fix(dx): pin root dependency versions (#210) - #236
Conversation
📝 WalkthroughWalkthroughMultiple package.json files were updated to pin dependency versions (root, packages/common, apps/dashboard-api, apps/public-api). The public email queue module now exposes ChangesDependency Version Pinning
Public email worker reset
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
ESLint skipped: no ESLint configuration detected in root package.json. To enable, add Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
|
alright apps/public-api/package.json |
Hi @yash-pouranik, I'm currently away from my laptop. I can take this up tonight and update the dependency versions in:
I'll push the changes once I'm back and have verified everything locally. |
|
yh no worries. |
d2715f3 to
e511d6e
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
apps/public-api/package.json (1)
19-19: ⚡ Quick winUse a workspace-aware/versioned spec for
@urbackend/commoninapps/public-api
apps/public-api/package.jsonstill uses"@urbackend/common": "*"(even thoughpackage-lock.jsonresolves it as a local workspace link topackages/common); switch toworkspace:*or pin to the workspace version (currently0.10.0) for explicit, deterministic intent.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/public-api/package.json` at line 19, The dependency entry for "`@urbackend/common`" in package.json is currently "*" and should be made workspace-aware or pinned; update the "`@urbackend/common`" value to either "workspace:*" to explicitly use the local workspace package or to the current workspace version "0.10.0" to pin it, then run your package manager install to update lockfiles; modify the dependency string for "`@urbackend/common`" in apps/public-api's package.json accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/public-api/package.json`:
- Around line 17-18: The package-lock.json is out of sync with the pinned deps
in apps/public-api/package.json (notably "`@kiroo/sdk`" and
"`@supabase/supabase-js`" and the other entries around lines 20-34 and 37-38); to
fix, from the repo root run a clean install to regenerate the lockfile (e.g.,
delete node_modules if needed then run npm install or npm ci as appropriate),
verify package-lock.json now contains the exact resolved versions for those
packages, and commit the updated package-lock.json so CI will pass.
In `@packages/common/package.json`:
- Around line 8-25: The root lockfile is out of sync with the updated
dependencies listed under the packages/common package.json "dependencies" field;
regenerate the root package-lock.json and commit it so CI installs
deterministically. From the repository root run a lockfile update (for example
npm install or npm install --package-lock-only) so the top-level
package-lock.json reflects the new pins, verify the "packages/common" entry in
package-lock.json now matches the package.json dependencies, and commit the
updated package-lock.json.
---
Nitpick comments:
In `@apps/public-api/package.json`:
- Line 19: The dependency entry for "`@urbackend/common`" in package.json is
currently "*" and should be made workspace-aware or pinned; update the
"`@urbackend/common`" value to either "workspace:*" to explicitly use the local
workspace package or to the current workspace version "0.10.0" to pin it, then
run your package manager install to update lockfiles; modify the dependency
string for "`@urbackend/common`" in apps/public-api's package.json accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 6eb915c1-da06-4f75-9322-328c2aeca1c0
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (4)
apps/dashboard-api/package.jsonapps/public-api/package.jsonpackage.jsonpackages/common/package.json
✅ Files skipped from review due to trivial changes (2)
- apps/dashboard-api/package.json
- package.json
|
coderabbits comments are still not resolved and public api tests are failing. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/common/src/queues/publicEmailQueue.js`:
- Around line 18-23: Move the removal of worker event handlers so they occur
after the worker has fully closed: do not call worker.removeAllListeners()
before awaiting worker.close(); instead await worker.close() first (keep the
existing 'failed' handler and other listeners attached during close/drain) and
then call worker.removeAllListeners() (or conditional removal) afterward to
ensure the 'failed' handler logic (and quota refunds) can run while the worker
is finishing.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 5d1800d8-50db-4205-b38d-21b3d760629f
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (3)
apps/public-api/package.jsonapps/public-api/src/__tests__/mail.controller.test.jspackages/common/src/queues/publicEmailQueue.js
🚧 Files skipped from review as they are similar to previous changes (1)
- apps/public-api/package.json
|
Hi @yash-pouranik, Done with the requested dependency pinning changes. One of the CI checks was still failing after the lockfile sync, so I investigated it and applied the minimal fix required to get the |
|
last check, as whole package-lock.json is changed
|
|
Hi @yash-pouranik, Done the verification.
Looks good from my side. Note The only non-dependency files touched in this PR were |
|
ok done |
|
thnk u |
|
@yash-pouranik Sorry to bother you 😅. |
|
dont worry about that, every night i scroll to all the merged prs and add the needed labels |
Got it, thanks for the clarification! Also, are you planning to work on any new features or improvements in the near future? I'd love to contribute and help out wherever I can. |
|
Okay listen I have my exams starting from June 8th, so I won't be able to actively build new features myself for a little while. However, I want the momentum for urBackend to keep going During this period, I will shift my focus entirely to reviewing PRs and merging your contributions. To make this work efficiently, I did love for us to operate like a proper engineering team for this month. We can: Discuss upcoming features & roadmap. Let me know. |
AYE AYE CAPTAIN 🫡🪖. |
👍 I'm in. Maybe we can have a contributor channel while you're busy with exams so we can discuss ideas, coordinate work, and help new contributors when needed. Happy to help. |
|
Join the discord of urBackend |
Any direct link for that ? Or steps to join in the discord from GSSOC |
|
Its in readme, |
|
Exactly |
4 participants
Related Issue
Closes #210
Summary
Pinned the remaining loose dependency version ranges in the root package.json to exact versions.
Changes
Updated the following root dependencies from caret (
^) ranges to exact versions:Reason
Issue #210 highlights loose dependency version ranges as a source of potentially non-deterministic installs.
Following your guidance, the fix was limited to the root package.json and corresponding package-lock.json updates while avoiding unnecessary changes in other workspace manifests.
Files Changed
Validation
Summary by CodeRabbit
Chores
New Features
Tests