Skip to content

Enforce exact dependency versions#56

Merged
pandeymangg merged 7 commits intomainfrom
codex/exact-dependency-versions
Mar 27, 2026
Merged

Enforce exact dependency versions#56
pandeymangg merged 7 commits intomainfrom
codex/exact-dependency-versions

Conversation

@mattinannt
Copy link
Copy Markdown
Member

@mattinannt mattinannt commented Mar 20, 2026

Summary

  • enforce exact dependency versions across the workspace and pin root overrides
  • make future upgrades save exact versions by default via .npmrc, .ncurc.json, and scripts/check-exact-deps.mjs
  • fix the react-native package lint pipeline, then clean up the resulting source/test lint violations
  • add targeted test coverage and small CI follow-up fixes so lint, build, tests, and coverage all pass

Reviewer Note

  • This PR touches many files mostly because pnpm lint was previously blocked by a broken ESLint setup (packages/react-native/.eslintrc.cjs and a missing @vitest/eslint-plugin). Once that was fixed, the package had many existing lint violations, so one broad cleanup commit updated a lot of files.
  • Most of the churn under packages/react-native/src is lint-driven and mechanical. The main logic changes to review are in src/lib/common/setup.ts, src/lib/common/storage.ts, src/lib/common/event-listeners.ts, and the added/expanded tests.

Suggested Review Order

  1. Dependency policy changes: package.json, .npmrc, apps/playground/.npmrc, .ncurc.json, scripts/check-exact-deps.mjs, pnpm-lock.yaml
  2. Lint pipeline unblock: packages/react-native/.eslintrc.cjs, packages/react-native/package.json
  3. Remaining packages/react-native/src changes, treating most of them as lint cleanup

Verification

  • pnpm install
  • node scripts/check-exact-deps.mjs
  • pnpm lint
  • pnpm --filter @formbricks/react-native build
  • pnpm --filter @formbricks/react-native test
  • pnpm --filter @formbricks/react-native test:coverage

Notes

  • peerDependencies remain ranged intentionally for SDK consumer compatibility
  • local coverage after the added tests: event-listeners.ts 100%, setup.ts 97.22% lines / 88.75% branches

@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Mar 20, 2026

Walkthrough

This pull request introduces infrastructure to enforce exact dependency version pinning across the monorepo. New configuration files (.ncurc.json, .npmrc, apps/playground/.npmrc) are added to control version handling. A new validation script (scripts/check-exact-deps.mjs) recursively checks all package.json files for exact semver specifications in dependencies and pnpm overrides, with configurable exceptions for workspace and file protocols. Existing dependencies and overrides are updated to use exact versions, the lint script is modified to run the validation before linting, and pnpm is upgraded to version 10.32.1.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The title 'Enforce exact dependency versions' is clear, specific, and directly summarizes the main change in the changeset.
Description check ✅ Passed The pull request description is directly related to the changeset, clearly explaining the main objectives (enforce exact dependency versions, configure tools for exact versions, fix ESLint issues) and providing reviewer guidance with verification steps.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@scripts/check-exact-deps.mjs`:
- Line 57: The directory traversal using for (const entry of
fs.readdirSync(dirPath, { withFileTypes: true })) is non-deterministic; call
fs.readdirSync into a variable (e.g., entries), sort the Dirent objects by their
name (entries.sort((a,b) => a.name.localeCompare(b.name))) and then iterate over
the sorted list so the violation lists produced by the script
(scripts/check-exact-deps.mjs) are stable and deterministic across runs and CI.
- Around line 25-27: The JSON read/parse of each manifest is unwrapped and will
throw without indicating which file failed; wrap the fs.readFileSync/JSON.parse
for each manifestPath in a try/catch, and on error log or print the failing
manifestPath (manifestPath) along with the error before exiting; update the loop
that reads manifestPaths and the code around JSON.parse(fs.readFileSync(...)) to
catch errors and include manifestPath context in the error message.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 8133ed50-9826-4ea4-bb65-383f9d4092db

📥 Commits

Reviewing files that changed from the base of the PR and between bfce8a0 and fa056e9.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (7)
  • .ncurc.json
  • .npmrc
  • apps/playground/.npmrc
  • package.json
  • packages/react-native/.eslintrc.cjs
  • packages/react-native/package.json
  • scripts/check-exact-deps.mjs

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fa056e99a4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@mattinannt mattinannt requested a review from pandeymangg March 20, 2026 15:13
Copy link
Copy Markdown
Contributor

@pandeymangg pandeymangg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

changes look good, I just left two comments 🙏

@sonarqubecloud
Copy link
Copy Markdown

Copy link
Copy Markdown
Contributor

@pandeymangg pandeymangg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🚀

@pandeymangg pandeymangg added this pull request to the merge queue Mar 27, 2026
Merged via the queue into main with commit 2e3fee9 Mar 27, 2026
9 checks passed
@pandeymangg pandeymangg deleted the codex/exact-dependency-versions branch March 27, 2026 09:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants