chore: Reduce npm vulnerability and attack surface across workspace#57
chore: Reduce npm vulnerability and attack surface across workspace#57mattinannt merged 7 commits intomainfrom
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 11fe6fa1d9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@coderabbitai please review |
|
✅ Actions performedReview triggered.
|
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 6 minutes and 3 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
WalkthroughThis pull request upgrades Node.js from 22.x to 24.x across build workflows, replaces Prettier and ESLint with Biome for linting and formatting, and bumps TypeScript to 6.0.2. It adds GitHub Actions workflow improvements including a new lint-and-type-check workflow and quality gates (linting and type-checking) to the release pipeline. The React Native package receives substantial updates: new TypeScript build configuration, enhanced WebView security controls, improved type safety (replacing 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
packages/react-native/tsconfig.json (1)
17-19:⚠️ Potential issue | 🔴 CriticalFix pipeline failure:
baseUrlis deprecated in TypeScript 6+.The pipeline is failing with TS5101 because
baseUrlis deprecated and will stop functioning in TypeScript 7.0. Since the project uses TypeScript 6.0.2, you need to either suppress the warning or migrate the configuration.🔧 Option 1 (quick fix): Suppress the deprecation warning
"compilerOptions": { + "ignoreDeprecations": "6.0", "composite": false,🔧 Option 2 (recommended): Use paths without baseUrl
In TypeScript 5.x+,
pathsno longer requiresbaseUrl. Since you're already using"moduleResolution": "bundler", you can specify paths relative to the tsconfig location:- "baseUrl": ".", "paths": { - "@/*": ["./src/*"] + "@/*": ["./src/*"] },Simply removing
baseUrlshould work sincepathsare resolved relative to the tsconfig file whenbaseUrlis absent.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/react-native/tsconfig.json` around lines 17 - 19, Remove the deprecated "baseUrl" compilerOption instead of using it: delete the "baseUrl" entry from the tsconfig compilerOptions and keep your "paths" mapping (e.g., "@/*": ["./src/*"]) since paths are resolved relative to the tsconfig when baseUrl is absent; ensure "moduleResolution": "bundler" remains set. Alternatively, if you need a temporary quick fix, suppress the deprecation warning by adding a compiler flag that silences deprecation diagnostics (instead of using "baseUrl") until you fully migrate.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/react-native/src/components/survey-web-view.tsx`:
- Around line 324-327: getSurveyScriptUrl currently falls back to localhost,
throws on sync protocol validation, and strips pathname which causes renderHtml
to crash; change getSurveyScriptUrl to treat options.appUrl as required: if
appUrl is missing or invalid return null (do not default to localhost or throw),
validate with a safe URL parse (catching errors) and construct the script URL by
resolving against the full origin + pathname (preserve appUrl.pathname instead
of using a root-relative path), and update renderHtml to check surveyScriptUrl
=== null and skip injecting/loading the script gracefully. Ensure you reference
getSurveyScriptUrl, renderHtml, and options.appUrl when making the fixes.
In `@packages/react-native/src/lib/common/command-queue.ts`:
- Around line 8-10: The command type allows Promise<void> but the queue
implementation (when invoking command and assigning to result, and later reading
result.data.ok) assumes a Result shape; update the invocation logic that awaits
the command output (the variable currently named result) to perform a runtime
shape check: if the awaited value is undefined or does not have the expected
Result structure (no .data or no .data.ok), wrap it into a successful
Result<void, unknown> before continuing so the subsequent dereference of
result.data.ok is safe; locate the command invocation and result handling in the
queue processing function (where the code currently casts the command output to
Result<void, unknown> and reads result.data.ok) and add this guard and wrapping
logic there.
In `@packages/react-native/src/types/response.ts`:
- Around line 3-6: TResponseData currently allows nested Record<string, string>,
which diverges from ZResponseData and can cause runtime validation failures;
update TResponseData to mirror ZResponseData by replacing the nested
Record<string, string> with the same recursive union shape used by ZResponseData
(i.e., nested records must allow the same union of string | number | string[] |
nested record), so modify the type declaration for TResponseData to use
Record<string, string | number | string[] | Record<string, string | number |
string[]>> (or the equivalent recursive union) to keep the compile-time type
contract aligned with ZResponseData.
