-workspace.yamlclose every transitive CVE:3.2.7/3.4.3→3.4.4) — fixes XSS bypasses GHSA-crv5-9vww-q3g8 + GHSA-v9jr-rg53-9pgp + GHSA-h8r8-wccr-v5f2 inmonaco-editorandmermaid4.17.21→4.18.1) — fixes prototype-pollution CVEs pulled viaprettier-plugin-java>java-parser>chevrotain4.x/6.x→7.0.5) — fixes XSS via__proto__(GHSA-1113686, GHSA-1115723) pulled via@docusaurus>copy-webpack-plugin+css-minimizer-webpack-pluginEach pin carries a rationale comment in
pnpm-workspace.yaml. Renovate'slockFileMaintenancewill alert if a parent eventually ships clean transitives so the override can be removed.pnpm 11 migration — toolchain changes
pnpm-workspace.yaml(4 workspace members + narrowpublicHoistPatternfor code reachable from outside a package boundary +allowBuildspolicy +supportedArchitecturesfor lockfile portability acrosslinux+darwin × x64+arm64 × glibc+musl+overrides+peerDependencyRules),.npmrc(minimal —package-lock=false),pnpm-lock.yaml,.dockerignorepackage-lock.json,docs/package-lock.json,scripts/install-platform-binaries.mjs(200-line npm-era workaround installing rollup native binaries that Vite 8 / Rolldown no longer needs — pnpm handles native bindings correctly via the lockfile)package.json:packageManager: "pnpm@11.1.2", all 44+npm -w <pkg>script entries →pnpm --filter <pkg>,npx→pnpm exec,shx rm -rf→node -e "fs.rm(...)",shxandprettier-plugin-java@2.9.1removed/reverted (2.8.1keeps pre-existing Java test-config files from tripping).husky/pre-push,.husky/commit-msg): switched topnpm run/pnpm exec, mode100755preserved in git indexCI / GitHub Actions
.github/actions/setup-pnpm-node/— SHA-pinnedpnpm/action-setup@v6.0.8(with explicitversion: 11.1.2to work around action-setup#227) +actions/setup-node@v6.4.0. Replaces 7 inlinedSetup pnpm+Setup Node.jsblocks across 5 workflows + teardown.github/actions/setup-caches/action.yml— dropped duplicated pnpm/node setup + dead platform-binaries cache +cache: mavenoverlap (the explicit~/.m2/repositorycache below it did the same job)ci-quality-gates.yml,ci-tests.yml,openapi-autocommit.yml,cd-docs.yml,pull-request.yml. Pluscd-docs-teardown.yml.dorny/test-reporterbumped v2 → v3 (Node 24 runtime aligned). All third-party actions SHA-pinned per existing repo conventioncd-docs.yml: split into separatebuild-preview(PR) /build-production(push to main) jobs with job-levelif:; both use the new composite.preview+cd-docs-teardown.ymluse sparse-checkout (.github/actions/setup-pnpm-node,.node-version,pnpm-lock.yaml) becauseactions/setup-nodewithcache: pnpmneeds the lockfile to compute its cache key. Surge install:npm install -g surge→pnpm dlx surgeci-docker-build.yml: webhook docker-context bumped from./server/webhook-ingestto.(repo root) so the new pnpm-workspace-aware Dockerfile canCOPY pnpm-lock.yaml+ sibling workspace manifests.github/copilot-environment.yml: rewritten for Node 24 + Corepack-managed pnpmDockerfiles
webapp/Dockerfile(Node 22 alpine → Node 24 alpine):corepack enable && corepack prepare pnpm@11.1.2 --activate,PNPM_HOME=/pnpm+PATH=$PNPM_HOME:$PATH, BuildKit cache mount withsharing=lockedat/pnpm/store,pnpm install --frozen-lockfile --filter webappserver/webhook-ingest/Dockerfile(Node 22 alpine → Node 24 alpine): same corepack/PNPM_HOME pattern +pnpm install --frozen-lockfile --filter webhook-ingest...+pnpm deploy --prod --legacy /deploy(the--legacyis required in pnpm 11 unlessinject-workspace-packagesis enabled)docker/agents/pi/Dockerfile(Node 22-slim → Node 24-slim): switched fromnpm install -gto corepack pnpm withPNPM_HOME=/usr/local/pnpmandPATH=$PNPM_HOME/bin:$PNPM_HOME:$PATH(pnpm 11 puts globals in/bin/);PI_VERSIONbumped 0.74.0 → 0.74.1server/application-server/Dockerfile: unchanged — its Maven build does not invoke npm/pnpmTypeScript
