Skip to content

fix(deps): update all dependencies #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(deps): update all dependencies #20

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/actions/setup/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ runs:
using: composite
steps:
- name: Install pnpm
uses: pnpm/action-setup@v3
uses: pnpm/action-setup@v6
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify mutable action refs under .github (tag-based refs like `@v1/`@v6).
# Expected: no matches after SHA pinning.
rg -n --iglob '*.yml' --iglob '*.yaml' 'uses:\s*[^@[:space:]]+@v[0-9]+(\.[0-9]+){0,2}\b' .github

Repository: ProverCoderAI/openapi-effect

Length of output: 1009

Pin pnpm/action-setup to an immutable commit SHA.

Line 13 uses a mutable tag (@v6). Please pin to a full-length commit SHA to reduce supply-chain risk and avoid policy breaks in hardened org settings.

🔒 Suggested change 
-      uses: pnpm/action-setup@v6
+      uses: pnpm/action-setup@<full-length-commit-sha> # v6.x

Reference: https://docs.github.com/actions/security-guides/security-hardening-for-github-actions

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/actions/setup/action.yml at line 13, The workflow currently uses a
mutable tag "pnpm/action-setup@v6"; replace that with an immutable full commit
SHA (40-hex) for pnpm/action-setup to pin the action (e.g.,
"pnpm/action-setup@<full-commit-sha>"). Locate the "uses: pnpm/action-setup@v6"
entry in the action.yml and update it to the exact commit SHA from the
pnpm/action-setup repository, verify the SHA is full-length (40 characters) and
that the workflow still runs correctly after the change.

- name: Install node
uses: actions/setup-node@v6
with:
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/checking-dependencies.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,10 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: pnpm/action-setup@v4
- uses: pnpm/action-setup@v6
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify mutable action refs under .github (tag-based refs like `@v1/`@v6).
# Expected: no matches after SHA pinning.
rg -n --iglob '*.yml' --iglob '*.yaml' 'uses:\s*[^@[:space:]]+@v[0-9]+(\.[0-9]+){0,2}\b' .github

Repository: ProverCoderAI/openapi-effect

Length of output: 1009

Pin pnpm/action-setup to a commit SHA instead of a mutable tag.

Line 15 uses @v6, which is a mutable tag reference. Per GitHub's security hardening guidelines, action references should be pinned to full commit SHAs to ensure immutability and prevent unintended updates from tag rewrites.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/checking-dependencies.yml at line 15, Replace the mutable
tag reference "uses: pnpm/action-setup@v6" with an immutable pin to the full
commit SHA for the pnpm/action-setup action (e.g., "uses:
pnpm/action-setup@<full-commit-sha>"); locate the occurrences of
"pnpm/action-setup@v6" in the workflow and update them to the corresponding
release commit SHA from the action's repository, then verify the workflow runs
successfully.

- uses: actions/setup-node@v6
with:
node-version: 24.13.1
node-version: 24.15.0
cache: pnpm

- run: pnpm install --frozen-lockfile
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/snapshot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ jobs:
npm pack --silent --pack-destination ../../artifacts
- name: Upload snapshot artifacts
if: steps.snapshot.outputs.success != 'true'
uses: actions/upload-artifact@v6
uses: actions/upload-artifact@v7
with:
name: context-doc-snapshot
path: artifacts/*.tgz
6 changes: 3 additions & 3 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
"version": "1.0.0",
"private": true,
"description": "Monorepo workspace for effect-template",
"packageManager": "pnpm@10.30.1",
"packageManager": "pnpm@11.1.2",
"workspaces": [
"packages/*"
],
Expand All @@ -22,8 +22,8 @@
"start": "pnpm --filter @prover-coder-ai/openapi-effect start"
},
"devDependencies": {
"@changesets/changelog-github": "^0.5.2",
"@changesets/cli": "^2.29.8"
"@changesets/changelog-github": "^0.7.0",
"@changesets/cli": "^2.31.0"
},
"repository": {
"type": "git",
Expand Down
70 changes: 35 additions & 35 deletions packages/app/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,54 +48,54 @@
"url": "https://github.com/ProverCoderAI/effect-template/issues"
},
"homepage": "https://github.com/ProverCoderAI/effect-template#readme",
"packageManager": "pnpm@10.30.1",
"packageManager": "pnpm@11.1.2",
"dependencies": {
"@effect/cli": "^0.73.2",
"@effect/cluster": "^0.56.4",
"@effect/experimental": "^0.58.0",
"@effect/platform": "^0.94.5",
"@effect/platform-node": "^0.104.1",
"@effect/printer": "^0.47.0",
"@effect/printer-ansi": "^0.47.0",
"@effect/rpc": "^0.73.2",
"@effect/cli": "^0.75.1",
"@effect/cluster": "^0.58.2",
"@effect/experimental": "^0.60.0",
"@effect/platform": "^0.96.1",
"@effect/platform-node": "^0.106.0",
"@effect/printer": "^0.49.0",
"@effect/printer-ansi": "^0.49.0",
"@effect/rpc": "^0.75.1",
"@effect/schema": "^0.75.5",
"@effect/sql": "^0.49.0",
"@effect/typeclass": "^0.38.0",
"@effect/workflow": "^0.16.0",
"effect": "^3.19.18",
"@effect/sql": "^0.51.1",
"@effect/typeclass": "^0.40.0",
"@effect/workflow": "^0.18.1",
"effect": "^3.21.2",
"openapi-typescript-helpers": "^0.1.0",
"ts-morph": "^27.0.2"
"ts-morph": "^28.0.0"
},
"devDependencies": {
"@biomejs/biome": "^2.4.4",
"@biomejs/biome": "^2.4.15",
"@effect/eslint-plugin": "^0.3.2",
"@effect/language-service": "latest",
"@effect/vitest": "^0.27.0",
"@eslint-community/eslint-plugin-eslint-comments": "^4.6.0",
"@eslint/compat": "2.0.2",
"@eslint/eslintrc": "3.3.3",
"@effect/vitest": "^0.29.0",
"@eslint-community/eslint-plugin-eslint-comments": "^4.7.1",
"@eslint/compat": "2.1.0",
"@eslint/eslintrc": "3.3.5",
"@eslint/js": "10.0.1",
"@prover-coder-ai/eslint-plugin-suggest-members": "^0.0.25",
"@prover-coder-ai/eslint-plugin-suggest-members": "^0.0.26",
"@ton-ai-core/vibecode-linter": "^1.0.11",
"@types/node": "^24.10.13",
"@typescript-eslint/eslint-plugin": "^8.56.0",
"@typescript-eslint/parser": "^8.56.0",
"typescript-eslint": "^8.56.0",
"@vitest/coverage-v8": "^4.0.18",
"eslint": "^10.0.1",
"@types/node": "^24.12.4",
"@typescript-eslint/eslint-plugin": "^8.59.3",
"@typescript-eslint/parser": "^8.59.3",
"typescript-eslint": "^8.59.3",
"@vitest/coverage-v8": "^4.1.6",
"eslint": "^10.3.0",
"eslint-import-resolver-typescript": "^4.4.4",
"eslint-plugin-codegen": "0.34.1",
"eslint-plugin-import": "^2.32.0",
"eslint-plugin-simple-import-sort": "^12.1.1",
"eslint-plugin-sonarjs": "^4.0.0",
"eslint-plugin-simple-import-sort": "^13.0.0",
"eslint-plugin-sonarjs": "^4.0.3",
"eslint-plugin-sort-destructure-keys": "^3.0.0",
"eslint-plugin-unicorn": "^63.0.0",
"@vitest/eslint-plugin": "^1.6.9",
"globals": "^17.3.0",
"jscpd": "^4.0.8",
"typescript": "^5.9.3",
"vite": "^7.3.1",
"eslint-plugin-unicorn": "^64.0.0",
"@vitest/eslint-plugin": "^1.6.17",
"globals": "^17.6.0",
"jscpd": "^4.2.0",
"typescript": "^6.0.3",
"vite": "^8.0.13",
"vite-tsconfig-paths": "^6.1.1",
"vitest": "^4.0.18"
"vitest": "^4.1.6"
}
}
Loading
Loading