fix: enforce runtime dependency audit policy - #1208
Merged
Merged
Conversation
|
Warning Review limit reached
Next review available in: 47 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (62)
📝 WalkthroughWalkthrough경로 인식 의존성 감사 정책 스크립트(scripts/dependency-audit-policy.mts)를 신규 추가하고 CI/릴리스 워크플로우에서 audit:prod 대신 security:audit-policy를 사용하도록 전환했다. pnpm을 11.9.0으로 업그레이드하고 다수 패키지에 devDependencies를 추가했으며, create-croco-app 템플릿의 next/drizzle-orm 버전과 provider-rpc 의존성을 갱신하고 관련 테스트를 업데이트했다. Changes의존성 감사 정책 코어 및 CI/릴리스 연동
Estimated code review effort: 4 (Complex) | ~60 minutes 패키지 매니저 업그레이드, 의존성 추가 및 템플릿 갱신
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant CI as CI Workflow
participant Release as Release Workflow
participant Script as security:audit-policy
participant Policy as dependency-audit-policy.mts
participant Report as ci-reports/security
CI->>Script: pnpm security:audit-policy 실행
Release->>Script: pnpm security:audit-policy 실행
Script->>Policy: runDependencyAuditPolicy 호출
Policy->>Policy: pnpm audit 결과 수집/분류
Policy->>Report: 마크다운 리포트 작성
Policy-->>Script: exitCode 반환
Script-->>CI: 성공/실패 상태 보고
Script-->>Release: publish 차단 여부 결정
Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
📊 Benchmark Results✅ All benchmarks passed
Updated: 2026-07-04T04:57:27.244Z · Commit: 13a7b66 |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0ebc3a0c11
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
kang-heewon
force-pushed
the
issue-1188-runtime-audit-policy
branch
from
July 4, 2026 00:26
0ebc3a0 to
35f4eab
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 35f4eab4ce
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
kang-heewon
force-pushed
the
issue-1188-runtime-audit-policy
branch
2 times, most recently
from
July 4, 2026 01:30
0924e00 to
a54fa4a
Compare
kang-heewon
force-pushed
the
issue-1188-runtime-audit-policy
branch
from
July 4, 2026 01:33
a54fa4a to
33ef3f3
Compare
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a54fa4af6f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
kang-heewon
force-pushed
the
issue-1188-runtime-audit-policy
branch
from
July 4, 2026 02:35
33ef3f3 to
546289f
Compare
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
kang-heewon
force-pushed
the
issue-1188-runtime-audit-policy
branch
from
July 4, 2026 02:41
546289f to
33ff1a0
Compare
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
kang-heewon
force-pushed
the
issue-1188-runtime-audit-policy
branch
from
July 4, 2026 02:54
33ff1a0 to
1b1cd4b
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1b1cd4b223
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
kang-heewon
force-pushed
the
issue-1188-runtime-audit-policy
branch
from
July 4, 2026 03:34
1b1cd4b to
f32fd3b
Compare
There was a problem hiding this comment.
Actionable comments posted: 9
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@packages/create-croco-app/templates/addons/web-graphql/apps/web/package.json.hbs`:
- Line 16: The Next dependency in the web GraphQL template was changed from an
exact pin to a caret range, so verify whether this template should keep
reproducible builds; if so, update the package.json.hbs entry in the web addon
template to use the same exact versioning pattern as before. Check the
dependency declaration for next in the template and keep it consistent with the
intended versioning strategy used by the other addon templates.
In `@packages/customer-health-drizzle/package.json`:
- Around line 42-43: `customer-health-drizzle`의 package.json에서
`reflect-metadata` 버전 표기가 레포 내 다른 패키지들과 불일치합니다. 이 패키지군의 기존 규칙에 맞춰
`drizzle-orm`처럼 버전 표기를 하나로 통일하고, `reflect-metadata`도 동일한 방식으로 맞추세요.
`package.json`의 dependencies 항목에서 해당 두 의존성 표기를 확인해 일관되게 수정하면 됩니다.
