chore: standardize tooling versions and lock critical dependencies#1440
chore: standardize tooling versions and lock critical dependencies#1440rohilsurana merged 16 commits intomainfrom
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughTooling and metadata updates: Node bumped to 22 and pnpm to 10.19.0 across CI, Docker, and package files; added a Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Pull Request Test Coverage Report for Build 22943471118Warning: This coverage report may be inaccurate.This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.
Details
💛 - Coveralls |
rohilsurana
changed the title
There was a problem hiding this comment.
Pull request overview
Standardizes the web workspace’s tooling/runtime expectations (pnpm + Node engines) and reduces dependency drift by pinning “critical” packages, while adding a Turbo-driven preview workflow for production-like local testing.
Changes:
- Pin pnpm to
10.19.0viapackageManagerfields and update the web-sdk GitHub Actions workflow to use pnpm 10. - Add/extend
enginesconstraints for Node and pnpm across key packages. - Lock select dependencies to exact versions and add pnpm overrides to prevent TanStack Query version conflicts; add
turbo run previewpipeline/task.
Reviewed changes
Copilot reviewed 7 out of 8 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| web/turbo.json | Adds a preview Turbo task that depends on build and runs persistently without cache. |
| web/sdk/package.json | Pins several tooling/runtime dependencies; locks React Query to 5.83.0; adds Node/pnpm engine constraints. |
| web/package.json | Pins pnpm version, adds preview script, adds pnpm engine constraint, and overrides @tanstack/query-core. |
| web/apps/client-demo/package.json | Updates packageManager to pnpm 10.19.0. |
| web/apps/admin/package.json | Locks @tanstack/react-query and devtools to 5.83.0; updates @types/node. |
| docs/package.json | Adds pnpm engine constraint alongside existing Node engine constraint. |
| .github/workflows/web-sdk.yml | Updates workflow to install pnpm 10.19.0. |
Comments suppressed due to low confidence (1)
.github/workflows/web-sdk.yml:33
- This workflow updates pnpm to 10.19.0, but other CI workflows in this repo still install pnpm 9.3.0 (e.g.
.github/workflows/lint.ymlandrelease.yml). WithpackageManager: pnpm@10.19.0/engines.pnpm >=10.19.0now set inweb/package.json, those workflows are likely to become inconsistent or fail when runningpnpm i. Please update the remaining workflows to pnpm 10.19.0 as well (or drop/relax the pnpm engine constraint if CI must stay on pnpm 9).
- name: Setup pnpm 10
uses: pnpm/action-setup@v2
with:
version: 10.19.0
- name: Setup Node.js 20.x
uses: actions/setup-node@v2
with:
node-version: 20.x
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
rohilsurana
force-pushed
the
tooling-fixes
branch
from
68eabe5 to
6ab33bf
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
web/sdk/package.json (1)
107-108: Verify the Proton upgrade against the SDK's exported surface.
web/sdk/src/index.tsre-exports@raystack/proton/frontier, and SDK hooks likeweb/sdk/react/hooks/useOrganizationMembers.tsandweb/sdk/react/hooks/useOrganizationProjects.tsconsume generatedFrontierServiceQueriesand request schemas directly. Swapping to a commit-based Proton build can therefore change both the SDK internals and its public API without any local TypeScript diff here. Please gate this with a type-level smoke test, or treat it as a breaking release if any exported message/service symbols changed.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 603390d9-7c79-4ba6-875e-e8986824f27e
⛔ Files ignored due to path filters (1)
web/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (9)
.github/workflows/lint.yml.github/workflows/release.yml.github/workflows/web-sdk.ymldocs/package.jsonweb/apps/admin/package.jsonweb/apps/client-demo/package.jsonweb/package.jsonweb/sdk/package.jsonweb/turbo.json
There was a problem hiding this comment.
