chore: update and pin all dependencies by NicolasRitouet · Pull Request #5 · keywaysh/keyway

NicolasRitouet · 2026-03-25T03:17:32Z

Summary

Update all TS and Go dependencies to latest within current semver ranges
Pin all dependency versions (remove ^ and ~ prefixes) to mitigate supply chain attacks
Remove NODE_ENV=production from .env and .env.example to fix Next.js warning during make dev

What changed

Root: prettier, turbo
Backend: fastify, drizzle-kit, sentry, stripe, pino, zod, eslint, vitest, typescript, and more
Dashboard: next, tailwindcss, radix-ui, react-query, sentry, zod, vitest, typescript, and more
MCP: mcp-sdk, eslint, vitest, typescript, and more
Docs: docusaurus, mdx, prism-react-renderer
CLI (Go): cobra, charmbracelet/huh, posthog-go, and transitive deps
Crypto (Go): grpc, protobuf, and transitive deps

Test plan

pnpm build passes (all 4 TS packages)
pnpm test passes (923 backend + 790 dashboard + MCP tests)
go build passes (CLI + crypto)
go test passes (735 CLI + 133 crypto)
Manual smoke test with make dev

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores

Updated development and runtime dependencies to newer versions across all packages
Pinned dependency versions for consistent and reproducible builds
Upgraded toolchain versions (Go 1.24.0 → 1.25.0)
Refined environment variable configuration guidance for framework integration

vercel · 2026-03-25T03:17:37Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
keyway-dashboard	Ready	Preview, Comment	Mar 25, 2026 4:29am

coderabbitai · 2026-03-25T03:17:49Z

Warning

Rate limit exceeded

@NicolasRitouet has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 24 minutes and 6 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1c4c9500-5826-4dea-a097-534b434d0c2a

📥 Commits

Reviewing files that changed from the base of the PR and between 10230a8 and c0450d5.

⛔ Files ignored due to path filters (3)

packages/cli/go.sum is excluded by !**/*.sum
packages/crypto/go.sum is excluded by !**/*.sum
pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (12)

.env.example
.github/workflows/ci-cli.yml
.github/workflows/ci-crypto.yml
package.json
packages/backend/package.json
packages/cli/.golangci.yml
packages/cli/go.mod
packages/cli/internal/cmd/set.go
packages/crypto/go.mod
packages/dashboard/package.json
packages/docs/package.json
packages/mcp/package.json

📝 Walkthrough

Walkthrough

The PR systematically pins dependency versions across the monorepo by replacing flexible version ranges with fixed versions. It updates development tools (prettier, turbo) at the root level, upgrades runtime and dev dependencies in backend and frontend packages, updates Go from 1.24.0 to 1.25.0, and removes the default NODE_ENV from .env.example with added clarification about framework behavior.

Changes

Cohort / File(s)	Summary
Environment Configuration `.env.example`	Removed default `NODE_ENV=production` value and added comments explaining that frameworks auto-set this variable; instructs not to set it in the file to avoid conflicts with `make dev`.
Root Dependencies `package.json`	Updated dev dependencies: `prettier` (`^3.7.4` → `3.8.1`) and `turbo` (`^2.5.4` → `2.8.20`) pinned to exact versions.
Backend Runtime & Dev Dependencies `packages/backend/package.json`	Pinned exact versions for runtime packages (`@fastify/`, `@grpc/`, `@sentry/node`, `dotenv`, `fastify`, `pino`, `postgres`, `posthog-node`, `resend`, `stripe`, `zod`) and dev packages (`@eslint/js`, `@types/node`, `@vitest/coverage-v8`, `drizzle-kit`, `eslint`, `typescript`, etc.), replacing caret ranges.
Dashboard Frontend Dependencies `packages/dashboard/package.json`	Pinned exact versions across dependencies (`@sentry/nextjs`, `@tailwindcss/forms`, `@tanstack/react-query`, `next`, `tailwind-merge`, `zod`) and devDependencies (`@tailwindcss/postcss`, `@types/react*`, `@vitejs/plugin-react`, `autoprefixer`, `postcss`, `tailwindcss`, `typescript`, `vitest`), replacing range specifiers.
Documentation & MCP Dependencies `packages/docs/package.json`, `packages/mcp/package.json`	Pinned exact versions for Docusaurus/MDX packages, React, and toolchain dependencies (`@modelcontextprotocol/sdk`, `@eslint/js`, `@types/node`, `prettier`, `typescript`, `typescript-eslint`), removing caret ranges.
CLI & Crypto Go Modules `packages/cli/go.mod`, `packages/crypto/go.mod`	Upgraded Go toolchain version from `1.24.0` to `1.25.0` and pinned direct dependencies (`charmbracelet/`, `google.golang.org/grpc`, `google.golang.org/protobuf`, `spf13/cobra`, `golang.org/x/`) to specific versions; refreshed indirect dependencies accordingly.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

🐰 Dependencies dance in pinned-down rows,
No more the caret's flexible throes,
From 1.24 to 1.25 we spring,
Exact versions make the whole thing sing,
Locked and loaded, stable and bright! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore: update and pin all dependencies' accurately and concisely summarizes the primary change—updating and pinning dependency versions across the entire project.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/pin-dependencies

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.env.example:
- Around line 169-170: Update the NODE_ENV comment to avoid implying frameworks
set it automatically: state that the backend determines NODE_ENV via its config
parsing (so do not override it in local .env), and add a clear warning not to
set NODE_ENV=production when running development with make dev; reference the
NODE_ENV variable and the local .env usage so maintainers understand what to
avoid.

In `@packages/dashboard/package.json`:
- Around line 36-39: Update the React stack to the recommended version by
changing the "react" and "react-dom" dependencies in package.json from "18.3.1"
to the React 19 release (e.g., "19.x.x"); ensure compatibility with "next"
(Next.js 15) by also verifying any peerDependencies or related packages like
"next-themes" still work with React 19 and run the project's install and test
scripts to catch any breaking changes before merging.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: cfe46af6-fdf9-4dcd-b7d6-1ec00406f65d

📥 Commits

Reviewing files that changed from the base of the PR and between 63cb2d8 and 10230a8.

⛔ Files ignored due to path filters (3)

packages/cli/go.sum is excluded by !**/*.sum
packages/crypto/go.sum is excluded by !**/*.sum
pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (8)

.env.example
package.json
packages/backend/package.json
packages/cli/go.mod
packages/crypto/go.mod
packages/dashboard/package.json
packages/docs/package.json
packages/mcp/package.json

coderabbitai · 2026-03-25T03:23:06Z

+    "next": "15.5.14",
+    "next-themes": "0.4.6",
+    "react": "18.3.1",
+    "react-dom": "18.3.1",


⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

For Next.js 15.5.x App Router projects, what is the official support/recommendation status of React 18.3.x vs React 19.x?

💡 Result:

For Next.js 15.5.x App Router projects, React 19.x is the official recommendation and stable support, while React 18.3.x is supported via peer dependency compatibility (e.g., "^18.2.0 || ^19.0.0") but not the primary recommendation for App Router, which aligns with React 19 features. Upgrade instructions emphasize installing react@latest (React 19.x).

Citations:

1: Can React 18 be used with Next.js version 15? vercel/next.js#72795

2: https://nextjs.org/blog/next-15-1

3: https://nextjs.org/docs/app/building-your-application/upgrading/version-15

4: https://nextjs.org/blog/next-15

5: https://nextjs.org/docs/app/guides/upgrading/version-15

6: https://www.npmjs.com/package/next/v/15.0.2

Upgrade React to v19 for optimal Next.js 15 App Router support.

React 19 is the official recommendation for Next.js 15 App Router projects. While React 18.3.1 is supported via peer dependency compatibility, Next.js 15 features align with React 19 and it is the primary supported version moving forward. Consider upgrading to React 19 to follow the recommended stack.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed. In `@packages/dashboard/package.json` around lines 36 - 39, Update the React stack to the recommended version by changing the "react" and "react-dom" dependencies in package.json from "18.3.1" to the React 19 release (e.g., "19.x.x"); ensure compatibility with "next" (Next.js 15) by also verifying any peerDependencies or related packages like "next-themes" still work with React 19 and run the project's install and test scripts to catch any breaking changes before merging.

