Release/0.1.6#29
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request initializes a deepsec scanning workspace, adding configuration, documentation, and a threat model for the analytics SDK, while also bumping the package version to 0.1.6. The review feedback highlights that a generated metadata file includes a local absolute path which should be gitignored to prevent leaking system information. Additionally, the package manager version in the new workspace should be updated to match the root configuration for consistency.
| "package.json" | ||
| ], | ||
| "detectedAt": "2026-05-16T23:06:59.117Z", | ||
| "rootPath": "/Users/yos/sdk-react-native" |
There was a problem hiding this comment.
The rootPath property contains an absolute path specific to a local environment (/Users/yos/...). This makes the configuration non-portable and leaks local system information. If this file is intended to be tracked in git, this path should be made relative (e.g., ".."). However, given that it also contains a detectedAt timestamp, this file appears to be a generated cache that should likely be added to .deepsec/.gitignore and removed from the repository.
| "description": "deepsec scanning workspace", | ||
| "type": "module", | ||
| "workspaces": [], | ||
| "packageManager": "pnpm@9.15.4", |
There was a problem hiding this comment.
The packageManager version specified here (pnpm@9.15.4) is inconsistent with the version used in the root package.json (pnpm@10.27.0). It is recommended to keep these versions synchronized to ensure consistent dependency resolution and lockfile behavior across the entire repository. Before applying this change, verify that pnpm@10.27.0 is available on the official registry (e.g., npm view pnpm@10.27.0).
| "packageManager": "pnpm@9.15.4", | |
| "packageManager": "pnpm@10.27.0", |
References
- Verify the existence of recent package versions on the official registry before accepting version changes.
1 participant
Need help on this PR? Tag
@codesmithwith what you need.