Skip to content

feat: update dependencies - #2028

Merged
Eli Bosley (elibosley) merged 10 commits into
mainfrom
codex/fix-dependency-audit-issues
Jul 21, 2026
Merged

feat: update dependencies#2028
Eli Bosley (elibosley) merged 10 commits into
mainfrom
codex/fix-dependency-audit-issues

Conversation

@elibosley

@elibosley Eli Bosley (elibosley) commented Jun 14, 2026

Copy link
Copy Markdown
Member

Summary

  • Upgrade vulnerable dependency ranges across the workspace and refresh pnpm-lock.yaml.
  • Add a repo audit wrapper that filters ignored CVEs and pnpm's stale actions for ignored advisories/workspace importer false positives.
  • Keep existing dependencies in place rather than removing them, including ip and lodash-es.
  • Fix the Unraid plugins missing-directory test so it uses an isolated temp path.

Validation

  • pnpm run --silent audit --prod
  • pnpm --filter ./api type-check
  • pnpm --filter ./api test

Notes

  • The unpatched ip advisory is ignored through repo audit policy because npm reports no patched version.
  • Native pnpm audit --prod still leaves a stale action for that ignored advisory; use the repo audit script for CI/user checks.

Summary by CodeRabbit

  • Bug Fixes
    • Accordion now reliably clears/open values when the bound model value becomes empty or undefined.
    • Modal cancellation is triggered consistently when the dialog closes.
    • Resizing UI no longer touches browser-only APIs outside the browser environment.
    • Markdown/log sanitization now consistently uses DOMPurify for safer rendering.
  • Improvements
    • Added an enhanced dependency audit command and a CI audit job with support for advisory exclusions.
    • Updated Nuxt UI and related libraries for improved compatibility.
  • Chores
    • Refreshed dependency versions across the project and updated related test support.

@coderabbitai

coderabbitai Bot commented Jun 14, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

Walkthrough

This PR upgrades dependencies across the monorepo, adds pnpm audit post-processing, replaces private IP detection, and updates frontend sanitization, generated typings, component behavior, and test environment setup.

Changes

Backend dependency and audit tooling

Layer / File(s) Summary
Core dependency and build alignment
package.json, api/package.json, packages/..., plugin/package.json, api/scripts/build.ts, AGENTS.md
Updates workspace dependencies, propagates root pnpm overrides into API builds, and removes one development guidance line.
pnpm audit report processing
scripts/pnpm-audit.mjs, package.json, .github/workflows/main.yml
Adds audit execution, workspace-importer filtering, ignore handling, advisory pruning, metadata recalculation, and CI integration.
API plugin test isolation
api/src/unraid-api/graph/resolvers/unraid-plugins/unraid-plugins.service.spec.ts
Uses real ConfigService spies and temporary directories with cleanup in plugin service tests.

Private IP detection

Layer / File(s) Summary
Private IP helper and DNS integration
packages/unraid-api-plugin-connect/src/connection-status/*, packages/unraid-api-plugin-connect/src/__test__/*
Replaces the external private-IP check with explicit Node BlockList ranges and adds IPv4, IPv6, public-address, and invalid-input tests.

Frontend package compatibility and component updates

Layer / File(s) Summary
Frontend package and generated type alignment
unraid-ui/package.json, web/package.json, web/auto-imports.d.ts, web/components.d.ts, unraid-ui/vite.config.ts
Updates frontend packages and Nuxt UI declarations for version 4.8.2, while changing declaration output configuration.
DOMPurify and browser test environment
web/src/helpers/markdown.ts, web/src/composables/useContentHighlighting.ts, web/vitest.setup.ts, web/__test__/*, web/vitest.config.ts
Switches DOMPurify integration, adds jsdom-backed sanitization and storage mocks, updates fetch stubs, and replaces snapshot checks with targeted assertions.
Frontend component behavior and type contracts
unraid-ui/src/components/common/accordion/Accordion.vue, web/src/composables/*, web/src/components/*, web/src/store/callbackActions.ts
Updates undefined Accordion values, Nuxt UI dropdown types, browser guards, modal close handling, skeleton styling, and callback key defaults.

