chore(release): bump package versions#167
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
|
Warning Review limit reached
Your plan currently allows 1 review/hour. Refill in 44 minutes and 44 seconds. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more review capacity refills, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis PR coordinates a dual-package release with security updates and test infrastructure improvements. Version bumps (core 0.7.0, jose 0.6.0) are accompanied by manifest and changelog updates. The secret entropy minimum is reduced from 254 to 128 bits with test coverage. Core's vitest config consolidates on jose's crypto helpers instead of Node's crypto module. Sign-in tests are updated with explicit trusted origins configuration, and identity tests gain environment cleanup between test cases. ChangesRelease and Infrastructure Coordination
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
packages/core/package.json (1)
28-28: 💤 Low valueConsider aligning registry URL format across packages.
The
publishConfig.registryinpackages/core/package.jsonincludes the full package path (https://registry.npmjs.org/@aura-stack/auth), whilepackages/jose/package.json(line 28) was updated to use only the base URL (https://registry.npmjs.org/).The base URL format is the standard convention for
publishConfig.registry. Consider updating this value for consistency.📝 Suggested alignment
"publishConfig": { "access": "public", - "registry": "https://registry.npmjs.org/@aura-stack/auth" + "registry": "https://registry.npmjs.org/" },🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/core/package.json` at line 28, The publishConfig.registry value currently contains the full package-scoped URL ("https://registry.npmjs.org/@aura-stack/auth"); update the publishConfig.registry entry in packages' package.json (the publishConfig.registry key) to the base registry URL "https://registry.npmjs.org/" to match the format used in other packages (e.g., packages/jose) for consistency.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/core/package.json`:
- Line 19: The clean:cts npm script currently runs "find dist -type f -name
\"*.cts\" -delete" which errors if dist/ is missing; change the "clean:cts"
script so it first checks for the existence of dist (e.g., using a shell guard
like test -d dist && ...) or redirects/ignores errors (e.g., append 2>/dev/null
|| true) so the command becomes a no-op when dist/ does not exist; update the
"clean:cts" entry in package.json accordingly.
In `@packages/jose/package.json`:
- Line 19: Update the package.json "clean:cts" npm script so it no longer fails
when dist/ is missing: modify the "clean:cts" script (the script key named
clean:cts) to guard for the directory existence (e.g., wrap in if [ -d dist ];
then ...; fi) or use a safe removal that tolerates missing files (e.g., rm -f
dist/*.cts) so running pnpm clean:cts standalone returns zero even if dist/ is
absent.
In `@packages/jose/src/secret.ts`:
- Line 7: Update the docs and changelog to resolve the mismatch between the
implemented MIN_SECRET_ENTROPY_BITS = 128 (in symbol MIN_SECRET_ENTROPY_BITS
inside packages/jose/src/secret.ts and enforced by assertSecretEntropy) and the
still-documented 254-bit minimum in packages/jose/CHANGELOG.md: either change
the changelog entry to state the new enforced 128-bit minimum and add a short
migration note for users who relied on 254-bit validation, or if 254 bits must
remain the policy, revert or update MIN_SECRET_ENTROPY_BITS and
assertSecretEntropy to enforce 254; include a brief security-team
rationale/approval blurb and a breaking-change note explaining the impact on
existing secrets and recommended actions (rotate or re-generate secrets) so
documentation and code are consistent.
In `@packages/jose/test/secret.test.ts`:
- Around line 95-100: The test is incorrectly calling .toString() on the
Uint8Array returned by getRandomBytes(32), causing base64url.encode to operate
on a comma-separated string; update the test to pass the raw bytes to
base64url.encode (i.e., encode the Uint8Array returned by getRandomBytes) so
that createSecret receives a proper base64url-encoded byte string; locate the
test using getRandomBytes, base64url.encode, and createSecret and remove the
.toString() conversion, ensuring the encodedSecret is produced from the
Uint8Array directly.
---
Nitpick comments:
In `@packages/core/package.json`:
- Line 28: The publishConfig.registry value currently contains the full
package-scoped URL ("https://registry.npmjs.org/@aura-stack/auth"); update the
publishConfig.registry entry in packages' package.json (the
publishConfig.registry key) to the base registry URL
"https://registry.npmjs.org/" to match the format used in other packages (e.g.,
packages/jose) for consistency.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: ed4c53f8-42a0-48f4-b507-21fd8a69d788
⛔ Files ignored due to path filters (1)
deno.lockis excluded by!**/*.lock
📒 Files selected for processing (12)
packages/core/CHANGELOG.mdpackages/core/deno.jsonpackages/core/package.jsonpackages/core/test/actions/signIn/signIn.test.tspackages/core/test/api/signIn.test.tspackages/core/test/identity.test.tspackages/core/vitest.config.tspackages/jose/CHANGELOG.mdpackages/jose/deno.jsonpackages/jose/package.jsonpackages/jose/src/secret.tspackages/jose/test/secret.test.ts
1 participant
Description
This pull request publishes new releases of the packages to both npm and JSR registries:
@aura-stack/auth@0.7.0@aura-stack/jose@0.6.0Registries
NPM
JSR
Key changes
@aura-stack/authCryptoKeyPairsupport across jose and core auth #157DribbleOAuth provider #153Click UpOAuth provider #151@aura-stack/joseCryptoKeyPairsupport across jose and core auth #157@coderabbitai pause