chores: upgrade to pnpm 11 and vite 7#4095
Conversation
📝 WalkthroughWalkthroughUpgrades pnpm to v11 across GitHub Actions, adds workspace engine-strict and dependency overrides, updates frontend dev dependencies and packageManager to pnpm@11.1.2, tweaks Makefile pnpm install logic, and makes small route redirect and Svelte UI text edits. Changespnpm 11 Upgrade and Workspace Configuration
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
frontend/package.json (1)
31-31: 💤 Low valueCI pnpm version is unpinned while
packageManagerspecifies an exact version.The workflows install
version: 11(resolves to the latest11.xpatch), butpackageManageris locked topnpm@11.0.8. Any patch bump on the11.xline between lock-file generation and a future CI run could surface subtle differences (e.g., new pnpm 11 behaviour changes). Consider pinning the workflow version to11.0.8(or the exact installed patch) to keep both in sync.Also applies to: 62-62, 86-86
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@frontend/package.json` at line 31, Your CI pnpm installer is unpinned while package.json's packageManager is locked to pnpm@11.0.8; update the GitHub Actions workflow steps that install pnpm (the occurrences referenced at lines 31, 62, 86 in your diff) to pin the exact patch version 11.0.8 (replace version: 11 or similar with 11.0.8 or pnpm@11.0.8) so the CI installer matches packageManager and avoids patch-level drift.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@frontend/package.json`:
- Line 31: Your CI pnpm installer is unpinned while package.json's
packageManager is locked to pnpm@11.0.8; update the GitHub Actions workflow
steps that install pnpm (the occurrences referenced at lines 31, 62, 86 in your
diff) to pin the exact patch version 11.0.8 (replace version: 11 or similar with
11.0.8 or pnpm@11.0.8) so the CI installer matches packageManager and avoids
patch-level drift.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 8f2c43b4-4c00-4c8d-a69b-c642f0fb5e7d
⛔ Files ignored due to path filters (1)
frontend/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (11)
.github/workflows/frontend-coverage.yaml.github/workflows/frontend-linters.yaml.github/workflows/frontend-unit-tests.yml.github/workflows/functional-tests.yml.github/workflows/rpm-build.yml.github/workflows/startup-tests.ymlfrontend/.npmrcfrontend/package.jsonfrontend/pnpm-workspace.yamlfrontend/src/routes/(app)/(internal)/[model=urlmodel]/+page.server.tsfrontend/src/routes/(app)/(internal)/experimental/evidence-multifile/+page.svelte
💤 Files with no reviewable changes (1)
- frontend/.npmrc
There was a problem hiding this comment.
🧹 Nitpick comments (2)
enterprise/frontend/Makefile (1)
22-27: ⚡ Quick winConsider adding defensive validation for
nodeavailability andpackageManagerfield extraction.The
ensure-pnpmtarget depends onnodeto extract the version frompackage.json. While thepackageManagerfield exists and is properly formatted in the current codebase, the script lacks error handling ifnodeis unavailable or if the extraction fails, which could produce cryptic error messages for developers.🛡️ Proposed defensive validation
ensure-pnpm: `@command` -v pnpm >/dev/null 2>&1 || { \ + command -v node >/dev/null 2>&1 || { \ + echo "Error: node is required to extract pnpm version from package.json"; \ + exit 1; \ + }; \ PNPM_VER=$$(node -p "require('$(COMMUNITY_DIR)/package.json').packageManager.split('@')[1]"); \ + if [ -z "$$PNPM_VER" ]; then \ + echo "Error: Could not extract pnpm version from $(COMMUNITY_DIR)/package.json packageManager field"; \ + exit 1; \ + fi; \ echo "pnpm not found, installing pnpm@$$PNPM_VER (pinned in $(COMMUNITY_DIR)/package.json)"; \ npm install -g "pnpm@$$PNPM_VER"; \ }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@enterprise/frontend/Makefile` around lines 22 - 27, The ensure-pnpm Makefile target currently assumes node is present and that node -p "require('$(COMMUNITY_DIR)/package.json').packageManager.split('@')[1]" will always succeed; add defensive checks so the recipe first verifies node exists (use command -v node) and fails with a clear error if not, capture the packageManager extraction into PNPM_VER and verify it is non-empty and matches the expected pattern (contains a version after '@'), and only proceed to echo/install pnpm if PNPM_VER is valid otherwise print a helpful error and exit non-zero; reference ensure-pnpm, PNPM_VER, COMMUNITY_DIR and the packageManager extraction when implementing these checks..github/workflows/startup-tests.yml (1)
84-86: Consider pinning pnpm version to exact11.1.2for consistency across jobs.The workflow correctly uses
pnpm/action-setup@v6, which supports pnpm v11. All four jobs specifyversion: 11, which resolves to the latest v11.x release (currently11.1.2, matching the exact version pinned infrontend/package.json).However,
version: 11will auto-resolve to any future v11.x release. To ensure consistent behavior across community and enterprise jobs, consider pinning to the exact version:version: 11.1.2This eliminates the small risk of version drift if pnpm releases a future
11.2.0or patch, which community jobs (using the action directly) would adopt before enterprise jobs (which invokeensure-pnpmfrom the Makefile).Also applies to: 137-139, 219-222, 290-293
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/startup-tests.yml around lines 84 - 86, The workflow uses pnpm/action-setup@v6 with a floating major version ("version: 11") which can drift; change each "version: 11" occurrence to the exact patch release used in frontend/package.json (e.g., "version: 11.1.2") so all jobs (the four places currently set to version: 11) pin the same pnpm release for deterministic builds and to avoid cross-job/version drift when pnpm publishes 11.x updates.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/startup-tests.yml:
- Around line 84-86: The workflow uses pnpm/action-setup@v6 with a floating
major version ("version: 11") which can drift; change each "version: 11"
occurrence to the exact patch release used in frontend/package.json (e.g.,
"version: 11.1.2") so all jobs (the four places currently set to version: 11)
pin the same pnpm release for deterministic builds and to avoid
cross-job/version drift when pnpm publishes 11.x updates.
In `@enterprise/frontend/Makefile`:
- Around line 22-27: The ensure-pnpm Makefile target currently assumes node is
present and that node -p
"require('$(COMMUNITY_DIR)/package.json').packageManager.split('@')[1]" will
always succeed; add defensive checks so the recipe first verifies node exists
(use command -v node) and fails with a clear error if not, capture the
packageManager extraction into PNPM_VER and verify it is non-empty and matches
the expected pattern (contains a version after '@'), and only proceed to
echo/install pnpm if PNPM_VER is valid otherwise print a helpful error and exit
non-zero; reference ensure-pnpm, PNPM_VER, COMMUNITY_DIR and the packageManager
extraction when implementing these checks.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: ec298704-043f-44eb-8a21-befbe1c8a6f2
⛔ Files ignored due to path filters (1)
frontend/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (5)
.github/workflows/functional-tests.yml.github/workflows/startup-tests.ymlenterprise/frontend/Makefilefrontend/package.jsonfrontend/pnpm-workspace.yaml
🚧 Files skipped from review as they are similar to previous changes (3)
- frontend/package.json
- frontend/pnpm-workspace.yaml
- .github/workflows/functional-tests.yml
1 participant
Summary by CodeRabbit
Chores
Bug Fixes
Documentation