Estimated code review effort: 4 (Complex) | ~60 minutes

Poem

I’m a rabbit with packages stacked,
Hopping through audits, neat and tracked.
Private IP ranges guard the way,
Nuxt types bloom in fresh display.
DOMPurify gleams; tests thump hooray.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately captures the main theme: workspace dependency updates.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/fix-dependency-audit-issues

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

Copy link
Copy Markdown
Contributor

🚀 Storybook has been deployed to staging: https://unraid-ui-storybook-staging.unraid-workers.workers.dev

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@api/src/unraid-api/graph/resolvers/unraid-plugins/unraid-plugins.service.spec.ts`:
- Around line 170-175: Replace the mock ConfigService object creation that uses
the `as unknown as ConfigService` casting pattern with the `vi.spyOn()` approach
to maintain type safety and avoid unsafe casting. The current pattern at the
configService initialization violates type safety guidelines. Instead of
creating a mock object and casting it, use the spy approach demonstrated in the
existing test setup to properly mock the ConfigService without bypassing
TypeScript's type checking. Apply this fix consistently wherever this pattern
appears in the test file.

In `@scripts/pnpm-audit.mjs`:
- Around line 9-13: The spawnSync call for the pnpm audit command in the audit
function does not specify an explicit maxBuffer option, which defaults to 1 MB
and can be exceeded by large audit payloads, causing stdout truncation and
JSON.parse failures. Add a maxBuffer property to the options object passed to
spawnSync with a significantly larger value (such as 10 MB or higher) to
accommodate large audit output without truncation.

In `@unraid-ui/package.json`:
- Line 89: The devDependencies for ajv has been upgraded to 8.20.0, but the
peerDependencies.ajv is still pinned to 8.17.1, creating a version mismatch.
Update the peerDependencies.ajv version from 8.17.1 to 8.20.0 to align with the
upgraded devDependencies version and match what is being consumed in
web/package.json.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 869d8a80-ee9e-4352-9190-bb46f85b2e2b

📥 Commits

Reviewing files that changed from the base of the PR and between 6f94aa1 and 58b6f3b.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (11)
  • api/package.json
  • api/src/unraid-api/graph/resolvers/unraid-plugins/unraid-plugins.service.spec.ts
  • package.json
  • packages/unraid-api-plugin-connect/package.json
  • packages/unraid-api-plugin-generator/package.json
  • packages/unraid-api-plugin-health/package.json
  • packages/unraid-shared/package.json
  • plugin/package.json
  • scripts/pnpm-audit.mjs
  • unraid-ui/package.json
  • web/package.json

Comment thread api/src/unraid-api/graph/resolvers/unraid-plugins/unraid-plugins.service.spec.ts Outdated
Comment thread scripts/pnpm-audit.mjs
Comment thread unraid-ui/package.json
@elibosley
Eli Bosley (elibosley) force-pushed the codex/fix-dependency-audit-issues branch from 58b6f3b to a421619 Compare June 14, 2026 14:09
@github-actions

Copy link
Copy Markdown
Contributor

🚀 Storybook has been deployed to staging: https://unraid-ui-storybook-staging.unraid-workers.workers.dev

@elibosley
Eli Bosley (elibosley) force-pushed the codex/fix-dependency-audit-issues branch from a421619 to 0baec05 Compare June 14, 2026 14:19
@github-actions

Copy link
Copy Markdown
Contributor

🚀 Storybook has been deployed to staging: https://unraid-ui-storybook-staging.unraid-workers.workers.dev

@codecov

codecov Bot commented Jun 14, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 31.81818% with 15 lines in your changes missing coverage. Please review.
✅ Project coverage is 52.90%. Comparing base (2679fda) to head (d7afea6).
⚠️ Report is 3 commits behind head on main.

Files with missing lines Patch % Lines
web/__test__/setup.ts 0.00% 5 Missing ⚠️
...d-ui/src/components/common/accordion/Accordion.vue 0.00% 3 Missing ⚠️
web/src/components/Common/ResizableSlideover.vue 0.00% 3 Missing ⚠️
...nboarding/components/InternalBootConfirmDialog.vue 50.00% 2 Missing ⚠️
...rc/components/Docker/DockerContainerManagement.vue 0.00% 1 Missing ⚠️
web/src/composables/useContextMenu.ts 0.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #2028      +/-   ##
==========================================
+ Coverage   52.77%   52.90%   +0.12%     
==========================================
  Files        1035     1035              
  Lines       72060    72088      +28     
  Branches     8303     8313      +10     
==========================================
+ Hits        38031    38135     +104     
+ Misses      33903    33826      -77     
- Partials      126      127       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions

Copy link
Copy Markdown
Contributor

This plugin has been deployed to Cloudflare R2 and is available for testing.
Download it at this URL:

https://preview.dl.unraid.net/unraid-api/tag/PR2028/dynamix.unraid.net.plg

@elibosley
Eli Bosley (elibosley) marked this pull request as ready for review June 14, 2026 14:28

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0baec05c03

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

Comment thread scripts/pnpm-audit.mjs
updateVulnerabilityMetadata(report);

process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
process.exitCode = Object.keys(report.advisories ?? {}).length === 0 ? 0 : (audit.status ?? 1);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve audit failures for registry errors

When pnpm audit --json returns a JSON error object instead of an advisory list, this line treats the missing advisories object as empty and exits 0. I reproduced this with the current registry 403 response: node scripts/pnpm-audit.mjs printed ERR_PNPM_AUDIT_BAD_RESPONSE but returned success; pnpm audit --help documents --ignore-registry-errors as the option that should make registry errors exit 0, so without that flag CI will now pass even though the audit did not complete.

Useful? React with 👍 / 👎.

@github-actions

Copy link
Copy Markdown
Contributor

🚀 Storybook has been deployed to staging: https://unraid-ui-storybook-staging.unraid-workers.workers.dev

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@unraid-ui/src/components/common/accordion/Accordion.vue`:
- Around line 33-35: The watcher that handles `modelValue` changes currently
blocks `undefined` values with an `if (val !== undefined)` guard check,
preventing the parent from clearing or resetting the internal `openValue` state
in controlled mode. Remove or adjust the guard condition that skips `undefined`
values so that when `modelValue` is set to `undefined`, it properly propagates
to `openValue` to maintain controlled sync semantics. Apply the same fix to any
other watchers or handlers in the Accordion component that have similar guard
conditions blocking `undefined` (mentioned as also applying to the 52-55 range).

In `@unraid-ui/vite.config.ts`:
- Around line 33-36: Fix the vite-plugin-dts configuration in vite.config.ts to
match the v5.0.2 API. Change the property outDirs (which is an array) to the
singular property outDir with a string value of 'dist'. Additionally, replace
the bundleTypes object structure (containing the non-existent bundledPackages
property) with a boolean value of false, or remove the bundleTypes configuration
entirely since false is the default in this API version.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: bcb965b8-33c9-4b8a-98ba-201fdefdc943

📥 Commits

Reviewing files that changed from the base of the PR and between 58b6f3b and b7681c0.

