feat(ci): add pnpm audit --prod check
#2204
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| '@cloudflare/workers-types': ^4.20250917.0 | ||
| '@composio/client': 0.1.0-alpha.40 | ||
| ai: 5.0.44 | ||
| ai: 5.0.52 |
There was a problem hiding this comment.
Bug: Catalog version mismatch with pnpm overrides
The catalog defines ai as exact version 5.0.52, but the pnpm overrides use range >=5.0.52. This creates inconsistent version resolution where packages using catalog: get exactly 5.0.52, while transitive dependencies can resolve to newer versions. For vulnerability fixes requiring minimum versions, the catalog should use ^5.0.52 or >=5.0.52 to match the override behavior and allow security patches.
Additional Locations (1)
haxzie
approved these changes
Nov 25, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR:
pnpm audit --prodcheck to test suitecomposio's dev repositoryNote
Adds a production
pnpm auditCI step and enforces upgraded, secure dependency versions via pnpm overrides and lockfile updates (including ai, next, hono, js-yaml, form-data, sharp), with examples and workspace catalog aligned.pnpm audit --prodstep to TS SDK workflow (.github/workflows/ts.test.yml).pnpm.overridesinpackage.jsonto enforce secure versions ofform-data,js-yaml,hono,next,ai, and transitive@mastra/core>ai.ai,@ai-sdk/*,@openrouter/ai-sdk-provider,next(to 16.x),hono(4.10.x),js-yaml(4.1.1),form-data(4.0.5),sharp(0.34.5) and related platform artifacts.pnpm-workspace.yaml) and example apps (ts/examples/*) to align with new versions (e.g.,hono≥4.10.3,@mastra/core^0.24.5).Written by Cursor Bugbot for commit b61bb0c. This will update automatically on new commits. Configure here.