Consolidate open dependabot dependency bumps - #10603
Open
pavinduLakshan wants to merge 3 commits into
Open
pavinduLakshan wants to merge 3 commits into
pavinduLakshan wants to merge 3 commits into
Conversation
Merges the version bumps from PRs #10600, #10585, #10584, #10583, #10582, #10575, #10574, #10573, #10561, #10560, #10559, #10556, #10491, #10483, #10462, #10432, #10421, #10410, #10408 into one changeset to reduce review overhead of reviewing 19 separate one-line dependency bump PRs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This was referenced Aug 8, 2026
Closed
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (9)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughChangesThe pull request consolidates Java and JavaScript dependency upgrades, updates compatibility code for newer tooling APIs, improves image URL header handling, adds workspace dependency overrides, and records patch releases for four packages. Dependency version consolidation
🚥 Pre-merge checks | ✅ 5 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
package.json (1)
108-108: 🎯 Functional Correctness | 🔵 Trivial | 💤 Low valueUpdate the version script to use the major-version APIs.
fast-xml-parsernow exposes ESM imports; the CommonJS-stylerequire("fast-xml-parser")import can break parsing in Node/build tooling.simple-gitis promise-based by default in v3 and no longer needssimple-git/promise; replace it with the current v3 entry point to avoid the legacy path warning.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@package.json` at line 108, Update the version script’s dependency imports to use the current major-version APIs: replace the CommonJS require of fast-xml-parser with its ESM-compatible import, and replace simple-git/promise with the standard simple-git entry point. Preserve the existing parsing and Git behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/console/java/pom.xml`:
- Around line 578-580: The Jackson dependency-management entries in
apps/console/java/pom.xml lines 578-580 and apps/myaccount/java/pom.xml lines
580-580 must use one consistent, tested Jackson version line. Align
jackson-core, jackson-annotations, jackson-databind, and
jackson-jaxrs-json-provider in both POM sections, preserving the existing
dependency keys.
In `@identity-apps-core/pom.xml`:
- Line 836: Align the dependency stack before changing org.apache.cxf.version to
4.1.7: either retain the existing javax.ws.rs-api 2.1.1 and Jersey 1.19.1 by
keeping CXF on its compatible version, or migrate all CXF consumers and managed
APIs from javax/Jersey to the Jakarta EE 10 baseline required by CXF 4.1,
including the JDK 17 requirement.
In `@package.json`:
- Around line 120-121: Update the `@storybook/react-webpack5` dependency to
version 9.1.19 to match the pinned storybook package, refresh the lockfile
accordingly, and run storybook doctor to verify the dependency alignment.
---
Nitpick comments:
In `@package.json`:
- Line 108: Update the version script’s dependency imports to use the current
major-version APIs: replace the CommonJS require of fast-xml-parser with its
ESM-compatible import, and replace simple-git/promise with the standard
simple-git entry point. Preserve the existing parsing and Git behavior.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro Plus
Run ID: 21551ab7-a142-4fbd-99e3-233027686465
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (10)
.changeset/dependency-bumps-consolidation.mdapps/console/java/pom.xmlapps/console/package.jsonapps/myaccount/java/pom.xmlapps/myaccount/package.jsonfeatures/admin.copilot.v1/package.jsonidentity-apps-core/pom.xmlmodules/core/package.jsonpackage.jsonpnpm-workspace.yaml