⛔ Files ignored due to path filters (2)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
  • web/__test__/helpers/__snapshots__/markdown.test.ts.snap is excluded by !**/*.snap
📒 Files selected for processing (32)
  • AGENTS.md
  • api/package.json
  • api/src/unraid-api/graph/resolvers/unraid-plugins/unraid-plugins.service.spec.ts
  • package.json
  • packages/unraid-api-plugin-connect/package.json
  • packages/unraid-api-plugin-generator/package.json
  • packages/unraid-api-plugin-health/package.json
  • packages/unraid-shared/package.json
  • plugin/package.json
  • scripts/pnpm-audit.mjs
  • unraid-ui/package.json
  • unraid-ui/src/components/common/accordion/Accordion.vue
  • unraid-ui/vite.config.ts
  • web/__test__/components/Logs/SingleLogViewer.test.ts
  • web/__test__/components/SsoButton.test.ts
  • web/__test__/helpers/markdown.test.ts
  • web/__test__/setup.ts
  • web/__test__/store/callbackActions.test.ts
  • web/auto-imports.d.ts
  • web/components.d.ts
  • web/package.json
  • web/src/components/Common/ResizableSlideover.vue
  • web/src/components/Docker/DockerContainerManagement.vue
  • web/src/components/Onboarding/components/InternalBootConfirmDialog.vue
  • web/src/composables/gql/graphql.ts
  • web/src/composables/useContentHighlighting.ts
  • web/src/composables/useContextMenu.ts
  • web/src/composables/useDockerRowActions.ts
  • web/src/helpers/markdown.ts
  • web/src/store/callbackActions.ts
  • web/vitest.config.ts
  • web/vitest.setup.ts
💤 Files with no reviewable changes (1)
  • AGENTS.md
✅ Files skipped from review due to trivial changes (8)
  • web/src/helpers/markdown.ts
  • web/src/components/Docker/DockerContainerManagement.vue
  • web/src/composables/useContentHighlighting.ts
  • web/test/store/callbackActions.test.ts
  • packages/unraid-api-plugin-generator/package.json
  • web/components.d.ts
  • web/src/composables/gql/graphql.ts
  • web/auto-imports.d.ts
🚧 Files skipped from review as they are similar to previous changes (10)
  • plugin/package.json
  • api/src/unraid-api/graph/resolvers/unraid-plugins/unraid-plugins.service.spec.ts
  • packages/unraid-api-plugin-health/package.json
  • packages/unraid-api-plugin-connect/package.json
  • package.json
  • packages/unraid-shared/package.json
  • unraid-ui/package.json
  • api/package.json
  • scripts/pnpm-audit.mjs
  • web/package.json

Comment thread unraid-ui/src/components/common/accordion/Accordion.vue
Comment thread unraid-ui/vite.config.ts
Comment on lines +33 to +36
outDirs: ['dist'],
bundleTypes: {
bundledPackages: [],
},

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check vite-plugin-dts version and verify API compatibility
cat unraid-ui/package.json | jq -r '.devDependencies["vite-plugin-dts"]'

# Search for other vite-plugin-dts usage patterns
rg -nC3 'vite-plugin-dts|from.*dts' unraid-ui/

Repository: unraid/api

Length of output: 863


🏁 Script executed:

cat -n unraid-ui/vite.config.ts | head -50

Repository: unraid/api

Length of output: 1921


🌐 Web query:

vite-plugin-dts 5.0.2 API configuration outDirs bundleTypes

💡 Result:

In vite-plugin-dts, there are no specific configuration options named outDirs or bundleTypes [1][2]. It appears these may be confused with other settings or older plugin versions: Regarding bundling types: The functionality to bundle all type declaration files into a single file is controlled by the rollupTypes option, not bundleTypes [1][2]. When set to true, the plugin uses @microsoft/api-extractor to perform the bundling [1][2]. Example usage: import dts from 'vite-plugin-dts'; export default defineConfig({ plugins: [dts({ rollupTypes: true })], }); Regarding output directories: The plugin does not provide an outDirs option. The output directory for declaration files is generally determined by your Vite build configuration (typically build.outDir) and the plugin's default behavior of following your source file structure [3][1]. If you need to restrict output, the plugin provides a strictOutput option (default: true), which ensures that generated declaration files remain within the configured outDir [2].

Citations:


🌐 Web query:

vite-plugin-dts 5.0.2 changelog release notes

💡 Result:

vite-plugin-dts version 5.0.2 was released on June 1, 2026 [1][2][3]. As of the 5.x major release, the project has evolved into unplugin-dts [4]. While vite-plugin-dts remains available as a package, it is now maintained within the unplugin-dts repository [1][4]. The 5.0.2 update includes the following key changes: Bug Fixes: - Re-emits declarations when non-type files change during watch mode [5][6]. - Fixes a getResolvedModule error that occurred when bundling dts files outside of the src directory [5][6]. - Adds a.js extension to synthetic entry imports to support nodenext module resolution [5][6]. Additional Changes: - Version 5.0.2 also includes an internal update to bump the minimum Node.js requirement to version 20 or higher [3]. For users migrating or seeking the most versatile version of the plugin, the author recommends transitioning to the unplugin-dts package, which supports Vite, Rollup, Rolldown, Webpack, Rspack, and Esbuild [4].