♻️ Duplicate comments (2)
.github/workflows/web-sdk.yml (1)
30-33:⚠️ Potential issue | 🟡 MinorUpdate
actions/setup-nodeto v4.The workflow uses
actions/setup-node@v2, which is outdated and flagged by actionlint as incompatible with current GitHub Actions runners. Therelease.ymlworkflow already uses@v4.🔧 Proposed fix
- name: Setup Node.js 22.x - uses: actions/setup-node@v2 + uses: actions/setup-node@v4 with: node-version: 22.x.github/workflows/lint.yml (1)
40-43:⚠️ Potential issue | 🟡 MinorUpdate
actions/setup-nodeto v4.Same issue as in
web-sdk.yml— this workflow usesactions/setup-node@v2, which is outdated and incompatible with current GitHub Actions runners per actionlint. Therelease.ymlworkflow already uses@v4.🔧 Proposed fix
- name: Setup Node.js 22.x - uses: actions/setup-node@v2 + uses: actions/setup-node@v4 with: node-version: 22.x
🧹 Nitpick comments (1)
.github/workflows/release.yml (1)
48-53: LGTM - Node 22 and pnpm 10.19.0 updates are consistent with PR objectives.The tooling version upgrades align with the standardization effort. One optional improvement: consider using the
pnpm/action-setupaction instead ofnpm install -g, which provides better caching and is more idiomatic for GitHub Actions workflows.,
♻️ Optional: Use pnpm/action-setup action
- name: Set up Node uses: actions/setup-node@v4 with: node-version: "22" - - name: Install pnpm - run: npm install -g pnpm@10.19.0 + - name: Install pnpm + uses: pnpm/action-setup@v4 + with: + version: 10.19.0
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: c5b115fc-f2f9-48cf-a54a-7e2fe5d805fe
⛔ Files ignored due to path filters (1)
web/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (9)
.github/workflows/lint.yml.github/workflows/release.yml.github/workflows/web-sdk.ymldocs/package.jsonweb/apps/admin/package.jsonweb/apps/client-demo/package.jsonweb/package.jsonweb/sdk/package.jsonweb/turbo.json
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: a8794f91-5cb0-45b6-95f5-b59e400e32f0
📒 Files selected for processing (2)
web/package.jsonweb/sdk/package.json
🚧 Files skipped from review as they are similar to previous changes (1)
- web/sdk/package.json
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/web-sdk.yml (1)
35-36: Use--frozen-lockfilefor deterministic release builds.This is a release workflow that publishes to npm. Using
pnpm i --frozen-lockfileensures that package installations remain deterministic across CI runs and prevents accidental dependency version changes during releases, which is a best practice for release workflows.🔧 Proposed fix
- name: Install Dependencies 🔧 - run: pnpm i + run: pnpm i --frozen-lockfile
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 49d625d9-28e3-4b59-9d24-34a4fb230511
⛔ Files ignored due to path filters (1)
web/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (3)
.github/workflows/lint.yml.github/workflows/web-sdk.ymlDockerfile.dev
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/lint.yml
rohilsurana
force-pushed
the
tooling-fixes
branch
from
4d794c5 to
2138ba2
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: a34a883d-4c7e-4aaa-8244-99e3666bb322
⛔ Files ignored due to path filters (1)
web/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (10)
.github/workflows/lint.yml.github/workflows/release.yml.github/workflows/web-sdk.ymlDockerfile.devdocs/package.jsonweb/apps/admin/package.jsonweb/apps/client-demo/package.jsonweb/package.jsonweb/sdk/package.jsonweb/turbo.json
🚧 Files skipped from review as they are similar to previous changes (7)
- docs/package.json
- web/sdk/package.json
- .github/workflows/lint.yml
- .github/workflows/release.yml
- web/apps/client-demo/package.json
- Dockerfile.dev
- web/turbo.json
Summary
Standardize tooling versions across the codebase and upgrade key dependencies to ensure consistency between local development, CI environments, and production builds.
Tooling Version Upgrades
pnpm: 9.3.0 → 10.19.0
packageManagerfield in web/package.json and web/apps/client-demo/package.jsonengines.pnpmto>=10.19.0in web/package.json and docs/package.jsonpnpm/action-setup@v2with version 10.19.0:.github/workflows/web-sdk.yml.github/workflows/lint.yml.github/workflows/release.yml(2 jobs - replaced manual npm install with action)Dockerfile.devto use pnpm 10.19.0Node: >=20.6.1 → >=22
engines.nodeto>=22in web/package.json (workspace root)>=22✓Dockerfile.devto use node:22-alpineactions/setup-nodeto v4 across all workflows for consistency@types/nodeto^22.10.0in SDK, admin, and client-demo to match Node 22web/sdk/package.json(published to npm) does NOT have engines to avoid breaking downstream consumers on Node 20Dependency Upgrades
@raystack/proton: unified to 0.1.0-d8accdc231fe7e3b23b38c0535b2aa92da42cf24
@connectrpc packages: upgraded to 2.1.1 (locked)
@connectrpc/connect: 2.1.1 (locked - was ^2.0.2 in SDK, ^2.1.0 in admin)@connectrpc/connect-web: 2.1.1 (locked - was ^2.0.2 in SDK, ^2.1.0 in admin)@connectrpc/connect-query: 2.1.1 (already locked, unchanged)@tanstack/react-query: ^5.83.0 → ^5.90.2
@tanstack/react-query-devtoolsupgraded to ^5.90.2@types/node: ^20.19.0 → ^22.10.0
Development Experience Improvements
previewscript to root package.jsonpreviewtask to turbo.json (depends on build, runs production build locally)pnpm/action-setup@v2action instead of manual npm installImportant Design Decisions
web/sdk/package.json) does not haveenginesfield - this package is published to npm and should not restrict consumer's Node version since compiled artifacts target ES2015web/package.json), CI workflows, and Dockerfile.devTesting