fix(security): bulk dependency updates to resolve Dependabot alerts - #325
Conversation
|
📝 WalkthroughWalkthroughThe change ignores and removes generated Klotho compiled output, including infrastructure and application artifacts. It also updates Node.js and Python dependency versions across several examples and adds pnpm build configuration. ChangesKlotho compiled output cleanup
Example dependency updates
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Addresses 681 open Dependabot security alerts by updating lock files across all example projects using `npm audit fix --legacy-peer-deps`, `pnpm update --latest`, and `yarn upgrade`. Also updates Python requirements.txt files for critical/high severity vulnerabilities: - h11: 0.14.0 → 0.16.0 (critical, HTTP request smuggling) - idna: 3.7 → 3.15 (medium, DoS) - python-dotenv: 0.20.0 → 1.2.2 (medium) - pytest: 7.1.2 → 9.0.3 (medium) Note: some vulnerabilities remain where they require breaking changes to the serverless framework major version (v3→v4). These require manual intervention or separate PRs per project. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The _compiled/ output was generated by Klotho (a now-discontinued tool) and committed as a single snapshot. It has never been updated and carries ongoing Dependabot alerts that cannot be maintained. Adds _compiled/ to .gitignore so any local regeneration is not tracked. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
e5d4bc2 to
02deaeb
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@examples/node-package-managers/examples/pnpm-project/package.json`:
- Around line 13-17: Update the pnpm example’s package configuration to address
the Express 5 runtime requirement: add an explicit Node 18+ target using the
package’s engines configuration or an equivalent repository-standard version
file, or remove the unused express dependency if no Express API is exercised.
Keep the remaining dependencies unchanged.
In `@examples/serverless-localstack-with-s3-and-dynamodb/package.json`:
- Around line 50-54: Update the dependencies in package.json so ts-jest remains
within its direct TypeScript compiler support: constrain the typescript
dependency to a supported 6.x version, unless this project is explicitly
configured with ts-jest’s documented TypeScript 7 side-by-side compatibility
setup. Preserve the existing type-check and npx tsc behavior.
In `@examples/serverless-localstack-with-s3-and-dynamodb/pnpm-workspace.yaml`:
- Around line 2-5: Update the build approvals in allowBuilds by replacing the
placeholder strings for aws-sdk, esbuild, serverless, and unrs-resolver with
boolean values; set serverless and esbuild to true, and aws-sdk and
unrs-resolver to false.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 3b5149b7-cbad-4405-9fe9-f8f92070b2cc
⛔ Files ignored due to path filters (24)
examples/aws-cloudwatch-evidently/poc/package-lock.jsonis excluded by!**/package-lock.jsonexamples/klotho-analysis/klotho-go-example/_compiled/my-first-app.pngis excluded by!**/*.pngexamples/kubernetes-tilt-dev/apps/node-nestjs-app/package-lock.jsonis excluded by!**/package-lock.jsonexamples/node-package-managers/examples/npm-project/package-lock.jsonis excluded by!**/package-lock.jsonexamples/node-package-managers/examples/pnpm-project/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlexamples/node-package-managers/examples/yarn-project/yarn.lockis excluded by!**/yarn.lock,!**/*.lockexamples/serverless-appsync-node-typescript/package-lock.jsonis excluded by!**/package-lock.jsonexamples/serverless-appsync-python/package-lock.jsonis excluded by!**/package-lock.jsonexamples/serverless-cognito-local/package-lock.jsonis excluded by!**/package-lock.jsonexamples/serverless-glue-deployment/package-lock.jsonis excluded by!**/package-lock.jsonexamples/serverless-glue-full-boilerplate/package-lock.jsonis excluded by!**/package-lock.jsonexamples/serverless-localstack-with-s3-and-dynamodb/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlexamples/serverless-neo4j-ec2/package-lock.jsonis excluded by!**/package-lock.jsonexamples/serverless-node-typescript-bundle/package-lock.jsonis excluded by!**/package-lock.jsonexamples/serverless-node-typescript-middy-custom-middleware/package-lock.jsonis excluded by!**/package-lock.jsonexamples/serverless-node-typescript-middy/package-lock.jsonis excluded by!**/package-lock.jsonexamples/serverless-node-typescript-nest/package-lock.jsonis excluded by!**/package-lock.jsonexamples/serverless-python-fastapi/package-lock.jsonis excluded by!**/package-lock.jsonexamples/serverless-s3-local/package-lock.jsonis excluded by!**/package-lock.jsonexamples/serverless-sqs-node-typescript-offline-with-elasticmq/package-lock.jsonis excluded by!**/package-lock.jsonexamples/serverless-sqs-python/package-lock.jsonis excluded by!**/package-lock.jsonexamples/serverless-start-stop-ec2-instance/package-lock.jsonis excluded by!**/package-lock.jsonexamples/serverless-twilio-aws-lambdas-typescript/package-lock.jsonis excluded by!**/package-lock.jsontools/danger/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (57)
