refactor: Bump otpauth from 9.4.0 to 9.5.0#10423
refactor: Bump otpauth from 9.4.0 to 9.5.0#10423mtrezza merged 1 commit intoparse-community:alphafrom
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code. |
📝 WalkthroughWalkthroughUpdated the Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes 🚥 Pre-merge checks | ✅ 5 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Checkov (3.2.513)package.json2026-04-10 19:55:22,125 [MainThread ] [ERROR] Template file not found: package.json ... [truncated 2547 characters] ... ck__) Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@package-lock.json`:
- Around line 3542-3547: The CI workflows release-manual-docs.yml and
release-prepare-monthly.yml pin Node 18.20.4 which is incompatible with the
transitive package `@noble/hashes` (engine >=20.19.0); update their GitHub Actions
setup-node steps to use Node 20.19.0 or a newer supported LTS (e.g., change
node-version / node-version-file/matrix entries in those workflows to "20.19.0"
or higher) so the actions run with a Node version that satisfies the declared
engines and prevents install failures.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 39e11093-6c9d-4d9f-98f1-605cfd09e8fa
📒 Files selected for processing (2)
package-lock.jsonpackage.json
| "version": "2.0.1", | ||
| "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-2.0.1.tgz", | ||
| "integrity": "sha512-XlOlEbQcE9fmuXxrVTXCTlG2nlRXa9Rj3rr5Ue/+tX+nmkgbX720YHh0VR3hBF9xDvwnb8D2shVGOwNx+ulArw==", | ||
| "license": "MIT", | ||
| "engines": { | ||
| "node": "^14.21.3 || >=16" | ||
| "node": ">= 20.19.0" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== package.json engines =="
cat package.json | jq '.engines // "no engines field"'
echo
echo "== package-lock root package engines (if present) =="
cat package-lock.json | jq '.packages[""].engines // "no root lockfile engines field"'
echo
echo "== Node versions pinned in workflows =="
fd -i '.yml' .github/workflows -x sh -c '
f="$1"
echo "-- $f"
rg -n "node-version|NODE_VERSION|setup-node|matrix" "$f" -C 2 || true
' sh {}
echo
echo "== Verify transitive engine floor in lockfile =="
cat package-lock.json | jq -r '.packages["node_modules/@noble/hashes"].engines.node'Repository: parse-community/parse-server
Length of output: 8956
Update workflows to use Node versions compatible with declared engines.
The @noble/hashes@2.0.1 engine requirement (>= 20.19.0) aligns with the repo's declared minimum. However, release-manual-docs.yml and release-prepare-monthly.yml still pin Node 18.20.4, which is incompatible with both the declared engines (>=20.19.0) and the transitive dependency. Update these workflows to use a supported Node version (20.19.0 or newer) to prevent installation failures and ensure consistency with declared engines.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@package-lock.json` around lines 3542 - 3547, The CI workflows
release-manual-docs.yml and release-prepare-monthly.yml pin Node 18.20.4 which
is incompatible with the transitive package `@noble/hashes` (engine >=20.19.0);
update their GitHub Actions setup-node steps to use Node 20.19.0 or a newer
supported LTS (e.g., change node-version / node-version-file/matrix entries in
those workflows to "20.19.0" or higher) so the actions run with a Node version
that satisfies the declared engines and prevents install failures.
There was a problem hiding this comment.
The Node 18.20.4 pins in release-automated.yml and release-manual-docs.yml are pre-existing on the alpha branch and not introduced by this PR. This PR only modifies package.json and package-lock.json for the otpauth bump. The workflow Node version pins are a separate concern to be addressed in a dedicated PR.
There was a problem hiding this comment.
@mtrezza, understood — the workflow Node version pins are pre-existing and out of scope for this PR. Would you like me to open a follow-up GitHub issue to track updating the Node version pins in release-automated.yml and release-manual-docs.yml to a version compatible with @noble/hashes@2.0.1 (>= 20.19.0)?
🧠 Learnings used
Learnt from: mtrezza
Repo: parse-community/parse-server PR: 0
File: :0-0
Timestamp: 2025-12-02T08:00:20.138Z
Learning: For Parse Server 9 release (PR `#9938` and related), the parse/push-adapter dependency must be upgraded to version >= 8.0.0, not 7.0.0. Version 8.x drops support for Node 18.
Learnt from: mtrezza
Repo: parse-community/parse-server PR: 0
File: :0-0
Timestamp: 2025-12-02T08:00:08.440Z
Learning: For Parse Server 9 release preparation, the parse/push-adapter dependency should be upgraded to version >= 8.0.0, not 7.x, as version 8.x is required despite dropping Node 18 support (which aligns with Parse Server 9's removal of EOL Node versions).
Learnt from: mtrezza
Repo: parse-community/parse-server PR: 10082
File: package.json:3-3
Timestamp: 2026-02-28T15:22:57.025Z
Learning: In the parse-community/parse-server repository, manual changes to the npm package version in package.json should never be approved. The package version is managed and bumped automatically by semantic-release during the release workflow.
Learnt from: mtrezza
Repo: parse-community/parse-server PR: 0
File: :0-0
Timestamp: 2025-12-02T06:55:53.808Z
Learning: When reviewing Parse Server PRs that add or modify Parse Server options, always verify that changes are properly reflected in three files: src/Options/index.js (where changes originate), src/Options/Definitions.js, and src/Options/docs.js. The correct workflow is: make changes in index.js first, then run `npm run definitions` to automatically replicate the changes to Definitions.js and docs.js.
mtrezza
dismissed
coderabbitai[bot]’s stale review
The flagged Node 18 workflow pins are pre-existing on the alpha branch and not introduced by this PR. The concern is valid but out-of-scope for this dependency bump.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## alpha #10423 +/- ##
=======================================
Coverage 92.49% 92.49%
=======================================
Files 192 192
Lines 16786 16786
Branches 234 234
=======================================
Hits 15527 15527
Misses 1236 1236
Partials 23 23 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
1 participant
Closes #10403
Changes
TOTP,Secret.fromBase32,totp.validate) are unchangedBreaking Changes
Code Changes Required
Summary by CodeRabbit
otpauthdependency to version 9.5.0 and corresponding transitive dependencies.