NicolasRitouet · 2026-03-25T04:04:30Z

Re: React 19 upgrade — Acknowledged, but this is a breaking major version change (new hook semantics, removed APIs, etc.) that doesn't belong in a dependency pinning PR. Will handle in a dedicated PR with proper testing.

Re: NODE_ENV comment — Fixed in 34eb6da.

CI fixes in 34eb6da:

ci-crypto: reads Go version from go.mod instead of hardcoded 1.24
ci-cli: upgraded to golangci-lint-action@v7 + golangci-lint v2.11.4 (Go 1.25 compatible)
golangci.yml: migrated to v2 config format
serialize-javascript: added pnpm override >=7.0.3 to fix GHSA-5c6j-r48x-rmvq

Update all TS and Go dependencies to latest within semver ranges and pin exact versions (remove ^ and ~ prefixes) to mitigate supply chain attacks. Also removes NODE_ENV from .env/.env.example to fix Next.js warning when running `make dev`. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- ci-crypto: read Go version from go.mod instead of hardcoding 1.24 - ci-cli: upgrade golangci-lint-action to v7 with golangci-lint v2.11.4 (v1.64.8 was built with Go 1.24, incompatible with go.mod targeting 1.25) - golangci.yml: migrate config to v2 format (linters-settings → linters.settings) - package.json: add pnpm override for serialize-javascript >= 7.0.3 (fixes GHSA-5c6j-r48x-rmvq RCE via Docusaurus transitive dep) - .env.example: clarify NODE_ENV comment per review feedback Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Move issues.exclude-rules to linters.exclusions.rules per golangci-lint v2 schema requirements. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Add errcheck exclusions for color.Printf, io.ReadCloser.Close, os.File.Close (standard Go patterns, not real bugs) - Fix staticcheck QF1001 in set.go: apply De Morgan's law for readability Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

vercel Bot deployed to Preview March 25, 2026 03:18 View deployment

coderabbitai Bot reviewed Mar 25, 2026

View reviewed changes

NicolasRitouet and others added 2 commits March 25, 2026 05:04

NicolasRitouet force-pushed the chore/pin-dependencies branch from 34eb6da to a8627ef Compare March 25, 2026 04:05

vercel Bot deployed to Preview March 25, 2026 04:06 View deployment

fix(ci): migrate golangci-lint config to v2 format

986b78e

Move issues.exclude-rules to linters.exclusions.rules per golangci-lint v2 schema requirements. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

vercel Bot deployed to Preview March 25, 2026 04:17 View deployment

fix(ci): remove gosimple linter (merged into staticcheck in v2)

21cf4b6

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

vercel Bot deployed to Preview March 25, 2026 04:19 View deployment

vercel Bot deployed to Preview March 25, 2026 04:29 View deployment

NicolasRitouet merged commit 8ccf62c into main Mar 25, 2026
19 checks passed

NicolasRitouet deleted the chore/pin-dependencies branch March 25, 2026 04:32

coderabbitai Bot mentioned this pull request Jun 16, 2026

feat(orgs): live GitHub member roster + role correctness (+ security-audit fixes) #18

Merged

coderabbitai Bot mentioned this pull request Jul 23, 2026

security(deps): patch P0 vulnerabilities (Snyk) #29

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: update and pin all dependencies - #5

chore: update and pin all dependencies#5
NicolasRitouet merged 5 commits into
mainfrom
chore/pin-dependencies

NicolasRitouet commented Mar 25, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented Mar 25, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Mar 25, 2026 •

edited

Loading

Rate limit exceeded

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

coderabbitai Bot Mar 25, 2026

Uh oh!

NicolasRitouet commented Mar 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

NicolasRitouet commented Mar 25, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What changed

Test plan

Summary by CodeRabbit

Chores

Uh oh!

vercel Bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

NicolasRitouet commented Mar 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

NicolasRitouet commented Mar 25, 2026 •

edited by coderabbitai Bot

Loading

vercel Bot commented Mar 25, 2026 •

edited

Loading

coderabbitai Bot commented Mar 25, 2026 •

edited

Loading