Repository navigation
chore(deps): drop stray testing-library dep and transport-http lockfile - #1478
Conversation
`testing-library@0.0.2` (the bare package, not `@testing-library/*`) was added to apps/web devDependencies by accident in meshtastic#1097 and is never imported. It pulls in Angular 6, rxjs 6 and zone.js, which carry 14 open security advisories that Dependabot can't resolve. `packages/transport-http/pnpm-lock.yaml` is left over from the pnpm switch in meshtastic#763. The workspace uses the root lockfile, so this one is never installed, but Dependabot scans it as its own project and fails every security update for it (rollup, glob, minimatch, brace-expansion, picomatch).
|
@danditomaso is attempting to deploy a commit to the Meshtastic Team on Vercel. A member of the Team first needs to authorize it. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly summarizes both dependency cleanup changes described in the PR objectives. |
| Description check | |
The description explains the changes and their purpose, reports testing, and completes the applicable checklist. Related issues are optional, and screenshots do not apply to these changes. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files.
✨ Finishing Touches: 💡 1
-
🛠️ Fix failing CI checks: 💡
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit checks the package list.
One testing-library entry is gone.
The manifest rests, neat and clear.
Soft paws tap a cheerful beat.
The burrow welcomes lighter shelves.
Comment @coderabbitai help to get the list of available commands.
1 participant
Description
Dependabot has failed 10 of its last 11 runs. Two leftovers cause it, and between them they account for 21 of the 22 open Dependabot alerts.
Changes Made
testing-libraryfromapps/webdevDependencies. This is the baretesting-library@0.0.2package, not@testing-library/*. It came in by accident with feat(protobufs): sync to firmware-current and consume workspace package #1097 and nothing imports it. It pulls in Angular 6, rxjs 6 and zone.js, which carry 14 open advisories (@angular/core,@angular/common) that Dependabot can't update.packages/transport-http/pnpm-lock.yaml. It's left over from the pnpm switch in refactor: update ci/cd scripts, switch to pnpm #763. The workspace installs from the root lockfile, so this file is never used, but Dependabot scans it as a separate project. That's where the failingrollup,glob,minimatch,brace-expansionandpicomatchupdates come from (7 alerts).The lockfile diff only removes entries:
testing-library, Angular, rxjs, zone.js andtslib@1.Not fixed here: alert #193 (
braces≤3.0.3, throughvite-plugin-html→fast-glob→micromatch). No patched version has been released.Testing Done
pnpm install --frozen-lockfilepnpm checkpnpm exec vitest run: 126 files, 851 tests passpnpm --filter ./apps/web run buildOnce this merges, the 21 alerts should close automatically and the next Dependabot security run should succeed.
Checklist
Summary by CodeRabbit