In `@packages/protocols-trpc/package.json`:
- Around line 43-44: `reflect-metadata` version is inconsistent across packages,
which can cause mismatched metadata behavior for typedi and other
reflection-based code. Update the dependency entry in the package manifest here
to use the same version range as the rest of the monorepo, and make sure any
related package manifests that reference `reflect-metadata` (including the
workflow-core package) are aligned to one shared version. Use the
`reflect-metadata` dependency entry as the anchor for the change.
In
`@packages/transports-cloudflare-workers/src/tests/PublishedWorkerTypes.spec.ts`:
- Around line 167-180: Duplicate external dependency entries are overwriting the
first valid local install path in the PublishedWorkerTypes.spec test setup. In
the loop that builds externalDependencies, update the logic so
installedPackage.packageDir is only recorded if that dependencyName has not
already been seen, or otherwise prefer the packageDir whose
installedDependencyDir actually exists on disk. Keep the existing
sorting/iteration over externalDependencies, but ensure the source directory
resolution in installedDependencyDir uses a preserved valid path instead of the
last package to declare the dependency.
In `@scripts/dependency-audit-policy.mts`:
- Around line 230-243: The pnpm subprocess calls can hang indefinitely because
`spawnSync` is used without a timeout. Add a bounded `timeout` to both
`runPnpmAudit` and `runGeneratedTemplateAudit` so `pnpm audit` and `pnpm install
--lockfile-only` fail fast under registry/network delays, and handle the
timeout/error path consistently with the existing `result.error` and stderr
reporting.
- Around line 498-519: `readConfiguredSuppressions` is scanning only the
`packages` workspace, so `examples/*/package.json` suppressions are missed while
`readWorkspaceManifests` already includes both workspace roots. Update
`readConfiguredSuppressions` to also traverse the `examples` directory (using
the same manifest discovery approach as
`readWorkspaceManifests`/`findPackageJsonFiles`), and merge those results into
the suppression scan so `pnpm.auditConfig` entries under examples are detected
as dead policy state.
- Around line 755-768: The readWorkspaceSuppressions helper currently scans
pnpm-workspace.yaml with a global regex, so it can pick up GHSA/CVE entries
outside the intended auditConfig scope. Update readWorkspaceSuppressions in
dependency-audit-policy.mts to parse the YAML structure and extract only
pnpm.auditConfig.ignoreGhsas and pnpm.auditConfig.ignoreCves values, instead of
matching all text. Keep the existing ConfiguredSuppression shape and source
mapping, but ensure the logic is scoped to the actual keys so unrelated lists or
comments do not produce suppressions.
- Around line 163-267: The script currently throws generic Error instances in
parseArgs, runPnpmAudit, parseAuditJson, and runGeneratedTemplateAudit instead
of using a Problem subclass. Add or import a dedicated Problem type for this CLI
(for example DependencyAuditPolicyProblem) and replace every throw new Error
path with that subclass, keeping the same messages and labels so all failures in
the dependency-audit-policy flow follow the project convention.