- Align jackson-core/annotations/databind/jaxrs-json-provider to 2.18.9 across apps/console/java and apps/myaccount/java (was an inconsistent mix left over from applying each dependabot PR's single-property bump). - Cap org.apache.cxf at 3.6.11 instead of 4.1.7: CXF 4.x requires the jakarta.ws.rs namespace and JDK 17, incompatible with identity-apps-core's existing javax.ws.rs-api 2.1.1 / Jersey 1.19.1 / JDK 11 baseline. 3.6.11 is the latest release still on the javax-compatible line. - Bump @storybook/react-webpack5 to 9.1.19 to match the storybook bump. - Migrate scripts/update-version.js off removed/deprecated APIs: use fast-xml-parser's XMLParser class instead of the removed top-level parse() function, and simple-git's default export instead of the deprecated simple-git/promise subpath. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- modules/validation/src/validation.ts: response.headers["content-type"] is now typed as AxiosHeaderValue (string | string[] | number | boolean | null) instead of string, so .includes() no longer type-checks directly. Convert to string first and guard for null/undefined. - apps/console/vite.config.ts, apps/myaccount/vite.config.ts: vite 6's bundled sass types narrowed silenceDeprecations from string[] to DeprecationOrId[], which is a subtype "legacy-js-api" widens out of when written as a plain array literal. Assert it as a literal tuple instead. Also found and cleaned up stale node_modules/axios symlinks (leftover from before the axios override bump) that were pointing multiple feature packages at the old 1.7.0 install, causing a dual-package-version type clash across unrelated files. Confirmed via a full nx typecheck run across all 8 typecheck-configured projects (react-components, forms, access-control, validation, core, i18n, myaccount, console). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Codecov Report❌ Patch coverage is
❌ Your patch check has failed because the patch coverage (0.00%) is below the target coverage (80.00%). You can increase the patch coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## master #10603 +/- ##
==========================================
- Coverage 73.46% 73.20% -0.26%
==========================================
Files 471 471
Lines 71454 72141 +687
Branches 266 266
==========================================
+ Hits 52492 52813 +321
- Misses 18855 19325 +470
+ Partials 107 3 -104
🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidates the following open dependabot PRs into a single PR to reduce review overhead:
npm/yarn
5.4.8→6.4.3(apps/console, apps/myaccount) — closes Bump vite from 5.4.21 to 6.4.3 #104213.13.1→3.15.0(modules/core) — closes Bump js-yaml from 3.13.1 to 3.15.0 #10483, Bump js-yaml from 3.13.1 to 3.15.0 in /modules/core #104911.7.9→1.18.0(features/admin.copilot.v1) — closes Bump axios from 1.7.0 to 1.18.0 #10556, Bump axios from 1.7.9 to 1.18.0 in /features/admin.copilot.v1 #105741.129.0→3.36.0(root) — closes Bump simple-git from 1.132.0 to 3.36.0 #105829.1.9→9.1.19(root) — closes Bump storybook from 9.1.9 to 9.1.19 #105833.15.0→5.7.0(root) — closes Bump fast-xml-parser from 3.21.1 to 5.7.0 #105844.17.23→4.18.1(transitive, via workspace override) — closes Bump lodash from 4.17.23 to 4.18.1 #105855.1.6→5.1.9(transitive, via workspace override) — closes Bump immutable from 5.1.6 to 5.1.9 #105617.29.0→7.29.6(transitive, via workspace override) — closes Bump @babel/core from 7.29.0 to 7.29.6 #1057517.13.3→17.13.4(transitive, via workspace override) — closes Bump joi from 17.13.3 to 17.13.4 #104103.4.11→3.4.12(transitive, via workspace override) — closes Bump dompurify from 3.4.11 to 3.4.12 #10559Maven
3.4.10→4.1.7(identity-apps-core) — closes Bump org.apache.cxf:cxf-core from 3.4.10 to 4.1.7 in /identity-apps-core #106002.13.4.2→2.18.9(apps/console/java) — closes Bump com.fasterxml.jackson.core:jackson-databind from 2.13.4.2 to 2.18.9 in /apps/console/java #105732.10.5→2.18.8(apps/console/java) — closes Bump com.fasterxml.jackson.core:jackson-core from 2.10.5 to 2.18.8 in /apps/console/java #105602.13.4.2→2.22.0(apps/myaccount/java) — closes Bump com.fasterxml.jackson.core:jackson-databind from 2.13.4.2 to 2.22.0 in /apps/myaccount/java #104629.0.11→9.0.118(apps/console/java) — closes Bump org.apache.tomcat:tomcat-catalina from 9.0.11 to 9.0.118 in /apps/console/java #104329.0.11→9.0.118(apps/myaccount/java) — closes Bump org.apache.tomcat:tomcat-catalina from 9.0.11 to 9.0.118 in /apps/myaccount/java #10408Several of these are major version bumps (vite, fast-xml-parser, simple-git, jackson-databind, tomcat-catalina) with potential breaking changes that should be verified in CI/manual testing before merge.
Test plan
pnpm installresolves cleanly andpnpm typecheckpasses🤖 Generated with Claude Code