examples/klotho-analysis/klotho-go-example/.gitignoreexamples/klotho-analysis/klotho-go-example/_compiled/Pulumi.my-first-app.yamlexamples/klotho-analysis/klotho-go-example/_compiled/Pulumi.yamlexamples/klotho-analysis/klotho-go-example/_compiled/deploylib.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/analytics.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/api_gateway.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/cockroachdb.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/eks.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/elasticache.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/k8s/add_ons/alb_controller/index.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/k8s/add_ons/alb_controller/target_group_binding.yamlexamples/klotho-analysis/klotho-go-example/_compiled/iac/k8s/add_ons/cloud_map_controller/cloudmap_cluster_set.yamlexamples/klotho-analysis/klotho-go-example/_compiled/iac/k8s/add_ons/cloud_map_controller/cloudmap_export_service.yamlexamples/klotho-analysis/klotho-go-example/_compiled/iac/k8s/add_ons/cloud_map_controller/index.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/k8s/add_ons/external_dns/index.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/k8s/add_ons/index.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/k8s/add_ons/metrics_server/index.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/k8s/helm_chart.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/k8s/horizontal-pod-autoscaling.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/kubernetes.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/load_balancing.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/memorydb.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/app_runner.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/cloud_watch.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/common.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/dynamodb.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/ec2.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/ecs.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/eks.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/elasticache.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/elb.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/eventbridge.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/iam.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/index.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/lambda.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/memorydb.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/rds.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/s3.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/secrets_manager.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/service_discovery.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/sns.tsexamples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/sanitizer.tsexamples/klotho-analysis/klotho-go-example/_compiled/index.tsexamples/klotho-analysis/klotho-go-example/_compiled/klotho.yamlexamples/klotho-analysis/klotho-go-example/_compiled/main/Dockerfileexamples/klotho-analysis/klotho-go-example/_compiled/main/go.modexamples/klotho-analysis/klotho-go-example/_compiled/main/main.goexamples/klotho-analysis/klotho-go-example/_compiled/my-first-app.jsonexamples/klotho-analysis/klotho-go-example/_compiled/package.jsonexamples/klotho-analysis/klotho-go-example/_compiled/resources.jsonexamples/klotho-analysis/klotho-go-example/_compiled/tsconfig.jsonexamples/node-package-managers/examples/pnpm-project/package.jsonexamples/serverless-appsync-python/requirements.txtexamples/serverless-glue-deployment/requirements.txtexamples/serverless-localstack-with-s3-and-dynamodb/package.jsonexamples/serverless-localstack-with-s3-and-dynamodb/pnpm-workspace.yamlexamples/serverless-python-fastapi/requirements.txt
💤 Files with no reviewable changes (50)
- examples/klotho-analysis/klotho-go-example/_compiled/main/Dockerfile
- examples/klotho-analysis/klotho-go-example/_compiled/iac/k8s/add_ons/cloud_map_controller/cloudmap_export_service.yaml
- examples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/iam.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/eventbridge.ts
- examples/klotho-analysis/klotho-go-example/_compiled/Pulumi.my-first-app.yaml
- examples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/eks.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/k8s/add_ons/cloud_map_controller/cloudmap_cluster_set.yaml
