chore: PR + dependency triage report — 2026-05-12 #155

2026-05-12T21:48:25Z

KofTwentyTwo commented

2026-05-12 21:48:25 +00:00

(Migrated from github.com)

Summary

Read-only triage of:

8 open PRs (3 user drafts: #150 #151 #152; 5 Dependabot: #144 #145 #146 #147 #148)
2 open Dependabot security alerts (#1 esbuild GHSA-67mh-4wv8-2f99, #2 vite CVE-2026-39365 / GHSA-4w7w-66w2-5vf9) — both moderate, both dev-only
6 stashes on the main checkout (1 created by this lane as a safety net, 5 pre-existing)
9 sibling agent worktrees and what each is working on

Recommends; does not merge. Does not drop stashes. Does not modify any sibling-lane work.

Headline finding

PR #145 (vite 8.0.10 → 8.0.12) only partially closes Alerts #1 and #2. Confirmed by reading gh pr diff 145:

It upgrades packages/hud's vite to 8.0.12 and pulls vitest@3.2.4 onto vite@7.3.3 + esbuild@0.27.7 (both patched). Good.
It does NOT touch webview/package.json or webview/packages/bus/package.json, both of which pin vitest: ^2.1.0. Those still resolve to vitest@2.1.9 → vite@5.4.21 → esbuild@0.21.5 (both vulnerable).

So after PR #145 lands, the alerts will not auto-close. Recommended follow-up: add a small pnpm.overrides block in webview/package.json pinning vite >= 8.0.5 and esbuild >= 0.25.0 (then pnpm install to regenerate lockfile). One-file change; both alerts auto-close. The cleaner-but-bigger alternative — bumping vitest from ^2.1.0 to ^3.0.0 in root + bus — is filed as out-of-scope for this v0.1 lane.

Recommended morning sequence

Verify PR #145 locally (pnpm install + pnpm --filter @jarvis/hud test + bash scripts/build-webview.sh), then merge it.
Re-fetch gh api /repos/KofTwentyTwo/Jarvis/dependabot/alerts. Confirm both alerts are still open.
Open a 1-file PR adding pnpm.overrides to webview/package.json. Regenerate lockfile. Confirm grep -E 'vite@5|esbuild@0\.21' webview/pnpm-lock.yaml returns nothing.
File a follow-up issue: "Bump webview root + packages/bus vitest from ^2.1.0 to ^3.0.0" for v0.2.
Merge PR #148 (@react-three/fiber 9.6.1 — patch, safest).
Investigate PRs #144 (jsdom 25 → 29), #146 (TS 5.9 → 6.0), #147 (@vitejs/plugin-react v5 → v6) individually — all majors; treat each as its own decision.

Caveat

All 8 open PRs currently show CircleCI Pipeline: ERROR (pipeline-level failure, not per-job). Coordinate with ci/github-actions-v0.1 sibling lane before relying on CI green. Local-gate verification path documented in the report.

Test plan

Read docs/PR-DEPS-TRIAGE-2026-05-12.md.
Execute the "Recommended morning sequence" in order; each step is independently verifiable.
After steps 1–3, confirm Dependabot alerts #1 + #2 closed via gh api /repos/KofTwentyTwo/Jarvis/dependabot/alerts --jq '.[] | select(.state == "open")'.
Verify develop stays green via bash scripts/check-app-builds.sh + the boundary-gate sweep listed in CLAUDE.md after each merge.

## Summary Read-only triage of: - 8 open PRs (3 user drafts: #150 #151 #152; 5 Dependabot: #144 #145 #146 #147 #148) - 2 open Dependabot security alerts (#1 esbuild GHSA-67mh-4wv8-2f99, #2 vite CVE-2026-39365 / GHSA-4w7w-66w2-5vf9) — both moderate, both dev-only - 6 stashes on the main checkout (1 created by this lane as a safety net, 5 pre-existing) - 9 sibling agent worktrees and what each is working on Recommends; does not merge. Does not drop stashes. Does not modify any sibling-lane work. ## Headline finding **PR #145 (vite 8.0.10 → 8.0.12) only partially closes Alerts #1 and #2.** Confirmed by reading `gh pr diff 145`: - It upgrades `packages/hud`'s vite to 8.0.12 and pulls `vitest@3.2.4` onto `vite@7.3.3` + `esbuild@0.27.7` (both patched). Good. - It does **NOT** touch `webview/package.json` or `webview/packages/bus/package.json`, both of which pin `vitest: ^2.1.0`. Those still resolve to `vitest@2.1.9` → `vite@5.4.21` → `esbuild@0.21.5` (both vulnerable). So after PR #145 lands, the alerts will **not** auto-close. Recommended follow-up: add a small `pnpm.overrides` block in `webview/package.json` pinning `vite >= 8.0.5` and `esbuild >= 0.25.0` (then `pnpm install` to regenerate lockfile). One-file change; both alerts auto-close. The cleaner-but-bigger alternative — bumping `vitest` from `^2.1.0` to `^3.0.0` in root + bus — is filed as out-of-scope for this v0.1 lane. ## Recommended morning sequence 1. Verify PR #145 locally (`pnpm install` + `pnpm --filter @jarvis/hud test` + `bash scripts/build-webview.sh`), then merge it. 2. Re-fetch `gh api /repos/KofTwentyTwo/Jarvis/dependabot/alerts`. Confirm both alerts are still open. 3. Open a 1-file PR adding `pnpm.overrides` to `webview/package.json`. Regenerate lockfile. Confirm `grep -E 'vite@5|esbuild@0\.21' webview/pnpm-lock.yaml` returns nothing. 4. File a follow-up issue: "Bump webview root + packages/bus vitest from ^2.1.0 to ^3.0.0" for v0.2. 5. Merge PR #148 (`@react-three/fiber 9.6.1` — patch, safest). 6. Investigate PRs #144 (jsdom 25 → 29), #146 (TS 5.9 → 6.0), #147 (`@vitejs/plugin-react` v5 → v6) individually — all majors; treat each as its own decision. ## Caveat All 8 open PRs currently show `CircleCI Pipeline: ERROR` (pipeline-level failure, not per-job). Coordinate with `ci/github-actions-v0.1` sibling lane before relying on CI green. Local-gate verification path documented in the report. ## Test plan - [ ] Read `docs/PR-DEPS-TRIAGE-2026-05-12.md`. - [ ] Execute the "Recommended morning sequence" in order; each step is independently verifiable. - [ ] After steps 1–3, confirm Dependabot alerts #1 + #2 closed via `gh api /repos/KofTwentyTwo/Jarvis/dependabot/alerts --jq '.[] | select(.state == "open")'`. - [ ] Verify `develop` stays green via `bash scripts/check-app-builds.sh` + the boundary-gate sweep listed in `CLAUDE.md` after each merge.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/Jarvis#155