In `@scripts/tests/dependency-audit-policy.spec.ts`:
- Around line 430-450: The advisory() test fixture only generates dependency
paths without version suffixes, so it can’t catch regressions in
parseAuditPath/dependencyFieldFor handling real pnpm audit paths. Update the
dependency-audit-policy.spec.ts fixtures to include at least one advisory case
whose path includes an `@version` suffix on the final segment, and make sure the
existing test assertions cover that path shape through advisory() and the
related audit-path parsing behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 7b292062-fdde-4843-accf-9a0ca1401cf0
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (51)
.changeset/c4d7fa0c.md.github/workflows/ci.yml.github/workflows/release.yml.gitignorepackage.jsonpackages/admin-generated/package.jsonpackages/analytics-posthog/src/tests/Integration.spec.tspackages/audit-drizzle/package.jsonpackages/cli/src/tests/doctor.spec.tspackages/cli/src/tests/projectMap.spec.tspackages/create-croco-app/src/tests/e2e-generation.spec.tspackages/create-croco-app/src/tests/generator-install.spec.tspackages/create-croco-app/src/tests/templates-build.spec.tspackages/create-croco-app/templates/addons/graphql-nextjs/apps/web/package.json.hbspackages/create-croco-app/templates/addons/trpc-nextjs/apps/web/package.json.hbspackages/create-croco-app/templates/addons/web-graphql/apps/web/package.json.hbspackages/create-croco-app/templates/addons/web-meta-vite-fullstack/api-worker/package.json.hbspackages/create-croco-app/templates/addons/web-meta-vite-fullstack/api-worker/src/index.tspackages/create-croco-app/templates/addons/web-meta-vite-fullstack/api-worker/tsconfig.json.hbspackages/create-croco-app/templates/addons/web-trpc/apps/web/package.json.hbspackages/create-croco-app/templates/admin-console/package.json.hbspackages/create-croco-app/templates/ai-saas/package.json.hbspackages/create-croco-app/templates/base-ddd/libs/shared/provider-database/package.json.hbspackages/create-croco-app/templates/blank/package.json.hbspackages/create-croco-app/templates/saas/libs/shared/provider-rpc/package.json.hbspackages/create-croco-app/templates/saas/package.json.hbspackages/create-croco-app/templates/spa-be-split/libs/shared/provider-rpc/package.json.hbspackages/create-croco-app/templates/spa-be-split/package.json.hbspackages/create-croco-app/test-fixtures/templates/container-fullstack/package.json.hbspackages/create-croco-app/test-fixtures/templates/ssr-lambda/package.json.hbspackages/customer-health-drizzle/package.jsonpackages/entitlements-drizzle/package.jsonpackages/framework-context/package.jsonpackages/meta-vite/package.jsonpackages/migration-runner/package.jsonpackages/protocols-graphql/vitest.config.tspackages/protocols-trpc/package.jsonpackages/search-core/package.jsonpackages/telemetry-api/package.jsonpackages/transports-cloudflare-workers/package.jsonpackages/transports-cloudflare-workers/src/tests/PublishedWorkerTypes.spec.tspackages/workflow-core/package.jsonpnpm-workspace.yamlscripts/dependency-audit-policy.mtsscripts/package-entrypoint-smoke.mtsscripts/security-allowlist-metadata.jsonscripts/tests/ci-workflow.spec.tsscripts/tests/dependency-audit-policy.spec.tsscripts/tests/package-bin-smoke.spec.tsscripts/tests/package-entrypoint-smoke.spec.tsscripts/tests/release-workflow.spec.ts
kang-heewon
force-pushed
the
issue-1188-runtime-audit-policy
branch
from
July 4, 2026 04:31
f32fd3b to
6e548b6
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6e548b61e3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
kang-heewon
force-pushed
the
issue-1188-runtime-audit-policy
branch
from
July 4, 2026 04:49
6e548b6 to
0335245
Compare
kang-heewon
dismissed
coderabbitai[bot]’s stale review
July 4, 2026 05:22
Addressed CodeRabbit findings on the current head; latest CodeRabbit review could not run because prepaid credits are exhausted.
This was referenced Jul 11, 2026
This was referenced Jul 21, 2026
This was referenced Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1188.
Summary
pnpm audit --audit-level high --jsonoutput and classifies findings by workspace manifest edge instead of pnpm's production flag alone.package.json#pnpm.auditConfigGHSA suppression.Verification
COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm exec vitest run scripts/tests/dependency-audit-policy.spec.ts scripts/tests/ci-workflow.spec.ts scripts/tests/release-workflow.spec.ts --config vitest.config.ts- passed, 28 tests.COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm security:audit-policy- passed, wroteci-reports/security/dependency-audit-policy.mdwith 0 blocking findings.COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm check- passed.COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm typecheck- passed, 224 Turbo tasks successful.COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm test- passed, 225 Turbo tasks successful.COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm build- passed, 113 Turbo tasks successful.COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm changeset-required:check -- --base origin/trunk --head HEAD- passed, no publishable package behavior changes detected.git diff --checkandgit diff --cached --check- passed.Self-review gates
Review and QA
Notes
pnpm installprompt; the equivalent check, typecheck, test, build, policy, changeset, and diff gates above were run explicitly before PR creation.Summary by CodeRabbit
New Features
Bug Fixes