Citations:


🌐 Web query:

site:github.com vite-plugin-dts v5.0.2 API options

💡 Result:

In vite-plugin-dts version 5.x, the plugin core was migrated to unplugin-dts [1][2]. A primary breaking change in this version is the renaming of the rollupTypes option to bundleTypes [1]. Key API options for vite-plugin-dts v5.0.2 include: bundleTypes: A boolean (default: false) that enables type bundling. When set to true, it utilizes @microsoft/api-extractor to merge all declaration files into a single file [3]. tsconfigPath: A string used to specify the path to your tsconfig.json file. The plugin uses this to resolve include and exclude patterns [3][4]. outDir: Specifies the output directory for generated declaration files. This can be a string, an array of strings, or an object/array of objects to control module formats (e.g., { dir: 'dist', moduleFormat: 'esm' }) [4][5]. entryRoot: Overrides the root path of entry files, which is particularly useful in monorepo structures [4][5]. strictOutput: A boolean (default: true) that, when enabled, ignores generated declaration files that fall outside the specified outDir [4][5]. processor: Specifies the processing mode, accepting either 'ts' or 'vue' [4][5]. compilerOptions: Allows overriding TypeScript compilerOptions [4][5]. resolvers: An array for specifying custom resolvers [4][5]. For migration from version 4.x, note that the rollupTypes option has been removed in favor of bundleTypes [1]. Additionally, ensure that your project dependencies align with the updated requirements, as v5+ often requires peer dependencies like @microsoft/api-extractor and rollup [1].

Citations:


Fix vite-plugin-dts configuration for v5.0.2 API.

In vite-plugin-dts v5.0.2, bundleTypes is a boolean (not an object), and the option is outDir (singular, not outDirs). The current configuration is invalid:

  • outDirs: ['dist'] should be outDir: 'dist'
  • bundleTypes: { bundledPackages: [] } should be bundleTypes: false (or omitted, since false is the default)

The bundledPackages property does not exist in this API version.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@unraid-ui/vite.config.ts` around lines 33 - 36, Fix the vite-plugin-dts
configuration in vite.config.ts to match the v5.0.2 API. Change the property
outDirs (which is an array) to the singular property outDir with a string value
of 'dist'. Additionally, replace the bundleTypes object structure (containing
the non-existent bundledPackages property) with a boolean value of false, or
remove the bundleTypes configuration entirely since false is the default in this
API version.

- pnpm-audit: set explicit maxBuffer and preserve registry/audit errors
- unraid-ui: align peerDependencies ajv to 8.20.0
- unraid-ui: propagate undefined modelValue in Accordion controlled sync
- api: replace unsafe ConfigService casts with vi.spyOn in plugins spec
@elibosley

Copy link
Copy Markdown
Member Author

Addressed the outstanding review feedback and rebased onto latest main (2679fda). Summary of what changed and why:

Fixed

  • scripts/pnpm-audit.mjsmaxBuffer: added maxBuffer: 10 * 1024 * 1024 so large audit payloads don't truncate stdout and break JSON.parse.
  • scripts/pnpm-audit.mjs — registry errors (Codex P2): when pnpm audit --json returns a JSON error object (e.g. ERR_PNPM_AUDIT_BAD_RESPONSE), the script now writes it through and exits non-zero instead of treating the missing advisories map as "clean" and exiting 0.
  • unraid-ui/package.json: bumped peerDependencies.ajv 8.17.18.20.0 to match the dev/consumer version.
  • unraid-ui/.../Accordion.vue: removed the if (val !== undefined) guard in the modelValue watcher so a parent-driven clear/reset propagates to openValue in controlled mode.
  • unraid-plugins.service.spec.ts: replaced the three as unknown as ConfigService casts with new ConfigService() + vi.spyOn(...), matching the existing setup and the repo's no-cast guideline.

Not changed (false positive)

  • unraid-ui/vite.config.tsoutDirs / bundleTypes (flagged 🔴 Critical): kept as-is. The installed vite-plugin-dts@5.0.2 wraps unplugin-dts@1.0.2, whose PluginOptions uses outDirs (plural, string | OutDirConfig | (...)[]) and bundleTypes?: boolean | { bundledPackages?: string[]; ... }. There is no singular outDir option, and bundleTypes: true fails the build because the synthesized api-extractor.json needs an explicit bundledPackages array (#/bundledPackages Expected type array but found type undefined). The current outDirs: ['dist'] + bundleTypes: { bundledPackages: [] } is the correct, build-verified config.

Validation

  • pnpm --filter ./api type-check
  • pnpm --filter ./unraid-ui type-check
  • pnpm --filter ./api exec vitest run .../unraid-plugins.service.spec.ts ✅ (6/6)
  • pnpm --filter ./unraid-ui test run ✅ (18/18)
  • pnpm --filter ./unraid-ui build ✅ (bundled dist/index.d.ts produced)

@github-actions

Copy link
Copy Markdown
Contributor

🚀 Storybook has been deployed to staging: https://unraid-ui-storybook-staging.unraid-workers.workers.dev

Resolve all 27 open advisories (0 remaining on `pnpm run audit --prod`):
- overrides: axios 1.18.1, js-yaml 4.3.0, tar 7.5.20, brace-expansion
  1.x->1.1.16 and 3.x-5.x->5.0.7; add body-parser 2.3.0, protobufjs 7.6.5
- bump direct deps: undici 7.27.2->7.28.0 (api, shared, connect),
  dompurify 3.4.10->3.4.12 (web, unraid-ui)
@github-actions

Copy link
Copy Markdown
Contributor

🚀 Storybook has been deployed to staging: https://unraid-ui-storybook-staging.unraid-workers.workers.dev

Add an Audit Dependencies job to CI - Main (API) that runs
`pnpm run audit --prod` (repo audit wrapper) on every PR and push to main,
failing the build when unignored advisories are present.
@github-actions

Copy link
Copy Markdown
Contributor

🚀 Storybook has been deployed to staging: https://unraid-ui-storybook-staging.unraid-workers.workers.dev

@elibosley Eli Bosley (elibosley) changed the title [codex] fix dependency audit issues fix: dependency audit issues Jul 21, 2026
Address AI review findings on the new audit gate:
- pnpm-audit: fail closed (non-zero exit) when pnpm returns an
  unrecognized report shape, instead of treating a missing advisories
  key as zero advisories and exiting 0
- main.yml: scope the Audit Dependencies job to contents: read instead
  of inheriting the workflow's contents/pull-requests write tokens
@github-actions

Copy link
Copy Markdown
Contributor

🚀 Storybook has been deployed to staging: https://unraid-ui-storybook-staging.unraid-workers.workers.dev

Comment thread scripts/pnpm-audit.mjs
function isRecognizedAuditReport(report) {
return (
typeof report === 'object' &&
report !== null &&
build:release builds production node_modules with npm from api/package.json,
which did not include the root pnpm.overrides where the CVE remediation lives.
The shipped artifact therefore resolved vulnerable transitives (e.g. axios
0.26.1, 18 npm advisories) even though the pnpm audit gate reported 0.

Merge the root pnpm.overrides into the generated production package.json so
the npm-built release resolves the same patched versions the audit validates
(npm honors the name@range key syntax). Verified: axios -> 1.18.1 and npm
audit drops from 18 to 1 (the remaining ip advisory has no upstream fix and is
already ignored via pnpm.auditConfig).
The ip package (CVE-2024-29415, SSRF in isPublic) is unmaintained with no
patched release, and was only used for ip.isPrivate() in cloud.service's DNS
check. Replace it with a small net.BlockList-based isPrivateIp helper (Node
built-in, zero deps) and add unit tests. Drop the ip and @types/ip deps from
both api (dead dep) and the connect plugin, and remove the now-unnecessary
CVE-2024-29415 audit ignore. Repo audit is clean (0 advisories) without it.
@github-actions