- examples/klotho-analysis/klotho-go-example/_compiled/klotho.yaml
- examples/klotho-analysis/klotho-go-example/_compiled/package.json
- examples/klotho-analysis/klotho-go-example/_compiled/iac/k8s/add_ons/alb_controller/target_group_binding.yaml
- examples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/dynamodb.ts
- examples/klotho-analysis/klotho-go-example/_compiled/Pulumi.yaml
- examples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/secrets_manager.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/lambda.ts
- examples/klotho-analysis/klotho-go-example/_compiled/my-first-app.json
- examples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/ecs.ts
- examples/klotho-analysis/klotho-go-example/_compiled/tsconfig.json
- examples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/app_runner.ts
- examples/klotho-analysis/klotho-go-example/_compiled/resources.json
- examples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/elasticache.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/k8s/add_ons/metrics_server/index.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/ec2.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/cloud_watch.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/elasticache.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/common.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/service_discovery.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/elb.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/k8s/horizontal-pod-autoscaling.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/k8s/add_ons/external_dns/index.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/s3.ts
- examples/klotho-analysis/klotho-go-example/_compiled/index.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/index.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/k8s/helm_chart.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/rds.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/analytics.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/load_balancing.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/kubernetes.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/k8s/add_ons/index.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/memorydb.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/api_gateway.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/k8s/add_ons/cloud_map_controller/index.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/k8s/add_ons/alb_controller/index.ts
- examples/klotho-analysis/klotho-go-example/_compiled/main/main.go
- examples/klotho-analysis/klotho-go-example/_compiled/main/go.mod
- examples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/aws/sns.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/memorydb.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/eks.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/sanitization/sanitizer.ts
- examples/klotho-analysis/klotho-go-example/_compiled/iac/cockroachdb.ts
- examples/klotho-analysis/klotho-go-example/_compiled/deploylib.ts
| "@chakra-ui/react": "^3.36.1", | ||
| "@emotion/react": "^11.14.0", | ||
| "@emotion/styled": "^11.14.1", | ||
| "express": "^5.2.1", | ||
| "framer-motion": "^12.42.2" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
project='examples/node-package-managers/examples/pnpm-project'
fd -HI -a '^(package\.json|\.nvmrc|\.node-version)$' "$project" \
-x sh -c 'echo "--- $1"; sed -n "1,180p" "$1"' sh {}
rg -n -C2 \
-e "from ['\"]express['\"]" \
-e "require\(['\"]express['\"]\)" \
-e '\.del\(' \
-e 'req\.param\(' \
-e 'acceptsCharset\(' \
-e 'acceptsEncoding\(' \
-e 'acceptsLanguage\(' \
"$project" || trueRepository: nanlabs/devops-reference
Length of output: 663
🏁 Script executed:
#!/bin/bash
set -euo pipefail
project='examples/node-package-managers/examples/pnpm-project'
echo "Tracked files in project:"
git ls-files "$project" | sed -n '1,120p'
echo
echo "Node version files anywhere (focused names):"
git ls-files | grep -E '(^|/)(package\.json|pnpm-workspace\.yaml|\.nvmrc|\.node-version)$' | while IFS= read -r f; do
case "$f" in
*pnpm-project/package.json|*pnpm-workspace.yaml)
echo "--- $f"
sed -n '1,180p' "$f"
;;
esac
done
echo
echo "Express imports/usages in examples/node-package-managers/examples/pnpm-project:"
rg -n -C2 \
-e "from ['\"]express['\"]" \
-e "require\(['\"]express['\"]\)" \
-e "app\.use\(" \
-e "app\.\w+\(" \
-e "\.use\(" \
-e '\.del\(' \
-e 'req\.param\(' \
-e 'acceptsCharset\(' \
-e 'acceptsEncoding\(' \
-e 'acceptsLanguage\(' \
"$project" || true
echo
echo "Lockfile snippet for pnpm-project if present:"
if [ -f "$project/pnpm-lock.yaml" ]; then
sed -n '1,220p' "$project/pnpm-lock.yaml"
else
echo "no pnpm-lock.yaml under $project"
fiRepository: nanlabs/devops-reference
Length of output: 11183
Pin or justify the Node target for Express 5.
