Skip to content

Conversation

@Ansonhkg
Copy link
Collaborator

@Ansonhkg Ansonhkg commented Oct 14, 2025

WHAT

Pin all versions

  • Replaced all version ranges (^) in package.json files with fixed versions.

@Ansonhkg Ansonhkg marked this pull request as ready for review October 14, 2025 22:03
@Copilot Copilot AI review requested due to automatic review settings October 14, 2025 22:03
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR pins all package versions to exact versions for security purposes, removing caret (^) and tilde (~) version ranges across the entire monorepo.

  • Pin all dependency versions from flexible ranges (^, ~) to exact versions for enhanced security and reproducibility
  • Update package manager tooling references from yarn to pnpm
  • Add syncpack tooling for version management consistency

Reviewed Changes

Copilot reviewed 18 out of 19 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
packages/wrapped-keys-lit-actions/src/index.ts Removes extra blank lines in export statements
packages/wasm/package.json Pins ethers and pako versions, updates yarn to pnpm in scripts
packages/types/package.json Pins ethers version to exact 5.7.2
packages/schemas/package.json Pins ethers and siwe versions
packages/networks/package.json Pins multiple dependencies including @noble/curves, ethers, pino
packages/logger/package.json Pins pino version
packages/lit-client/package.json Pins bs58 version
packages/e2e/package.json Adds @lit-protocol/lit-status-sdk dependency
packages/crypto/package.json Pins @noble/curves, @noble/hashes, ajv, and tslib versions
packages/contracts/package.json Pins all devDependencies and peerDependencies, downgrades ethers from v6 to v5
packages/constants/package.json Pins @openagenda/verror and tslib versions
packages/auth/package.json Pins multiple auth-related dependencies and updates peer dependency
packages/auth-services/package.json Pins numerous service dependencies including express, redis, stytch
packages/auth-helpers/package.json Pins @wagmi/core, ethers, and siwe versions
packages/artillery/package.json Pins artillery version
packages/access-control-conditions/package.json Pins ethers version
package.json Comprehensive version pinning, adds syncpack tooling, updates package manager to pnpm
.vscode/settings.json Updates VS Code color theme configuration

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

"express-rate-limit": "8.1.0",
"google-auth-library": "9.15.1",
"helmet": "8.1.0",
"jose": "4.14.4",
Copy link

Copilot AI Oct 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The jose library version is being downgraded from 6.0.7 to 4.14.4, which is a major version downgrade that may introduce breaking changes and security vulnerabilities from using an older version.

Suggested change
"jose": "4.14.4",
"jose": "6.0.7",

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant