chore(deps): resolve dependabot security alerts by lskramarov · Pull Request #455 · koobiq/react-components

lskramarov · 2026-08-11T06:24:55Z

Drop firebase-tools from root devDependencies: its subtree was the source of most advisories (hono, re2, tar, tmp, morgan, basic-ftp, uuid, qs, ip-address). It is not needed at build time -- the PR preview workflow pins its own firebaseToolsVersion, and docs-stable now invokes it explicitly via npx.

Pin the remaining vulnerable transitive packages via pnpm.overrides, using pkg@range selectors where only one major line is affected so minimatch@10, brace-expansion@2 and esbuild@0.25 stay untouched.

Summary by CodeRabbit

Chores
- Updated stable documentation deployments to use a pinned Firebase CLI version.
- Removed the direct Firebase CLI development dependency.
- Added version constraints for documentation tooling and related packages to improve build consistency.

Drop firebase-tools from root devDependencies: its subtree was the source of most advisories (hono, re2, tar, tmp, morgan, basic-ftp, uuid, qs, ip-address). It is not needed at build time -- the PR preview workflow pins its own firebaseToolsVersion, and docs-stable now invokes it explicitly via npx. Pin the remaining vulnerable transitive packages via pnpm.overrides, using pkg@range selectors where only one major line is affected so minimatch@10, brace-expansion@2 and esbuild@0.25 stay untouched. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

coderabbitai · 2026-08-11T06:25:53Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8357cc47-9940-409b-82cc-8ff44f973c16

📥 Commits

Reviewing files that changed from the base of the PR and between dee7310 and 75ca9f1.

📒 Files selected for processing (1)

.github/workflows/docs-stable.yml

🚧 Files skipped from review as they are similar to previous changes (1)

.github/workflows/docs-stable.yml

📝 Walkthrough

Walkthrough

The stable documentation deployment now pins Firebase CLI version 15.22.3. package.json removes the direct Firebase development dependency and adds pnpm overrides for documentation tooling and transitive packages.

Changes

Docs toolchain

Layer / File(s)	Summary
Align deployment and package versions `.github/workflows/docs-stable.yml`, `package.json`	The deployment invokes Firebase CLI 15.22.3 through `npx --yes`. The package configuration removes `firebase-tools` and adds pnpm overrides for React documentation tooling and transitive dependencies.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: kamilemeleev

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the dependency changes made to resolve Dependabot security alerts.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/DS-5215

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-11T06:26:38Z

Visit the preview URL for this PR (updated for commit 75ca9f1):

https://react-koobiq-next--prs-455-ily23cl5.web.app

_{(expires Sun, 16 Aug 2026 07:34:16 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: fc29847d4a9e5cb1adf458c76a9b681c76e2eeff}

Copilot

Pull request overview

Removes firebase-tools from the root devDependencies (to reduce Dependabot security alerts) and pins remaining vulnerable transitive dependencies via pnpm.overrides, while updating the stable-docs deploy workflow to install Firebase tooling via npx.

Changes:

Drop firebase-tools from root devDependencies.
Add pnpm.overrides pins for remaining vulnerable transitive dependencies.
Update docs-stable GitHub Actions workflow to invoke Firebase tooling via npx.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
package.json	Removes `firebase-tools` from root devDependencies and adds `pnpm.overrides` pins for vulnerable transitive packages.
.github/workflows/docs-stable.yml	Switches stable docs deployment to run Firebase tooling via `npx` instead of relying on a repo dependency.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/docs-stable.yml:
- Line 23: Update the stable hosting deployment step to use an exact
firebase-tools version declared in the workspace and reflected in
pnpm-lock.yaml, then replace the npx invocation with pnpm exec while preserving
the existing deploy arguments and token usage.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4e7758f1-53ce-4f93-b82b-a2974c5d3cdc

📥 Commits

Reviewing files that changed from the base of the PR and between f5259d7 and dee7310.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

.github/workflows/docs-stable.yml
package.json

lskramarov requested a lite review from Copilot August 11, 2026 06:24

lskramarov self-assigned this Aug 11, 2026

lskramarov requested a review from KamilEmeleev as a code owner August 11, 2026 06:24

Copilot started reviewing on behalf of lskramarov August 11, 2026 06:25 View session

Copilot AI reviewed Aug 11, 2026

View reviewed changes

Comment thread .github/workflows/docs-stable.yml Outdated

coderabbitai Bot reviewed Aug 11, 2026

View reviewed changes

Comment thread .github/workflows/docs-stable.yml Outdated

fix: after review

75ca9f1

KamilEmeleev approved these changes Aug 11, 2026

View reviewed changes

lskramarov merged commit acd808c into main Aug 11, 2026
7 checks passed

lskramarov deleted the fix/DS-5215 branch August 11, 2026 09:26

Navigation Menu

Uh oh!

chore(deps): resolve dependabot security alerts - #455

chore(deps): resolve dependabot security alerts#455
lskramarov merged 2 commits into
mainfrom
fix/DS-5215

lskramarov commented Aug 11, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 11, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

github-actions Bot commented Aug 11, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

lskramarov commented Aug 11, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

github-actions Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

lskramarov commented Aug 11, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 11, 2026 •

edited

Loading

github-actions Bot commented Aug 11, 2026 •

edited

Loading