The example locks express@5.2.1, but package.json has no Node engine/.nvmrc and no source to exercise Express APIs. Add a Node 18+ target or remove Express 5 until it is exercised.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@examples/node-package-managers/examples/pnpm-project/package.json` around
lines 13 - 17, Update the pnpm example’s package configuration to address the
Express 5 runtime requirement: add an explicit Node 18+ target using the
package’s engines configuration or an equivalent repository-standard version
file, or remove the unused express dependency if no Express API is exercised.
Keep the remaining dependencies unchanged.
| "ts-jest": "^29.4.12", | ||
| "ts-loader": "^9.6.2", | ||
| "ts-node": "^10.9.2", | ||
| "tsconfig-paths": "^4.2.0", | ||
| "typescript": "^4.9.5" | ||
| "typescript": "^7.0.2" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
project='examples/serverless-localstack-with-s3-and-dynamodb'
fd -HI -a '^(jest\.config\..*|tsconfig.*\.json|package\.json)$' "$project" \
-x sh -c 'echo "--- $1"; sed -n "1,220p" "$1"' sh {}
rg -n -C3 -e 'ts-jest' -e 'preset[[:space:]]*:' -e 'transform[[:space:]]*:' "$project" || trueRepository: nanlabs/devops-reference
Length of output: 7350
🌐 Web query:
ts-jest 29.4.12 TypeScript support 7 side-by-side setup
💡 Result:
In ts-jest version 29.4.12, TypeScript 7 is supported via a specific side-by-side configuration [1][2]. This setup is required because TypeScript 7 does not provide the specific JavaScript compiler API that ts-jest needs for features such as transforms, language-service diagnostics, source maps, and custom AST transformers [3]. To implement this side-by-side setup, you must install both TypeScript 7 and a compatible TypeScript 6 version (specifically @typescript/typescript6) to act as the compiler API provider for ts-jest [3]. Recommended Setup Process: 1. Install TypeScript 7 for your native compilation needs: npm install --save-dev typescript@7 2. Install the TypeScript 6 compatibility package to satisfy ts-jest requirements: npm install --save-dev typescript6@npm:typescript@6 3. Configure your project to use these versions: - Use the native npx tsc for your project's type-checking and builds [3]. - You may use an alias such as npx tsc6 when you specifically need to run the TypeScript 6 compatibility compiler [3]. - Ensure ts-jest continues to reference the version 6 API through the established alias, as it avoids unstable native API calls and preserves the existing transformer contract [3]. Important Considerations: - Do not set the ts-jest compiler option to @typescript/native or attempt to bypass peer dependency checks with --legacy-peer-deps, as this can lead to an unstable compiler integration [3]. - ts-jest will automatically locate the required TypeScript 6 API if it is available via the side-by-side alias, and it does not silently fall back to the TypeScript 6 package if it is missing [3]. - Projects not yet using TypeScript 7 can continue to install the standard typescript package normally [3].
Citations:
- 1: kulshekhar/ts-jest@v29.4.11...v29.4.12
- 2: https://registry.npmjs.org/ts-jest
- 3: https://kulshekhar.github.io/ts-jest/docs/next/guides/typescript-7
🌐 Web query:
ts-jest TypeScript 7 side-by-side setup @tsj/typescript6 ts-jest compiler
💡 Result:
TypeScript 7.0 removed the in-process JavaScript compiler API required by ts-jest [1]. To use ts-jest with a project using TypeScript 7, you must implement a side-by-side setup where both the native TypeScript 7 compiler (for building) and a compatible TypeScript 6 package (for ts-jest's transforms and diagnostics) coexist in your project [2][3]. Official Configuration for TypeScript 7 To maintain compatibility, you must install TypeScript 7 and the TypeScript 6 compatibility package using npm aliases. Do not install TypeScript 7 directly as the sole typescript dependency [2]. 1. Installation: Use npm aliases to install both versions [2][3]: npm install --save-dev typescript@npm:typescript@7.0.0 typescript-6@npm:typescript@6.0.0 2. Project Usage: - Run npx tsc to execute the native TypeScript 7 compiler for your project's type-checking and builds [2][3]. - ts-jest will automatically use the typescript package (the alias resolving to the compatibility version) to access the required JavaScript compiler API [2]. Critical Setup Rules - Do not set the ts-jest compiler option to @typescript/native or any other native TS 7 path. Doing so will cause ts-jest to fail because TypeScript 7 lacks the necessary API [2][3]. - Do not bypass peer dependency checks (e.g., --legacy-peer-deps) to install TS 7, as this will lead to runtime errors when ts-jest attempts to load missing compiler APIs [2][3]. - ts-jest does not support a dual-compiler path where diagnostics are handled by TS 7 and transforms by TS 6 simultaneously, as this would break the consistency between the compiler's Program contract and ts-jest's AST transformers [2][3]. Experimental Native Engine If you require native TS 7 type-checking while running tests, ts-jest has introduced an experimental feature. You can configure the diagnostics engine to delegate type-checking to the native compiler out-of-process while maintaining the standard ts-jest emit/transform pipeline [1]: // jest.config.ts export default { //... globals: { 'ts-jest': { diagnostics: { engine: 'native', }, }, }, }; When this engine is active, ts-jest avoids loading the LanguageService and uses the native compiler's synchronous stdio API for diagnostics [1].
Citations:
- 1: feat: support TypeScript 7 (native) projects, with an experimental native type-checking engine kulshekhar/ts-jest#5380
- 2: https://kulshekhar.github.io/ts-jest/docs/next/guides/typescript-7
- 3: https://github.com/kulshekhar/ts-jest/blob/main/website/docs/guides/typescript-7.md
Keep the Jest transform in ts-jest’s direct compiler support.
ts-jest 29.4.12 supports TypeScript up to 6.x directly; TypeScript 7 requires the documented side-by-side setup, but this project still exposes typescript: ^7.0.2 as npx tsc/type-check and no TS 6 compatibility alias is configured. Constrain typescript to 6, or add the required TS 7 compatibility setup.
Proposed compatibility fix
- "typescript": "^7.0.2"
+ "typescript": "^6.0.0"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "ts-jest": "^29.4.12", | |
| "ts-loader": "^9.6.2", | |
| "ts-node": "^10.9.2", | |
| "tsconfig-paths": "^4.2.0", | |
| "typescript": "^4.9.5" | |
| "typescript": "^7.0.2" | |
| "ts-jest": "^29.4.12", | |
| "ts-loader": "^9.6.2", | |
| "ts-node": "^10.9.2", | |
| "tsconfig-paths": "^4.2.0", | |
| "typescript": "^6.0.0" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@examples/serverless-localstack-with-s3-and-dynamodb/package.json` around
lines 50 - 54, Update the dependencies in package.json so ts-jest remains within
its direct TypeScript compiler support: constrain the typescript dependency to a
supported 6.x version, unless this project is explicitly configured with
ts-jest’s documented TypeScript 7 side-by-side compatibility setup. Preserve the
existing type-check and npx tsc behavior.
