chore(deps): upgrade @posthog/next + restore lockfile platform binaries#940
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthroughThe ChangesPostHog Next Dependency Update
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
packages/cloud/src/workflows.ts (1)
988-1014:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winValidate
workflowStorage.backendbefore choosing the upload path.
isCloudApiWorkflowStorage()trustsprepared.workflowStorage?.backend, butisPrepareWorkflowResponse()never validates that field. If the prepare payload drifts or is malformed, this will silently fall back to the S3 branch instead of failing fast on an invalid response.Suggested fix
function isPrepareWorkflowResponse(payload: unknown): payload is PrepareWorkflowResponse { if (!payload || typeof payload !== 'object' || Array.isArray(payload)) { return false; } const record = payload as Record<string, unknown>; const s3Creds = record.s3Credentials; if (!s3Creds || typeof s3Creds !== 'object' || Array.isArray(s3Creds)) { return false; } const creds = s3Creds as Record<string, unknown>; + const workflowStorage = record.workflowStorage; + const hasValidWorkflowStorage = + workflowStorage === undefined || + (workflowStorage && + typeof workflowStorage === 'object' && + !Array.isArray(workflowStorage) && + (((workflowStorage as { backend?: unknown }).backend === undefined) || + (workflowStorage as { backend?: unknown }).backend === 's3' || + (workflowStorage as { backend?: unknown }).backend === 'cloud-api')); return ( typeof record.runId === 'string' && typeof record.s3CodeKey === 'string' && typeof creds.accessKeyId === 'string' && typeof creds.secretAccessKey === 'string' && typeof creds.sessionToken === 'string' && typeof creds.bucket === 'string' && typeof creds.prefix === 'string' && - (creds.backend === undefined || creds.backend === 's3' || creds.backend === 'cloud-api') + (creds.backend === undefined || creds.backend === 's3' || creds.backend === 'cloud-api') && + hasValidWorkflowStorage ); }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/cloud/src/workflows.ts` around lines 988 - 1014, The type guard isPrepareWorkflowResponse must also validate prepared.workflowStorage.backend so callers like isCloudApiWorkflowStorage don't rely on an unchecked field; update isPrepareWorkflowResponse to check that if workflowStorage exists and is an object then workflowStorage.backend is either undefined, 's3', or 'cloud-api' (mirroring the check for s3Credentials.backend) and any other required workflowStorage shape you expect, and then keep isCloudApiWorkflowStorage using prepared.workflowStorage?.backend === 'cloud-api' || prepared.s3Credentials.backend === 'cloud-api' so it only runs against validated values.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CHANGELOG.md`:
- Line 109: Rewrite the changelog bullet for the agent-relay change to be
impact-first and drop PR references: replace "- **Add --broker-name override to
`agent-relay up` (`#939`)** (`#939`)" with a concise user-facing statement like
"agent-relay up: add --broker-name to override the broker name" (no PR number),
and apply the same transformation to the other nearby bullets that include
PR/issue IDs (the other entries that list PR numbers), ensuring each line is a
single short, impact-focused sentence describing the shipped behavior.
---
Outside diff comments:
In `@packages/cloud/src/workflows.ts`:
- Around line 988-1014: The type guard isPrepareWorkflowResponse must also
validate prepared.workflowStorage.backend so callers like
isCloudApiWorkflowStorage don't rely on an unchecked field; update
isPrepareWorkflowResponse to check that if workflowStorage exists and is an
object then workflowStorage.backend is either undefined, 's3', or 'cloud-api'
(mirroring the check for s3Credentials.backend) and any other required
workflowStorage shape you expect, and then keep isCloudApiWorkflowStorage using
prepared.workflowStorage?.backend === 'cloud-api' ||
prepared.s3Credentials.backend === 'cloud-api' so it only runs against validated
values.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 102555d8-1f97-41cd-9280-bc687a5be100
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (37)
CHANGELOG.mdpackage.jsonpackages/acp-bridge/package.jsonpackages/agent/package.jsonpackages/brand/package.jsonpackages/broker-darwin-arm64/package.jsonpackages/broker-darwin-x64/package.jsonpackages/broker-linux-arm64/package.jsonpackages/broker-linux-x64/package.jsonpackages/broker-win32-x64/package.jsonpackages/browser-primitive/package.jsonpackages/cloud/package.jsonpackages/cloud/src/workflows.test.tspackages/cloud/src/workflows.tspackages/config/package.jsonpackages/credential-proxy/package.jsonpackages/events/package.jsonpackages/gateway/package.jsonpackages/github-primitive/package.jsonpackages/hooks/package.jsonpackages/memory/package.jsonpackages/openclaw/package.jsonpackages/personas/package.jsonpackages/policy/package.jsonpackages/sdk-py/pyproject.tomlpackages/sdk/package.jsonpackages/slack-primitive/package.jsonpackages/telemetry/package.jsonpackages/trajectory/package.jsonpackages/user-directory/package.jsonpackages/utils/package.jsonpackages/workflow-types/package.jsonsrc/cli/commands/core.test.tssrc/cli/commands/core.tssrc/cli/lib/broker-lifecycle.tssrc/cli/lib/client-factory.tsweb/package.json
|
|
||
| ### Product Perspective | ||
| #### User-Facing Features & Improvements | ||
| - **Add --broker-name override to `agent-relay up` (#939)** (#939) |
There was a problem hiding this comment.
