sec(frontend): pin npm dependencies to exact versions (closes #425) by cristim · Pull Request #872 · LeanerCloud/CUDly

cristim · 2026-05-30T17:42:31Z

Summary

Replaces all 29 caret (^) version ranges in frontend/package.json with the exact versions already recorded in package-lock.json.
Eliminates the attack surface where npm install (rather than npm ci) resolves a newer minor/patch release that may carry unaudited CVEs.
No functional change: every pinned version is the version currently installed; the lockfile is unchanged.

Test plan

All 29 dependencies + devDependencies entries verified to match package-lock.json exactly (node script).
npx tsc --noEmit -- no errors.
npm test --coverage -- 65 suites, 2142 tests passed, 1 skipped.
npm ci in a clean environment (disk full locally; CI will exercise this).

Summary by CodeRabbit

Chores
- Updated frontend tooling and library versions, including build, testing, linting, and TypeScript-related packages.
- Upgraded the charting library to a newer release.
- Locked package versions to exact values for more predictable installs and builds.

cristim · 2026-05-30T17:42:37Z

@coderabbitai review

coderabbitai · 2026-05-30T17:42:37Z

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 53 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2a825c6d-f131-443f-81fc-30bf601cc91a

📥 Commits

Reviewing files that changed from the base of the PR and between 6f2d921 and 1122850.

📒 Files selected for processing (1)

frontend/package.json

📝 Walkthrough

Walkthrough

This change updates frontend/package.json, bumping multiple devDependencies (Babel, TypeScript tooling, Jest, ESLint, Webpack stack, loaders/plugins, jsdom) and pinning them to exact version specifiers instead of caret ranges. The chart.js dependency version is also bumped.

Changes

Frontend dependency version updates

Layer / File(s)	Summary
Pin devDependencies and bump chart.js version `frontend/package.json`	DevDependencies are bumped and pinned to exact versions (removed caret ranges), and chart.js is bumped while qrcode is left unchanged.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Related issues: None specified

Related PRs: None specified

Suggested labels: dependencies, frontend

Suggested reviewers: None specified

🐰 A carrot-crunch, a version bump,
No caret left, just numbers plump,
Chart.js grows a whisker more,
Frontend deps now locked and sure.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely matches the main change: pinning frontend npm dependencies to exact versions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/425-wave19

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai · 2026-05-30T17:42:41Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

cristim · 2026-06-04T14:03:08Z

@coderabbitai review

coderabbitai · 2026-06-04T14:03:19Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

cristim · 2026-06-08T09:18:05Z

@coderabbitai full review

coderabbitai · 2026-06-08T09:19:42Z

✅ Action performed

Full review finished.

cristim · 2026-06-19T21:48:32Z

@coderabbitai review

coderabbitai · 2026-06-19T21:48:39Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

cristim · 2026-07-09T21:21:51Z

@coderabbitai review

coderabbitai · 2026-07-09T21:21:56Z

Rate Limit Exceeded

@cristim have exceeded the limit for the number of chat messages per hour. Please wait 4 minutes and 26 seconds before sending another message.

cristim · 2026-07-10T15:40:42Z

@coderabbitai review

coderabbitai · 2026-07-10T15:40:48Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

cristim · 2026-07-17T07:53:37Z

@coderabbitai review

cristim · 2026-07-17T07:53:54Z

Merge-prep: rebased onto origin/main (27fdb06), no conflicts. Non-Go PR; go vet on internal/... clean. @coderabbitai full review

cristim · 2026-07-17T11:25:02Z

Rebased onto main (includes #1437 tflint cache + #1438 trivy skip). No Go changes; frontend/package.json exact-version pins only.

Replace all 29 caret ranges (^) in package.json with the exact versions already recorded in package-lock.json. Exact pins eliminate the window where `npm install` (vs `npm ci`) resolves a newer minor/patch that may carry unaudited CVEs, and make supply-chain review straightforward. No functional change: every pinned version is the version currently installed, so the lockfile is unchanged.

cristim · 2026-07-17T16:29:27Z

@coderabbitai review

coderabbitai · 2026-07-17T16:29:47Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

cristim added triaged Item has been triaged priority/p3 Polish / idea / may never ship severity/low Minor harm urgency/eventually No deadline impact/internal Team-internal only effort/s Hours type/security Security finding labels May 30, 2026

cristim changed the base branch from feat/multicloud-web-frontend to main June 9, 2026 15:43

cristim force-pushed the fix/425-wave19 branch from 1b3bb89 to 0c25a81 Compare June 19, 2026 21:47

cristim mentioned this pull request Jun 19, 2026

sec(frontend): upgrade @babel/core past 7.29.0 to fix GHSA-4x5r-pxfx-6jf8 (arbitrary file read) #1270

Open

cristim force-pushed the fix/425-wave19 branch from 0c25a81 to 6f2d921 Compare July 5, 2026 23:05

cristim force-pushed the fix/425-wave19 branch from 6f2d921 to 60a18a1 Compare July 10, 2026 15:40

cristim force-pushed the fix/425-wave19 branch from 60a18a1 to 800528e Compare July 17, 2026 07:53

cristim force-pushed the fix/425-wave19 branch from 800528e to 1e46d4b Compare July 17, 2026 11:24

cristim force-pushed the fix/425-wave19 branch from 1e46d4b to 1122850 Compare July 17, 2026 16:24

cristim merged commit d29a3e0 into main Jul 17, 2026
20 checks passed

coderabbitai Bot mentioned this pull request Jul 26, 2026

fix(frontend): resolve high-severity npm audit vulns reddening Security Scanning (#1510) #1511

Merged

5 tasks

cristim deleted the fix/425-wave19 branch July 27, 2026 11:09

Uh oh!

Conversation

cristim commented May 30, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

cristim commented May 30, 2026

Uh oh!

coderabbitai Bot commented May 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Uh oh!

coderabbitai Bot commented May 30, 2026

Uh oh!

cristim commented Jun 4, 2026

Uh oh!

coderabbitai Bot commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cristim commented Jun 8, 2026

Uh oh!

coderabbitai Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cristim commented Jun 19, 2026

Uh oh!

coderabbitai Bot commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cristim commented Jul 9, 2026

Uh oh!

coderabbitai Bot commented Jul 9, 2026

Rate Limit Exceeded

Uh oh!

cristim commented Jul 10, 2026

Uh oh!

coderabbitai Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cristim commented Jul 17, 2026

Uh oh!

cristim commented Jul 17, 2026

Uh oh!

cristim commented Jul 17, 2026

Uh oh!

cristim commented Jul 17, 2026

Uh oh!

coderabbitai Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

cristim commented May 30, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 30, 2026 •

edited

Loading

coderabbitai Bot commented Jun 4, 2026 •

edited

Loading

coderabbitai Bot commented Jun 8, 2026 •

edited

Loading

coderabbitai Bot commented Jun 19, 2026 •

edited

Loading

coderabbitai Bot commented Jul 10, 2026 •

edited

Loading

coderabbitai Bot commented Jul 17, 2026 •

edited

Loading