| aws-sdk: set this to true or false | ||
| esbuild: set this to true or false | ||
| serverless: set this to true or false | ||
| unrs-resolver: set this to true or false |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
project='examples/serverless-localstack-with-s3-and-dynamodb'
sed -n '1,80p' "$project/pnpm-workspace.yaml"
fd -HI -a '^(package\.json|pnpm-lock\.yaml)$' "$project" \
-x sh -c 'echo "--- $1"; sed -n "1,120p" "$1"' sh {}Repository: nanlabs/devops-reference
Length of output: 6130
🌐 Web query:
pnpm allowBuilds configuration true false placeholder string install fails
💡 Result:
The allowBuilds configuration in pnpm is a setting used to manage which dependencies are permitted to execute build scripts (such as postinstall) [1][2]. It replaces older, deprecated settings like onlyBuiltDependencies and neverBuiltDependencies [2][3]. The issue you are observing—where pnpm modifies your pnpm-workspace.yaml file to include a placeholder string like set this to true or false—is an intended (though sometimes disruptive) behavior of pnpm's security policy [4][5]. How it works: When pnpm encounters a dependency that requires a build script but is not explicitly listed in your allowBuilds configuration, it automatically updates pnpm-workspace.yaml [1][5]. It inserts the package name and assigns it the string placeholder set this to true or false to prompt you to make a security decision [4][5]. Why installations fail: 1. Invalid Value: The system expects a boolean (true or false) [6]. The string placeholder set this to true or false is not a valid boolean, which can cause pnpm to reject the configuration or fail during subsequent command execution [6]. 2. Strict Mode: By default, if a package with a build script is not listed as true in allowBuilds, and strictDepBuilds is enabled (which is the default), pnpm will block the installation and throw an error [1][2]. How to resolve it: To fix the installation failure, you must manually edit your pnpm-workspace.yaml file [1][5]. Replace the placeholder string with either true (to allow the build) or false (to deny it) [1][3]. Example: Change this: allowBuilds: esbuild: set this to true or false To this: allowBuilds: esbuild: true Alternatively, you can run pnpm approve-builds, which provides an interactive prompt to manage these settings automatically and correctly update your configuration file [7][5]. Note on related issues: There have been reported bugs where pnpm unnecessarily overwrites existing settings or writes these placeholders even in non-interactive environments (such as CI/CD pipelines) [4][8]. If you are experiencing this in an automated environment, ensure you are not triggering workflows that bypass the intended approval process, and be aware that some older versions or specific flag combinations (like --ignore-workspace) have been identified as contributors to this clobbering behavior [4][8].
Citations:
- 1: https://pnpm.io/settings
- 2: https://pnpm.io/10.x/settings
- 3: pnpm/pnpm@cb367b9
- 4:
allowBuildsplaceholders written topnpm-workspace.yamlduring non-interactive installs pnpm/pnpm#11574 - 5: feat(approve-builds): positional args, !pkg deny syntax, and auto-populate allowBuilds pnpm/pnpm#11030
- 6: fix(cli): close the six pnpm-12-on-n8n defects pnpm/pnpm#13375
- 7: https://pnpm.io/cli/approve-builds
- 8: pnpm install --ignore-workspace overwrites allowBuilds in pnpm-workspace.yaml (clobbers true/false → "set this to true or false"), even with --frozen-lockfile pnpm/pnpm#12469
Replace the unresolved build-approval placeholders with booleans.
allowBuilds expects true or false per package, but this workspace currently contains the placeholder strings. With strict script-build checking enabled, these unresolved entries can block installs or prevent required build scripts from running. Set each entry explicitly—allow serverless and esbuild if trusted/reviewed, and leave the others as false.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@examples/serverless-localstack-with-s3-and-dynamodb/pnpm-workspace.yaml`
around lines 2 - 5, Update the build approvals in allowBuilds by replacing the
placeholder strings for aws-sdk, esbuild, serverless, and unrs-resolver with
boolean values; set serverless and esbuild to true, and aws-sdk and
unrs-resolver to false.
1 participant
Summary
Mass security update across all example projects to address the 681 open Dependabot security alerts.
npm audit fix --legacy-peer-depsin all npm-based examples (20 projects)pnpm update --latestin pnpm-based examples (2 projects)yarn upgradein the yarn-based examplerequirements.txtfiles for critical/high severity issuesklotho-analysis/_compiled/directory and added.gitignoreentryRefs #326, #327, #328, #329, #330, #331, #332, #333, #334, #335
Python package updates (direct dependency fixes)
serverless-python-fastapi/requirements.txth11serverless-python-fastapi/requirements.txtidnaserverless-appsync-python/requirements.txtpython-dotenvserverless-appsync-python/requirements.txtpytestserverless-glue-deployment/requirements.txtpytestRemaining alerts
Some vulnerabilities could not be auto-fixed because they require breaking changes to the Serverless framework (v3→v4 major bump). These are tracked in #326.
Additionally, 24 alerts in
examples/klotho-analysis/klotho-go-example/_compiled/were in auto-generated/compiled code — that directory has been removed in this PR.Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit
Examples
Maintenance