deps: upgrade nub to 0.7.4 and build tools - #29
Conversation
|
Warning Review limit reached
Next review available in: 29 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (7)
📝 WalkthroughWalkthroughThe project updates Nub, Vite, Vite Plus, and ChangesTooling version alignment
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1⚔️ Resolve merge conflicts 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR updates the project’s JavaScript toolchain versions, primarily upgrading the nub package manager and bumping core build tooling (Vite + related plugins), with an explicit compatibility pin for vite-plus.
Changes:
- Upgrade
nubfrom0.4.12to0.7.4(package.json + mise tool pin). - Upgrade
viteto^8.2.1and@vitejs/plugin-reactto^6.0.5. - Pin
vite-plusto0.2.7(exact) to preserve compatibility with the current test runner binding behavior.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Updates toolchain dependencies and nub package manager version (including the vite-plus exact pin). |
| .config/mise/conf.d/_config.toml | Updates mise’s nub tool pin to 0.7.4 to match the upgraded toolchain. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| "vite-plus": "0.2.7", | ||
| "vitest": "npm:@voidzero-dev/vite-plus-test@^0.1.24" |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Line 66: Synchronize the mise configuration’s vp version with the pinned
vite-plus dependency: update the vp setting associated with the package
toolchain to 0.2.7, or document the intentional reason for keeping it on latest
if they must differ.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 6665f161-75ce-4db2-847a-c4caaad4e70b
⛔ Files ignored due to path filters (1)
nub.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
.config/mise/conf.d/_config.tomlpackage.json
| "vite": "^8.1.0", | ||
| "vite-plus": "^0.2.5", | ||
| "vite": "^8.2.1", | ||
| "vite-plus": "0.2.7", |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n -C 4 'vp|vite-plus|vite-plus-test|vitest' \
--glob 'package.json' \
--glob '*.toml' \
--glob '*.yaml' \
--glob '*.yml' \
.
command -v vp
vp --versionRepository: apphane-dev/karkas
Length of output: 1454
🏁 Script executed:
#!/bin/bash
set -u
echo "tracked config and package files:"
git ls-files | rg '(^package\.json$|\.config/mise|^mise|\.tool-versions$)' || true
echo
echo "package dependency lines:"
python3 - <<'PY'
import json
p=json.load(open('package.json','r'))
for section in ('dependencies','devDependencies','dependenciesMeta','scripts'):
print(section)
vals= p.get(section)
if isinstance(vals,dict):
for k in sorted(vals):
if any(x in k.lower() for x in ['vite-plus','vitest','vp','voidzero','fallow']) or section=='scripts':
print(f' {k}: {vals[k]}')
PY
echo
echo "config references to version pins and tools:"
if [ -f .config/mise/conf.d/_config.toml ]; then
cat -n .config/mise/conf.d/_config.toml
fi
echo
echo "mise availability and tool/version metadata if present:"
(command -v mise && mise --version) || true
(command -v vp && vp --version) || true
(command -v vpx && vpx --version) || trueRepository: apphane-dev/karkas
Length of output: 2070
Synchronize vp with the pinned vite-plus toolchain.
package.json pins vite-plus to 0.2.7, but .config/mise/conf.d/_config.toml keeps vp = "latest". If the intended local toolchain should come from vp, set vp = "0.2.7" in mise; otherwise, document why the global vp version intentionally differs from the bundled local package.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` at line 66, Synchronize the mise configuration’s vp version
with the pinned vite-plus dependency: update the vp setting associated with the
package toolchain to 0.2.7, or document the intentional reason for keeping it on
latest if they must differ.
Bump the toolchain to current across the monorepo: - nub 0.4.12 -> 0.7.4 (packageManager + devEngines in every workspace package.json, and the mise [tools] pin; also the create-karkas template's package.json + mise.toml so generated projects start on 0.7.4) - vite ^8.1.0 -> ^8.2.1 (apps/demo + create-karkas template) - @vitejs/plugin-react ^6.0.3 -> ^6.0.5 (apps/demo + template) - vite-plus ^0.2.5 -> ^0.2.8 (apps/demo, create-karkas, site, template) vite-plus goes to 0.2.8 (not the previous exact pin at 0.2.7): main already moved vitest off the npm:@voidzero-dev/vite-plus-test alias to plain vitest@4.1.10, so the nested vite-plus-core that relied on the now-removed vite-plus ./binding export is gone. The coupling that forced the 0.2.7 cap no longer applies. nub 0.7.0 breaking changes are all clear here: allowBuilds already lives in package.json (not .npmrc), node-options is unset, and the hoisted-linker build-output wipe fix (GH#616) benefits this project. First install re- bootstraps two renamed caches once; nothing is re-downloaded. Verified: typecheck, lint (demo + create-karkas + site), a clean webapp build, the full test:ci suite (demo 416 + create-karkas 4), fallow, and steiger.
4531880 to
35cd154
Compare
Fallow audit reportNo GitHub PR/MR findings. Generated by fallow. |
Bump the toolchain to current:
vite-plus is pinned to exactly 0.2.7 rather than the latest 0.2.8: 0.2.8 removed the ./binding package export that the pinned test runner (@voidzero-dev/vite-plus-test@0.1.24, aliased as
vitest) falls back to for its native rolldown binding. With 0.2.8 the test runner fails to load its config. There is no 0.2.x test runner release yet, so 0.2.7 is the highest compatible version. Drop the exact pin once vite-plus-test ships a build aligned with vite-plus 0.2.8+.nub 0.7.0 breaking changes audited against this repo are all clear: allowBuilds already lives in package.json (not .npmrc), node-options is unset, and the hoisted-linker build-output wipe fix (GH#616) benefits this project since node-linker=hoisted is set. The first install re-bootstraps two renamed caches once; nothing is re-downloaded.
Regenerates nub.lock (the 0.7.x lockfile format is leaner). Verified with typecheck, lint, fallow, a clean webapp build, and the full test suite (26 files / 416 tests).
Summary by CodeRabbit