Copy link
Copy Markdown
Contributor

🚀 Storybook has been deployed to staging: https://unraid-ui-storybook-staging.unraid-workers.workers.dev

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/main.yml:
- Around line 172-173: Update the actions/checkout step to set
persist-credentials to false, ensuring the checkout action does not retain the
GitHub token in local git configuration.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: ccf7645a-4299-4af9-bed3-4d0674cde943

📥 Commits

Reviewing files that changed from the base of the PR and between 76f8cc3 and 19221da.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (9)
  • .github/workflows/main.yml
  • api/package.json
  • api/scripts/build.ts
  • package.json
  • packages/unraid-api-plugin-connect/package.json
  • packages/unraid-api-plugin-connect/src/__test__/is-private-ip.test.ts
  • packages/unraid-api-plugin-connect/src/connection-status/cloud.service.ts
  • packages/unraid-api-plugin-connect/src/connection-status/is-private-ip.ts
  • scripts/pnpm-audit.mjs
💤 Files with no reviewable changes (3)
  • package.json
  • api/package.json
  • packages/unraid-api-plugin-connect/package.json
🚧 Files skipped from review as they are similar to previous changes (1)
  • scripts/pnpm-audit.mjs

Comment on lines +172 to +173
- name: Checkout repo
uses: actions/checkout@v6

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Set persist-credentials: false for actions/checkout.

Leaving persist-credentials at its default (true) leaves the GitHub token in the local git configuration. To reduce the risk of credential exfiltration—especially when evaluating third-party dependencies—explicitly disable this.

🔒️ Proposed fix
       - name: Checkout repo
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Checkout repo
uses: actions/checkout@v6
- name: Checkout repo
uses: actions/checkout@v6
with:
persist-credentials: false
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 172-173: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/main.yml around lines 172 - 173, Update the
actions/checkout step to set persist-credentials to false, ensuring the checkout
action does not retain the GitHub token in local git configuration.

Source: Linters/SAST tools

The Audit Dependencies job skips pnpm install (pnpm audit reads the lockfile),
so setup-node's cache: 'pnpm' post-step failed with a path-validation error
trying to save a nonexistent store, marking the otherwise-passing job failed.
Remove the cache since there is nothing to cache.
@github-actions

Copy link
Copy Markdown
Contributor

🚀 Storybook has been deployed to staging: https://unraid-ui-storybook-staging.unraid-workers.workers.dev

@elibosley Eli Bosley (elibosley) changed the title fix: dependency audit issues feat: update dependencies Jul 21, 2026
@elibosley
Eli Bosley (elibosley) merged commit 1c8522d into main Jul 21, 2026
14 of 15 checks passed
@elibosley
Eli Bosley (elibosley) deleted the codex/fix-dependency-audit-issues branch July 21, 2026 17:57
@github-actions

Copy link
Copy Markdown
Contributor

🔄 PR Merged - Plugin Redirected to Staging

This PR has been merged and the preview plugin has been updated to redirect to the staging version.

For users testing this PR:

  • Your plugin will automatically update to the staging version on the next update check
  • The staging version includes all merged changes from this PR
  • No manual intervention required

Staging URL:

https://preview.dl.unraid.net/unraid-api/dynamix.unraid.net.plg

Thank you for testing! 🚀

Eli Bosley (elibosley) pushed a commit that referenced this pull request Jul 21, 2026
🤖 I have created a release *beep* *boop*
---


## [4.36.0](v4.35.1...v4.36.0)
(2026-07-21)


### Features

* add docker restart mutation
([#2022](#2022))
([b58120c](b58120c))
* update dependencies
([#2028](#2028))
([1c8522d](1c8522d))


### Bug Fixes

* **ci:** publish PR plugin after unrelated failures
([#2046](#2046))
([a2b0833](a2b0833))
* **ci:** resolve PR number for fork PR plugin uploads
([#2040](#2040))
([a086778](a086778))
* **ui:** smooth notification drawer slide-in/out
([#2038](#2038))
([66e86fe](66e86fe))
* **web:** send CSRF token on fetch-based webGUI requests
([#2039](#2039))
([8cb15f1](8cb15f1))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants