WEB-801: Upgrade minor versions of WebApp dependencies - #3237
Conversation
|
Note
|
| Cohort / File(s) | Summary |
|---|---|
Dependency Updates package.json |
Added dependencies: basic-ftp, hono, minimatch, qs, tar. Updated jspdf from ^4.1.0 to ^4.2.0. No script or devDependency edits. |
Estimated code review effort
🎯 2 (Simple) | ⏱️ ~10 minutes
Suggested reviewers
- IOhacker
🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
| Check name | Status | Explanation |
|---|---|---|
| Description Check | ✅ Passed | Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | ✅ Passed | The PR title accurately describes the main change: upgrading minor versions of WebApp dependencies, which aligns with the changeset showing version bumps for multiple packages (basic-ftp, hono, minimatch, qs, tar, jspdf). |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. |
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches
🧪 Generate unit tests (beta)
- Create PR with unit tests
- Post copyable unit tests in a comment
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands and usage tips.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@package.json`:
- Line 63: Remove the listed unused packages from package.json dependencies
(basic-ftp, hono, minimatch, qs, tar): delete their entries, run npm install (or
yarn) to update lockfile, and rebuild; before committing, search the repo for
any imports/usages of "basic-ftp", "hono", "minimatch", "qs", and "tar" to
ensure nothing breaks and run the test suite and a production build to verify no
runtime errors.
ℹ️ Review info
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.jsonand included by**/*
📒 Files selected for processing (1)
package.json
| "@tailwindcss/forms": "^0.5.4", | ||
| "@tinymce/tinymce-angular": "^9.1.1", | ||
| "angular-oauth2-oidc": "^20.0.0", | ||
| "basic-ftp": "^5.2.0", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cd /tmp && find . -name "package.json" -type f 2>/dev/null | head -5Repository: openMF/web-app
Length of output: 40
🏁 Script executed:
# First, let's see the current state of package.json
cat -n package.json | sed -n '60,85p'Repository: openMF/web-app
Length of output: 931
🏁 Script executed:
# Check if git history is available to see the diff
git diff HEAD~1 package.json 2>/dev/null | head -100Repository: openMF/web-app
Length of output: 40
🏁 Script executed:
# Search for imports of the flagged packages
echo "=== Checking for imports of flagged packages ==="
for pkg in "basic-ftp" "hono" "minimatch" "qs" "tar"; do
echo -e "\n--- Searching for imports of '$pkg' ---"
rg -l "$pkg" --type ts --type js --type tsx --type jsx -g '!node_modules' -g '!*.spec.ts' 2>/dev/null || echo "No files found importing $pkg"
doneRepository: openMF/web-app
Length of output: 475
🏁 Script executed:
# Check if package-lock.json exists and what it shows
if [ -f "package-lock.json" ]; then
echo "=== Checking package-lock.json ==="
for pkg in "basic-ftp" "hono" "minimatch" "qs" "tar"; do
if jq -e ".packages[\"node_modules/$pkg\"]" package-lock.json > /dev/null 2>&1; then
echo "$pkg: Found in package-lock.json"
jq -r ".packages[\"node_modules/$pkg\"].version" package-lock.json 2>/dev/null || echo " (version info unavailable)"
else
echo "$pkg: Not found in package-lock.json"
fi
done
else
echo "No package-lock.json found"
fiRepository: openMF/web-app
Length of output: 296
🏁 Script executed:
# Check the structure of the project
ls -la
file_count=$(find src -type f \( -name "*.ts" -o -name "*.js" \) 2>/dev/null | wc -l)
echo "Source files found: $file_count"Repository: openMF/web-app
Length of output: 2962
🏁 Script executed:
# Check if any of the flagged packages are listed as dependencies of other packages
echo "=== Checking if flagged packages are dependencies of other packages ==="
jq -r '.packages | to_entries[] | select(.value.dependencies | keys | any(. == ("basic-ftp" | "hono" | "minimatch" | "qs" | "tar"))) | .key' package-lock.json 2>/dev/null | head -20Repository: openMF/web-app
Length of output: 130
🏁 Script executed:
# Let's check what depends on these packages
for pkg in "basic-ftp" "hono" "minimatch" "qs" "tar"; do
echo -e "\n=== What depends on '$pkg'? ==="
jq -r ".packages[] | select(.dependencies | has(\"$pkg\")) | .name" package-lock.json 2>/dev/null | head -10 || echo "No dependencies found"
doneRepository: openMF/web-app
Length of output: 389
🏁 Script executed:
# Check the "node_modules/*/package.json" dependencies for these packages
# to see if they're being pulled in as transitive dependencies
echo "=== Checking why these packages are in dependencies ==="
jq -r '.packages[""].dependencies | keys[]' package-lock.json | grep -E '(basic-ftp|hono|minimatch|qs|tar)'Repository: openMF/web-app
Length of output: 145
Remove unused dependencies: basic-ftp, hono, minimatch, qs, tar.
