Refresh workspace and GitHub Actions dependencies - #170
Conversation
There was a problem hiding this comment.
Pull request overview
Refreshes dependency versions across the Exceptionless.JavaScript monorepo (core SDK packages plus example apps) to align on current compatible tooling, reduce known vulnerabilities via overrides, and keep the build/test toolchain consistent across workspaces.
Changes:
- Bumps
esbuildacross all SDK packages and updates rootallowScriptsaccordingly. - Updates framework/example dependencies (React, Vue, Vite, SvelteKit, Next.js, Expo/RN) and adds the missing
@testing-library/domdependency for the React example. - Adds root
overridesto pin@react-native-async-storage/async-storageand patch vulnerable transitive dependencies (cookie,postcss,uuid).
Reviewed changes
Copilot reviewed 14 out of 15 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| package.json | Updates shared dev deps (React/Vitest), updates allowScripts, and adds dependency overrides for security/compatibility pins. |
| packages/core/package.json | Bumps esbuild used for bundling core package outputs. |
| packages/browser/package.json | Bumps esbuild used for bundling browser package outputs. |
| packages/angularjs/package.json | Bumps esbuild used for bundling AngularJS wrapper outputs. |
| packages/node/package.json | Bumps esbuild and updates @types/node for Node package development/build. |
| packages/react/package.json | Updates React type dependencies and bumps esbuild for the React wrapper bundle. |
| packages/react-native/package.json | Pins AsyncStorage dev dependency for Expo/RN compatibility and updates React types. |
| packages/vue/package.json | Bumps esbuild used for bundling Vue wrapper outputs. |
| example/browser/package.json | Updates Vite for the browser sample app. |
| example/react/package.json | Updates React/Vite tooling and adds @testing-library/dom to satisfy testing-library peer requirements. |
| example/vue/package.json | Updates Vue/compiler and Vite for the Vue sample app. |
| example/svelte-kit/package.json | Updates SvelteKit/Svelte/Vite/Vitest versions for the SvelteKit sample app. |
| example/nextjs/package.json | Updates Next.js and aligns React versions for the Next.js sample app. |
| example/expo/package.json | Upgrades Expo SDK and React Native version while keeping Expo-pinned React and AsyncStorage versions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 19e8d457aa
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Dependency/security recheck (2026-07-31)
Validation passed:
The samples successfully rendered and queued their log/error events. Submission failures were expected because the local Exceptionless backend at ports 7110/7111 was not running. |
niemyjski
changed the title
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 92e79b4c52
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| npm publish --workspaces --access public --tag "ci-${TAG_BRANCH}" || true | ||
| run: | # zizmor: ignore[use-trusted-publishing] GitHub Packages uses GITHUB_TOKEN. | ||
| TAG_BRANCH="${GITHUB_REF##*/}" | ||
| npm publish --workspaces --access public --tag "ci-${TAG_BRANCH}" |
There was a problem hiding this comment.
When this branch workflow is rerun for a commit whose packages were already published—especially after a partial publish—the deterministic MinVer output gives every workspace the same version again. The npm publish documentation states that publishing fails when the name/version combination already exists, so removing the previous error handling makes such reruns finish unsuccessfully even if only one workspace conflicts. Handle already-published versions explicitly while still surfacing genuine registry failures.
Useful? React with 👍 / 👎.
Summary
node_modulescache with npm's cache; and remove the unpinned global version-replacement CLICompatibility and cooling decisions
@react-native-async-storage/async-storage2.2.0, React/ReactDOM 19.2.3,react-native-safe-area-context5.7.0, and TypeScript 6 because the current Expo/React Native/Svelte toolchains do not support their latest majors or patches as a coherent setmin-release-age=7; Expo's live compatibility map now asks for five patches published only 1-2 days ago, soexpo install --checkreports those intentional cooling holds while web export and browser runtime validation pass@xmldom/xmldomfrom the cooling window to take today's security-only 0.8.14 and 0.9.11 releasesAGENTS.md/CLAUDE.mdartifacts generated by the framework's defaultagentRulesbehavior, preventing recurring dirty worktreesSecurity and supply chain
image-size@1.2.1; OSV resolves that to two high-severity infinite-loop advisories (GHSA-5p2g-fcmc-qvqq, GHSA-w3rx-r6r6-pgpr) with no fixed release (image-sizethrough latest 2.0.2 is affected). npm's suggested Expo/React Native downgrade is incompatible, so this remains documented sample-tooling risk rather than a false clean claim.registry.npmjs.organd include integrity hasheszizmor --pedanticreports no findings (one documented GitHub Packages trusted-publishing exception)Validation
npm cinpm run build(all SDK packages plus browser, React, Vue, SvelteKit, and Next.js production builds)npm test— 28 files / 348 testsnpm run lintnpm ls --all --json— no problemsnpm pack --dry-runfor all seven publishable SDK workspacesnpm audit --omit=devfor each publishable SDK workspace — 0 vulnerabilitiesnpm audit signaturesosv-scanner scan --lockfile=package-lock.jsonnpm install-scripts lsuvx zizmor --pedantic .github/workflows/build.ymlexpo-doctorpassed 19/20 checks, with only the five intentional cooling-policy patch holds aboveFailed to fetchdiagnostics after events were constructed/enqueuedReview
The requested thermo-nuclear review completed against the exact final tree. It found and drove fixes for textarea state handling, cooling-policy bypass, dead CI caching, mutable action tags, Windows environment interpolation, and GitHub Packages registry ordering. Final verdict: GO.