Refresh workspace and GitHub Actions dependencies - #170
Conversation
There was a problem hiding this comment.
Pull request overview
Refreshes dependency versions across the Exceptionless.JavaScript monorepo (core SDK packages plus example apps) to align on current compatible tooling, reduce known vulnerabilities via overrides, and keep the build/test toolchain consistent across workspaces.
Changes:
- Bumps
esbuildacross all SDK packages and updates rootallowScriptsaccordingly. - Updates framework/example dependencies (React, Vue, Vite, SvelteKit, Next.js, Expo/RN) and adds the missing
@testing-library/domdependency for the React example. - Adds root
overridesto pin@react-native-async-storage/async-storageand patch vulnerable transitive dependencies (cookie,postcss,uuid).
Reviewed changes
Copilot reviewed 14 out of 15 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| package.json | Updates shared dev deps (React/Vitest), updates allowScripts, and adds dependency overrides for security/compatibility pins. |
| packages/core/package.json | Bumps esbuild used for bundling core package outputs. |
| packages/browser/package.json | Bumps esbuild used for bundling browser package outputs. |
| packages/angularjs/package.json | Bumps esbuild used for bundling AngularJS wrapper outputs. |
| packages/node/package.json | Bumps esbuild and updates @types/node for Node package development/build. |
| packages/react/package.json | Updates React type dependencies and bumps esbuild for the React wrapper bundle. |
| packages/react-native/package.json | Pins AsyncStorage dev dependency for Expo/RN compatibility and updates React types. |
| packages/vue/package.json | Bumps esbuild used for bundling Vue wrapper outputs. |
| example/browser/package.json | Updates Vite for the browser sample app. |
| example/react/package.json | Updates React/Vite tooling and adds @testing-library/dom to satisfy testing-library peer requirements. |
| example/vue/package.json | Updates Vue/compiler and Vite for the Vue sample app. |
| example/svelte-kit/package.json | Updates SvelteKit/Svelte/Vite/Vitest versions for the SvelteKit sample app. |
| example/nextjs/package.json | Updates Next.js and aligns React versions for the Next.js sample app. |
| example/expo/package.json | Upgrades Expo SDK and React Native version while keeping Expo-pinned React and AsyncStorage versions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 19e8d457aa
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Dependency/security recheck (2026-07-31)
Validation passed:
The samples successfully rendered and queued their log/error events. Submission failures were expected because the local Exceptionless backend at ports 7110/7111 was not running. |
niemyjski
changed the title
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 92e79b4c52
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| npm publish --workspaces --access public --tag "ci-${TAG_BRANCH}" || true | ||
| run: | # zizmor: ignore[use-trusted-publishing] GitHub Packages uses GITHUB_TOKEN. | ||
| TAG_BRANCH="${GITHUB_REF##*/}" | ||
| npm publish --workspaces --access public --tag "ci-${TAG_BRANCH}" |
There was a problem hiding this comment.
When this branch workflow is rerun for a commit whose packages were already published—especially after a partial publish—the deterministic MinVer output gives every workspace the same version again. The npm publish documentation states that publishing fails when the name/version combination already exists, so removing the previous error handling makes such reruns finish unsuccessfully even if only one workspace conflicts. Handle already-published versions explicitly while still surfacing genuine registry failures.
Useful? React with 👍 / 👎.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Summary
Release-note review
<6.1, so TypeScript 7 is not compatible.Also checked current release notes for the React/Vue/Svelte Vite plugins, SvelteKit, Testing Library, and Vitest ESLint plugin. Existing APIs require no migration.
Compatibility holds
<6.1..npmrcfor GHSA-x5fp-wj9c-mxmx and GHSA-4mjr-xmp4-gh2g.Security results (September 2 final clean tree)
npm ls --all: no dependency-tree problems;npm install-scripts ls: no unreviewed install scripts.zizmor --pedantic: no findings, with the existing documented GitHub Packages trusted-publishing exception.Validation
npm ciusing Node 24.20.0 / npm 11.npm run build: all SDK and buildable sample workspaces pass.npm test: 28 files / 348 tests pass, including cross-platform environment-only build-version regression coverage.npm run lint: pass./200, missing route 404,/trycatchexpected 500; events enqueued.dogfood-output/left untouched.Thermo-nuclear review
Reviewed the exact effective diff for structural regression, unnecessary abstractions, scattered special cases, public API drift, lifecycle permissions, lockfile integrity/age, and file-size growth. The September increment contains no application-code churn, no new abstractions, and no file newly crossing 1,000 lines; the generated lockfile was already above that threshold. Existing cookie/UUID overrides remain necessary because upstream parents still request vulnerable older ranges. No new blocking findings.
Hosted validation on
43ef5dfe1deafcb5959bc4b1fa82ed57ece3db21unknown_key, so the commit does not have a verified signature badge; no account keys or signing settings were changed.GitHub's default-branch Dependabot alerts are separate from the zero-finding dependency tree audited here and will need reevaluation after merge.