---
Outside diff comments:
In `@packages/react-native/tsconfig.json`:
- Around line 17-19: Remove the deprecated "baseUrl" compilerOption instead of
using it: delete the "baseUrl" entry from the tsconfig compilerOptions and keep
your "paths" mapping (e.g., "@/*": ["./src/*"]) since paths are resolved
relative to the tsconfig when baseUrl is absent; ensure "moduleResolution":
"bundler" remains set. Alternatively, if you need a temporary quick fix,
suppress the deprecation warning by adding a compiler flag that silences
deprecation diagnostics (instead of using "baseUrl") until you fully migrate.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 5b603334-723d-483a-897b-c9e57361beee
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (51)
.github/workflows/build.yml.github/workflows/lint.yml.github/workflows/release.yml.github/workflows/test.ymlapps/playground/.eslintrc.jsapps/playground/app.jsonapps/playground/package.jsonapps/playground/src/app.tsxbiome.jsonpackage.jsonpackages/react-native/.eslintrc.cjspackages/react-native/package.jsonpackages/react-native/src/components/formbricks.tsxpackages/react-native/src/components/survey-web-view.tsxpackages/react-native/src/index.tspackages/react-native/src/lib/common/api.tspackages/react-native/src/lib/common/command-queue.tspackages/react-native/src/lib/common/config.tspackages/react-native/src/lib/common/event-listeners.tspackages/react-native/src/lib/common/setup.tspackages/react-native/src/lib/common/tests/api.test.tspackages/react-native/src/lib/common/tests/command-queue.test.tspackages/react-native/src/lib/common/tests/config.test.tspackages/react-native/src/lib/common/tests/logger.test.tspackages/react-native/src/lib/common/tests/setup.test.tspackages/react-native/src/lib/common/tests/utils.test.tspackages/react-native/src/lib/common/utils.tspackages/react-native/src/lib/environment/state.tspackages/react-native/src/lib/environment/tests/state.test.tspackages/react-native/src/lib/survey/action.tspackages/react-native/src/lib/survey/tests/action.test.tspackages/react-native/src/lib/survey/tests/store.test.tspackages/react-native/src/lib/user/attribute.tspackages/react-native/src/lib/user/state.tspackages/react-native/src/lib/user/tests/attribute.test.tspackages/react-native/src/lib/user/tests/state.test.tspackages/react-native/src/lib/user/tests/update-queue.test.tspackages/react-native/src/lib/user/tests/update.test.tspackages/react-native/src/lib/user/tests/user.test.tspackages/react-native/src/lib/user/update.tspackages/react-native/src/lib/user/user.tspackages/react-native/src/types/api.tspackages/react-native/src/types/config.tspackages/react-native/src/types/error.tspackages/react-native/src/types/response.tspackages/react-native/src/types/survey.tspackages/react-native/tsconfig.build.jsonpackages/react-native/tsconfig.jsonpackages/react-native/vite.config.tsscripts/check-exact-deps.mjsturbo.json
💤 Files with no reviewable changes (3)
- apps/playground/.eslintrc.js
- apps/playground/app.json
- packages/react-native/.eslintrc.cjs
|
2 participants
Summary
This PR reduces the npm vulnerability and attack surface of the workspace by simplifying the tooling stack, removing avoidable dependencies and overrides, tightening the SDK runtime surface, and aligning the repo with current well-maintained package versions.
What changed
tsc+tsc-aliascheck-typestasks for both the SDK package and the playground apppnpm.overridesblock after verifying a fresh install still audits cleanAttack surface reduction
vite-plugin-dtsand its declaration-bundling dependency chain from the SDK buildEstimated magnitude
pnpm audit --jsonis now clean with0vulnerabilities1054to695, a reduction of359packages in the resolved graph31to28pnpm.overridesblock to stay audit-clean on a fresh lockfileEnterprise readiness impact
This makes the repository materially more enterprise ready by reducing the amount of transitive code that needs to be trusted, removing fragile audit-only override maintenance, tightening runtime permissions in the SDK, and standardizing the repo on current maintained toolchain versions and CI baselines.
Validation
pnpm installpnpm audit --jsonpnpm lintpnpm check-typespnpm buildpnpm testcd packages/react-native && npm pack --dry-run