update deps and remove unused deps#2006
Conversation
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the WalkthroughDependency updates across mail, server, and workspace: ElevenLabs packages swapped/updated, Markdown rendering replaced with HTML sanitization in mail, zod major bump at root, and wrangler catalog bumped. No source code or exported API changes shown. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (4)
pnpm-workspace.yaml (2)
7-7: Critical: catalog still pins zod v3 while root moved to v4—this will fork your type system.If you ship both Zod 3 and Zod 4, you’ll get incompatible ZodError shapes and subtle runtime/type mismatches. Align the catalog to Zod 4 and have all packages consume it via
catalog:.Apply:
- zod: ^3.25.42 + zod: ^4.1.1Then, in all packages using
"zod": "catalog:", run a workspace upgrade to ensure a single version is resolved.
18-18: Unify Node types via catalog to prevent cross-project drift.Catalog has
@types/nodeat ^22.15.21, while root devDeps moved to 24.3.0. Pick one (recommend 24.3.0) and propagate via catalog.Apply:
- '@types/node': ^22.15.21 + '@types/node': ^24.3.0apps/server/package.json (2)
93-93: Pin @types/node via catalog to match workspace policy.Local pin
^22.9.0diverges from workspace catalog intent. Usecatalog:and let pnpm resolve one version across apps.Apply:
- "@types/node": "^22.9.0", + "@types/node": "catalog:",
81-81: Sanitize once, consistently.Server now depends on
sanitize-html. Ensure a single, shared sanitizer policy (allowed tags/attributes, URL schemes) is used across server handlers to avoid inconsistent XSS surfaces. Centralize insrc/lib/sanitize.tsand reuse.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (4)
apps/mail/package.json(2 hunks)apps/server/package.json(1 hunks)package.json(2 hunks)pnpm-workspace.yaml(1 hunks)
🧰 Additional context used
📓 Path-based instructions (2)
**/package.json
📄 CodeRabbit inference engine (AGENT.md)
Workspace packages use catalog versioning for shared dependencies
Files:
apps/server/package.jsonapps/mail/package.jsonpackage.json
pnpm-workspace.yaml
📄 CodeRabbit inference engine (AGENT.md)
Monorepo managed with pnpm workspaces
Files:
pnpm-workspace.yaml
🧠 Learnings (2)
📚 Learning: 2025-08-10T08:25:22.063Z
Learnt from: CR
PR: Mail-0/Zero#0
File: AGENT.md:0-0
Timestamp: 2025-08-10T08:25:22.063Z
Learning: Applies to **/package.json : Workspace packages use catalog versioning for shared dependencies
Applied to files:
pnpm-workspace.yaml
📚 Learning: 2025-08-10T08:25:22.063Z
Learnt from: CR
PR: Mail-0/Zero#0
File: AGENT.md:0-0
Timestamp: 2025-08-10T08:25:22.063Z
Learning: Use `pnpm go` for quick development startup
Applied to files:
package.json
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: cubic · AI code reviewer
🔇 Additional comments (5)
pnpm-workspace.yaml (1)
14-14: Confirm Wrangler v4.32.0 CLI flag compatibilityI’ve verified that Wrangler is correctly bumped to ^4.32.0 in your workspace and that both apps reference it via
"wrangler": "catalog:". The only custom flag usage I found is in apps/server/package.json:
- Line 6:
devscript uses--experimental-vectorize-bind-to-prod- Line 7:
deployscript (wrangler deploy)- Line 8:
typesscript (wrangler types --env local)- apps/mail has no experimental flags
Next steps before liftoff:
- Run
wrangler dev --help(with v4.32.0 installed) or review the 4.32.0 release notes to confirm that--experimental-vectorize-bind-to-prod(and any other flags you lean on) are still supported and behave identically.- If any flags have been renamed, removed, or had their defaults tweaked, update your scripts accordingly.
Once you’ve validated the flag behavior, we can confidently approve this bump.
apps/server/package.json (1)
35-35: All clear — no legacy ElevenLabs imports detected.
A full-repo ripgrep scan shows zero references to either the oldelevenlabspackage or the new@elevenlabs/elevenlabs-jsSDK.• ✔️ No legacy imports to replace
• ✔️ No new SDK imports in code
• 📦 The dependency lives in apps/server/package.json but isn’t yet consumedNext steps (if applicable):
• If you’ve already migrated your ElevenLabs calls, double-check your import paths.
• If you intend to use the new SDK, centralize its client instantiation in a helper module.
• Otherwise, this dependency is currently unused and safe to merge (or remove).apps/mail/package.json (2)
1-146: No stray imports detected — deepmerge, dexie, emblor, and react-markdown fully removedI audited every JS/TS file under apps/mail (including all subdirectories) and found zero import or require statements for those packages. All clear—no runtime breakage or lockfile bloat incoming.
23-23: Confirm @elevenlabs/react 0.5.1 API SurfacesI couldn’t locate a public changelog for v0.5.1—docs still show up through v0.4.x—so it’s safest to manually validate the components/hooks you’re using. In your
apps/mailcode, you currently import and consume:
useConversation(inproviders/voice-provider.tsx)VoiceProvider/useVoicewrapper arounduseConversation- Any downstream calls like
conversation.startSession,conversation.sendMessage, etc.Please:
- Check that
useConversationstill exists and its return value keys (startSession,sendMessage, status flags) are unchanged.- Verify any props or config options you pass to
startSessionhaven’t been renamed or retyped.- Run your TypeScript build and smoke-test voice flows to catch missing or renamed APIs.
Once you’ve confirmed there are no breaking changes, we can drop a focused migration patch if needed.
package.json (1)
43-53: Ensure dependencies are installed and re-run the smoke testsIt looks like the CI sandbox didn’t have your
node_modules, soprettier,turbo, andtscweren’t found—giving us no real signal about whether those bumps broke anything. Let’s get the environment bootstrapped and then re-run the checks:• Run
pnpm installat the repo root to populatenode_modules.
• Re-run the format check:pnpm run check:format
• Re-run the linter:pnpm run lint
• Re-run the full type-check:pnpm -r exec tsc --noEmitOnce you have those outputs, we can confidently verify that the @types/node, dotenv-cli, Prettier, Tailwind plugin, tsx, and turbo upgrades didn’t introduce any subtle issues.
ahmetskilinc
force-pushed
the
08-25-update_deps_and_remove_unused_deps
branch
from
6465106 to
d336895
Compare
Merge activity
|
1 participant
Package Dependency Updates
Description
This PR updates several package dependencies across the project:
@elevenlabs/reactfrom 0.1.5 to 0.5.1 in mail app@elevenlabs/elevenlabs-js2.12.2 to server appdeepmerge,dexie,emblor, andreact-markdownsanitize-html2.16.0 to mail appelevenlabs1.59.0 from server (replaced with newer@elevenlabs/elevenlabs-js)Summary by CodeRabbit