fix(ci): unblock Dependabot PRs and patch high-severity npm vulns#22
fix(ci): unblock Dependabot PRs and patch high-severity npm vulns#22omerakben wants to merge 1 commit into
Conversation
…lities Dependabot PRs cannot access repository secrets, so the Django backend job failed at "Check Django configuration" with ImproperlyConfigured because SECRET_KEY was empty. Fall back to a CI-only test secret when the secret is unavailable. The settings.py guard that requires a real key still applies to production deploys (Railway), where DJANGO_SECRET_KEY is set. Also: - Replace `manage.py migrate --check` (always non-zero on a fresh DB) with `makemigrations --check --dry-run`, which is the actual migration drift check the step name implies. - Set ALLOWED_HOSTS=testserver and DEMO_MODE=True for the migrate and test steps so they match the configuration step. - Bump NODE_VERSION 18 -> 20 (Node 18 LTS ended Oct 2025). - Run `npm audit fix` and bump `next`/`eslint-config-next` to ^15.5.18 to clear 10 advisories (axios SSRF/prototype-pollution, follow-redirects header leak, flatted DoS/proto-poll, brace-expansion ReDoS, js-yaml proto-poll, minimatch ReDoS, picomatch ReDoS, ajv ReDoS, and the Next.js RCE/DoS series). Two transitive postcss advisories remain; npm's only fix path is downgrading Next to 9.x, which is not viable. - Add .github/dependabot.yml with grouping for radix-ui, eslint, next, django, and a github-actions ecosystem entry, so future updates batch. Test plan - npm run lint, typecheck, and build all pass (Next 15.5.18, all 12 pages generated). - python manage.py check / makemigrations --check / test all pass (64 tests, OK) with the fallback secret.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughThis PR establishes automated dependency management via Dependabot and updates CI/CD infrastructure. It adds weekly npm and pip dependency checks for the client and server packages, introduces monthly github-actions updates, upgrades the CI workflow to Node.js 20, standardizes Django test environment configuration with fallback secrets and expanded host allowlists, and bumps Next.js and its ESLint config to ^15.5.18. ChangesDependency Management and CI/CD Upgrades
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a Dependabot configuration for npm, pip, and GitHub Actions, alongside an update to several dependencies in the capstone-client project. However, the review highlights critical issues with the proposed changes: multiple dependency versions (such as next, axios, and postcss) appear to be non-existent in the npm registry, suggesting they were hallucinated. Additionally, the package-lock.json is corrupted with mismatched integrity hashes. It is recommended to use valid, verifiable versions and to regenerate the lockfile using standard npm commands to ensure a functional build environment.
| "firebase": "12.1.0", | ||
| "lucide-react": "^0.542.0", | ||
| "next": "15.5.2", | ||
| "next": "^15.5.18", |
There was a problem hiding this comment.
The version ^15.5.18 for next does not exist in the public npm registry. The latest stable version of Next.js 15 is currently 15.1.6. It appears the AI tool used to generate this PR has hallucinated non-existent version numbers. Attempting to install these will result in an ETARGET error from npm, breaking the build.
| "next": "^15.5.18", | |
| "next": "^15.1.6", |
| "@types/react-dom": "^19", | ||
| "eslint": "^9", | ||
| "eslint-config-next": "15.5.2", | ||
| "eslint-config-next": "^15.5.18", |
There was a problem hiding this comment.
Similarly, eslint-config-next@15.5.18 is a non-existent version. Please use a valid version such as ^15.1.6 to ensure compatibility with the Next.js installation and to resolve the build errors that will occur with the current version string.
| "eslint-config-next": "^15.5.18", | |
| "eslint-config-next": "^15.1.6", |
| "version": "1.12.2", | ||
| "resolved": "https://registry.npmjs.org/axios/-/axios-1.12.2.tgz", | ||
| "integrity": "sha512-vMJzPewAlRyOgxV2dU0Cuz2O8zzzx9VYtbJOaBgXFeLc4IV/Eg50n4LowmehOOR61S8ZMpc2K5Sa7g6A4jfkUw==", | ||
| "version": "1.16.0", |
There was a problem hiding this comment.
The version 1.16.0 for axios is hallucinated and does not exist on npm (the latest version is 1.7.9). Notably, the integrity hash provided in this diff (sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==) actually belongs to axios@1.7.7. This indicates the lockfile is corrupted and was generated with incorrect metadata. The lockfile should be regenerated using npm install with legitimate dependency versions.
| "version": "8.5.6", | ||
| "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz", | ||
| "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==", | ||
| "version": "8.5.14", |
There was a problem hiding this comment.
The version 8.5.14 for postcss is also non-existent. This confirms a pattern of hallucinated dependency versions throughout the lockfile changes. This PR should be revised to use real, verifiable versions from the npm registry to actually address the security vulnerabilities mentioned in the description and to maintain a functional build environment.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/dependabot.yml (1)
36-39: 💤 Low value
github-actionsecosystem entry is missingopen-pull-requests-limit.The npm and pip entries both cap at 10. The github-actions entry falls back to the Dependabot default of 5. If consistency matters, add the limit.
🔧 Proposed fix
- package-ecosystem: "github-actions" directory: "/" schedule: interval: "monthly" + open-pull-requests-limit: 10🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/dependabot.yml around lines 36 - 39, Add an open-pull-requests-limit setting to the existing github-actions dependabot entry so it matches the npm and pip caps (e.g., set open-pull-requests-limit: 10). Locate the block where package-ecosystem: "github-actions" is defined and add the open-pull-requests-limit key at the same indentation level as schedule, ensuring the value is an integer (10) to enforce the PR cap.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/dependabot.yml:
- Around line 15-22: The dependabot group pattern "eslint*" in the eslint group
is currently matching and stealing packages like "eslint-config-next" from the
next group; update the configuration so "eslint-config-next" is handled by the
next group instead of eslint: either narrow the eslint group's pattern (replace
"eslint*" with a more specific pattern that does not match "eslint-config-next")
or explicitly exclude "eslint-config-next" from the eslint group and/or
explicitly include it in the next group; adjust the patterns for the eslint and
next groups (referencing the "eslint" group, pattern "eslint*", and the "next"
group, pattern "eslint-config-next") accordingly so Dependabot assigns the
package to the correct group.
---
Nitpick comments:
In @.github/dependabot.yml:
- Around line 36-39: Add an open-pull-requests-limit setting to the existing
github-actions dependabot entry so it matches the npm and pip caps (e.g., set
open-pull-requests-limit: 10). Locate the block where package-ecosystem:
"github-actions" is defined and add the open-pull-requests-limit key at the same
indentation level as schedule, ensuring the value is an integer (10) to enforce
the PR cap.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 254369e8-a708-42eb-99dd-2224153222b0
⛔ Files ignored due to path filters (1)
capstone-client/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (3)
.github/dependabot.yml.github/workflows/deploy.ymlcapstone-client/package.json
| eslint: | ||
| patterns: | ||
| - "eslint*" | ||
| - "@eslint/*" | ||
| next: | ||
| patterns: | ||
| - "next" | ||
| - "eslint-config-next" |
There was a problem hiding this comment.
eslint* glob shadows eslint-config-next in the next group — the two packages will be bumped separately.
Dependabot assigns each package to the first group whose pattern matches it. Because the eslint group (using eslint*) is declared before the next group, eslint-config-next is captured by eslint, not by next. This defeats the goal of keeping next and eslint-config-next on the same version, and risks peer-dependency mismatches when they land in separate PRs.
Fix: either narrow the eslint group's glob to exclude eslint-config-next, or move eslint-config-next to an explicit exclude/include:
🔧 Proposed fix
eslint:
patterns:
- "eslint*"
- "@eslint/*"
+ exclude-patterns:
+ - "eslint-config-next"
next:
patterns:
- "next"
- "eslint-config-next"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/dependabot.yml around lines 15 - 22, The dependabot group pattern
"eslint*" in the eslint group is currently matching and stealing packages like
"eslint-config-next" from the next group; update the configuration so
"eslint-config-next" is handled by the next group instead of eslint: either
narrow the eslint group's pattern (replace "eslint*" with a more specific
pattern that does not match "eslint-config-next") or explicitly exclude
"eslint-config-next" from the eslint group and/or explicitly include it in the
next group; adjust the patterns for the eslint and next groups (referencing the
"eslint" group, pattern "eslint*", and the "next" group, pattern
"eslint-config-next") accordingly so Dependabot assigns the package to the
correct group.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d5ed1850e9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - "eslint*" | ||
| - "@eslint/*" | ||
| next: | ||
| patterns: | ||
| - "next" | ||
| - "eslint-config-next" |
There was a problem hiding this comment.
Because Dependabot assigns a dependency to the first matching group, eslint-config-next will match eslint* under the eslint group before it can reach the next group. That means next and eslint-config-next updates will be split into separate PRs even though this config appears intended to update them together, which can create avoidable CI breakage from version skew between Next and its lint config.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Pull request overview
Updates CI and dependency management to unblock Dependabot PR checks (by avoiding missing-secret failures), improve Django migration drift detection, move CI to Node 20, and patch high-severity npm vulnerabilities in capstone-client.
Changes:
- Adjust GitHub Actions workflow to use Node 20, provide a CI fallback for Django
SECRET_KEY, and switch migration validation tomakemigrations --check --dry-run. - Add grouped Dependabot configuration for npm/pip/github-actions ecosystems.
- Upgrade Next.js and refresh
package-lock.jsonto incorporate security fixes across transitive dependencies.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
.github/workflows/deploy.yml |
Updates CI runtime versions and Django checks; adds CI fallback secret and refines migration drift checks. |
.github/dependabot.yml |
Introduces grouped Dependabot update policies for npm, pip, and GitHub Actions. |
capstone-client/package.json |
Bumps Next.js / eslint-config-next to newer patched versions. |
capstone-client/package-lock.json |
Lockfile refresh capturing security-related transitive upgrades. |
Files not reviewed (1)
- capstone-client/package-lock.json: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - name: Check Django configuration | ||
| env: | ||
| SECRET_KEY: ${{ secrets.DJANGO_SECRET_KEY }} | ||
| SECRET_KEY: ${{ secrets.DJANGO_SECRET_KEY || 'ci-test-secret-key-not-for-production-use-only' }} | ||
| DEBUG: "True" | ||
| ALLOWED_HOSTS: "localhost,127.0.0.1" | ||
| ALLOWED_HOSTS: "localhost,127.0.0.1,testserver" |
| env: | ||
| NODE_VERSION: "18" | ||
| NODE_VERSION: "20" | ||
| PYTHON_VERSION: "3.12" |
| DEBUG: "True" | ||
| ALLOWED_HOSTS: "localhost,127.0.0.1" | ||
| ALLOWED_HOSTS: "localhost,127.0.0.1,testserver" | ||
| DEMO_MODE: "True" | ||
| run: | |
Summary
${{ secrets.DJANGO_SECRET_KEY }}was empty andcapstone-server/deadline_api/settings.pyraisedImproperlyConfiguredduringmanage.py check. Add a CI-only fallback secret so backend checks run on Dependabot PRs while production still requires the real key (Railway already injects it).manage.py migrate --check(returns non-zero whenever migrations are unapplied — always true on a fresh CI DB) withmanage.py makemigrations --check --dry-run, which is the actual drift check this step was meant to perform. PropagateALLOWED_HOSTS=testserver/DEMO_MODE=Trueto all three Django steps. BumpNODE_VERSION18 → 20 (Node 18 LTS ended October 2025).capstone-client:npm audit fixplus an explicit bump tonext@^15.5.18/eslint-config-next@^15.5.18clears 10 of 12 advisories — axios (SSRF + multiple prototype pollution chains), follow-redirects header leak, flatted DoS, brace-expansion ReDoS, js-yaml proto-poll, minimatch ReDoS, picomatch ReDoS, ajv ReDoS, and the Next.js RCE/DoS/HTTP-smuggling series. Two transitivepostcssadvisories remain; npm's only auto-fix path is downgrading Next to 9.x, which is not viable..github/dependabot.yml: Group radix-ui, eslint, next, and django updates so future security PRs arrive in batches instead of one-by-one, and add agithub-actionsecosystem so the deprecated-Node-20 actions warnings get resolved automatically.Files changed
.github/workflows/deploy.yml— fallback secret, env hygiene, migration check fix, Node 20..github/dependabot.yml— new, grouped weekly schedule.capstone-client/package.json+package-lock.json— Next 15.5.18, transitive security fixes.Test plan
npm run lint— passes (max-warnings=0).npm run typecheck— passes.npm run build— passes, all 12 pages generated, Next 15.5.18.python manage.py check— passes with fallback secret.python manage.py makemigrations --check --dry-run— passes (no drift).python manage.py test— 64 tests OK in 5.2s.npm audit— 12 → 2 vulnerabilities (remaining 2 are transitive postcss inside next/dist; build-time CSS stringify only).Unresolved / out of scope
postcssadvisories insidenext/distcannot be fixed without a Next major downgrade.package-lock.json; with this PR merged the failing Django check will go green and most of those Dependabot bumps are already subsumed bynpm audit fixhere. Consider closing the now-redundant ones after merge.DJANGO_SECRET_KEY, Railway/Vercel tokens, Firebase) are unchanged — the fallback is only used when the secret is empty (i.e. forked / Dependabot PRs).🤖 Generated with Claude Code
Summary by CodeRabbit