Make these release bullets impact-first and remove PR references.
These entries currently include PR IDs and don’t clearly state the practical shipped effect per command/API.
✍️ Suggested rewrite
- - **Add --broker-name override to `agent-relay up` (`#939`)** (`#939`)
+ - `agent-relay up --broker-name` lets users target a non-default broker identity at startup.
- - **Upload workflow code through cloud storage API (`#938`)** (`#938`)
- - **Pass env vars to scheduled workflows (`#935`)** (`#935`)
+ - `@agent-relay/cloud` workflow uploads can use the cloud storage API backend for code object upload.
+ - Scheduled workflows now receive configured environment variables at runtime.As per coding guidelines, "Changelog entries should be concise and impact-first, with one short bullet per user-visible change... Drop issue/PR links..."
Also applies to: 121-122
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@CHANGELOG.md` at line 109, Rewrite the changelog bullet for the agent-relay
change to be impact-first and drop PR references: replace "- **Add --broker-name
override to `agent-relay up` (`#939`)** (`#939`)" with a concise user-facing
statement like "agent-relay up: add --broker-name to override the broker name"
(no PR number), and apply the same transformation to the other nearby bullets
that include PR/issue IDs (the other entries that list PR numbers), ensuring
each line is a single short, impact-focused sentence describing the shipped
behavior.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 17da570fd1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| typeof creds.prefix === 'string' && | ||
| (creds.backend === undefined || creds.backend === 's3' || creds.backend === 'cloud-api') |
There was a problem hiding this comment.
When workflowStorage.backend is cloud-api, this validator still requires the full legacy S3 credential shape (accessKeyId/secretAccessKey/sessionToken/bucket/prefix) before runWorkflow proceeds. If the prepare endpoint returns cloud-storage mode without S3 creds (a common hardening pattern once uploads move behind API endpoints), the client throws Workflow prepare response was not valid JSON. and never attempts the API upload path. The cloud-api branch should validate a cloud-api-specific payload instead of enforcing S3 fields unconditionally.
Useful? React with 👍 / 👎.
willwashburn
force-pushed
the
chore/upgrade-posthog-next
branch
from
17da570 to
3f5f5e9
Compare
Six months stale (0.1.0 from 2026-03-06, 0.4.61 from 2026-05-21). Public API surface used by web (`PostHogProvider`, `postHogMiddleware`, `PostHogPageView`) is unchanged. The scoped override added in #937 holds, so `next` remains pinned to 15.5.18 across the workspace. Also rebuild the lockfile from a known-good pre-#937 base to restore Linux platform binaries (`@tailwindcss/oxide-linux-*`, `@img/sharp-linux-*`) that got stripped when #937's lockfile regen ran on darwin-arm64 — npm bug #4828. Without these entries, `npm ci` on CI's Linux runners fails to install the native bindings and `next build` errors with "Cannot find native binding" from @tailwindcss/oxide. Verified locally: `npm ci` produces a single `next@15.5.18` plus all platform binaries for darwin/linux/win32, and `cd web && npx next build` succeeds (75 static pages, typecheck clean). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
willwashburn
force-pushed
the
chore/upgrade-posthog-next
branch
from
3f5f5e9 to
866d36d
Compare
willwashburn
changed the title
1 participant
Summary
Two changes, both about unblocking the web build:
@posthog/nextfrom^0.1.0to^0.4.61— 0.1.0 was the package's initial release (2026-03-06), six months stale. 60+ patch versions of fixes since. The public API surface we use (PostHogProvider,postHogMiddleware,PostHogPageView) is unchanged.@tailwindcss/oxide-linux-*,@img/sharp-linux-*) frompackage-lock.json. Without those entries,npm cion CI's Linux runners can't install the native bindings, andnext builderrors with:Deploy Web (SST)workflow onmain(run 26251818073).Verification
@tailwindcss/oxide-linux-*entries and 8@img/sharp-linux-*entriesnexttarball entry (15.5.18) — scoped override still effectivenpm ci && cd web && npx next buildsucceeds locally (75 static pages, typecheck clean)Preview Web (SST)green on this PRDeploy Web (SST)green on merge to mainWhy bundle both fixes
Splitting would mean a hotfix PR for the lockfile, then this one rebased on it. Same lockfile churn either way, and main deploys are broken right now — getting both through one review is faster. The
@posthog/nextbump is independently safe; the lockfile diff is large but mechanical (it's a regen, not a hand-edit).🤖 Generated with Claude Code