These packages are listed in dependencies but are not imported or used anywhere in the codebase. They appear to be backend/Node.js utilities inappropriate for a browser-based Angular frontend:
- basic-ftp: FTP client (server-side only)
- hono: Web server framework (backend, not frontend)
- tar: Archive handling (Node.js utility, no browser support)
- minimatch: Glob matching (typically for build tooling, not runtime)
- qs: Query string parsing (Angular provides built-in alternatives)
Removing these unused dependencies will reduce bundle size and maintenance burden.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@package.json` at line 63, Remove the listed unused packages from package.json
dependencies (basic-ftp, hono, minimatch, qs, tar): delete their entries, run
npm install (or yarn) to update lockfile, and rebuild; before committing, search
the repo for any imports/usages of "basic-ftp", "hono", "minimatch", "qs", and
"tar" to ensure nothing breaks and run the test suite and a production build to
verify no runtime errors.
There was a problem hiding this comment.
@YousufFFFF could you please help me to review this comment, seems that the dependency alert received has some issue and only jspdf is required.
How we can exclude the others dependencies from the update alert?
There was a problem hiding this comment.
Seems like the humans are having a chat. I'll hop back into my burrow for now. If you need me again, just tag @coderabbitai in a new comment, and I'll come hopping out!
There was a problem hiding this comment.
Hi @IOhacker,
After verifying with npm why, these packages are not standalone unused dependencies. They are either:
• Required transitively by Angular CLI and build tooling (pacote, node-gyp, express, webpack-dev-server, etc.)
• Peer dependencies of tooling (@modelcontextprotocol/sdk → hono)
• Or used by dev tooling such as Puppeteer, Cypress, Jest, ESLint
This PR is scoped strictly to minor version upgrades under WEB-801 and does not change the dependency surface.
If needed, we can open a dedicated cleanup PR to review whether some of these should be moved from dependencies to devDependencies, but removal in this PR would risk breaking the toolchain.
Keeping this PR limited to version upgrades ensures minimal risk.
42e003e to
85e6fcb
Compare
| "@tailwindcss/forms": "^0.5.4", | ||
| "@tinymce/tinymce-angular": "^9.1.1", | ||
| "angular-oauth2-oidc": "^20.0.0", | ||
| "basic-ftp": "^5.2.0", |
There was a problem hiding this comment.
@YousufFFFF could you please help me to review this comment, seems that the dependency alert received has some issue and only jspdf is required.
How we can exclude the others dependencies from the update alert?
2 participants
Description
This PR upgrades minor versions of selected WebApp dependencies as requested in WEB-801. The update keeps the project aligned with the latest compatible releases while limiting changes to non-breaking minor updates.
Upgraded dependencies:
No functional changes were introduced.
Verification performed:
Related issues and discussion
#WEB-801
Screenshots, if any
N/A
Checklist
If you have multiple commits please combine them into one commit by squashing them.
Read and understood the contribution guidelines at web-app/.github/CONTRIBUTING.md.
Summary by CodeRabbit