webapp/tsconfig.json:baseUrlremoved (paths: {"@/*": ["./src/*"]}works without it undermoduleResolution: "bundler")server/webhook-ingest/tsconfig.json:baseUrland deadtypeRootsremoved; addedrootDir: "./src"because TS 6 requires it when the inferred common source directory collapses to a single subtree (the Docker build context only COPYssrc/, nottest/);includenarrowed tosrc/**/*server/webhook-ingest/tsconfig.test.json(new): overlayssrc/ + test/ + *.config.tsfortsc --noEmit; thetypecheckscript points at this so test code keeps being type-checked at PR timedocs/tsconfig.json: simplified toextends+exclude, keepsignoreDeprecations: "6.0"with tracking comment for upstream-DocusaurusbaseUrlVite / React Compiler / Storybook
webapp/vite.config.ts:reactCompilerPreset()from@vitejs/plugin-react, plugin order matches upstream README (tanstackRouter()→viteReact()→babel(reactCompilerPreset())→tailwindcss()); top-level await for the asyncbabel(...)factorywebapp/vitest.config.storybook.ts: same patternwebapp/.storybook/manager.ts: dropped undeclaredlodash/startCaseimport (npm's hoisting had masked it; pnpm's strict resolution exposes it); inlined a 6-linestartCaseinstead of pulling in lodashwebapp/src/components/icons/brand.tsx(new): drop-inGithubIcon/GitlabIcon/Githubexports matching the Lucide icon API surface (forwardRef +size/className/aria) over inline SVG pathsRenovate
postUpdateOptions: ["pnpmDedupe"]in both root andlockFileMaintenance(Renovate doesn't auto-inherit between them)rangeStrategy: "replace"ARG <PKG>_VERSIONpins preservedlucide-react/rechartsmajor-pin removed — we're now on v1 / v3, no longer need the gateDocumentation sweep
Bulk-migrated
npmreferences across 30+ files (Markdown docs, agent prompts, shell scripts, source-code comments): rootAGENTS.md, all per-serviceAGENTS.md, everyREADME.md,docs/contributor/*.mdx,MIGRATION.md,scripts/{codex-setup,codex-maintenance,jean-setup,db-utils}.sh,scripts/{generate-mermaid-erd,update-github-schema,update-gitlab-schema}.ts,.github/PULL_REQUEST_TEMPLATE.md,.github/prompts/{fix-ci,land-pr}.prompt.md,.github/instructions/tsx.instructions.md,.github/workflows/cicd.yml(user-facing summary tables),.opencode/commands/{fix-ci,land-pr}.md,.claude/skills/{fix-ci,land-pr,react-best-practices}/*.md, plus a few inline comments. Patterns:npm run X→pnpm run X,npm -w X→pnpm --filter X,npx→pnpm exec,npm ci→pnpm install --frozen-lockfile,npm install→pnpm install.Out of scope (separate epic)
Spring Boot 3.5 → 4.0 and related Java majors (Liquibase 5, Spring Modulith 2, okhttp 5, springdoc 3). CSRF defaults + Jackson 3 are too consequential to bundle here. The Renovate dashboard tracks them separately.
How to test
CI exercises the full matrix (Storybook + Playwright + Chromatic + OpenAPI regen + four multi-arch Docker builds: webapp / app-server / webhook / agent-pi). All green.
Screenshots
N/A — UI changes are limited to internal shadcn primitives (
resizable.tsx,chart.tsx,calendar.tsx) which preserve their public API. Storybook + Chromatic snapshots cover the regression surface.🤖 Generated with Claude Code