Conversation
WalkthroughThis pull request updates development and tooling metadata. In packages/pages/package.json the devDependency 🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/pages/package.json`:
- Line 103: Remove the redundant `@types/minimatch` entry from lockfiles and
package manifests (it conflicts with minimatch v10's built-in types) and run a
fresh install to update lockfile; then audit imports (e.g., the test file
packages/pages/src/common/src/function/internal/getFunctionFilepaths.test.ts and
any other modules) to ensure minimatch is only imported using ESM-style imports
(import { minimatch }) and not required via CommonJS, and if any CommonJS
consumers remain or you're constrained to CJS, either pin brace-expansion to a
compatible non-ESM version or add a dependency resolution/override to force a
compatible brace-expansion version so minimatch@10 works in your environment.
ℹ️ Review info
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
packages/pages/package.json
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@package.json`:
- Line 55: Replace the undocumented negation prefix used in package.json
("!**/THIRD-PARTY-NOTICES") with the documented micromatch extglob form
"!(**/THIRD-PARTY-NOTICES)" in the lint-staged config; update the pattern string
in the package.json entry so lint-staged sees the extglob negation, and verify
that the change in path structure (presence of a slash) does not inadvertently
disable matchBase behavior—if you need basename matching instead of full-path
matching, adjust the pattern accordingly (e.g., remove the slash or use an
alternate glob) to preserve original matching semantics.
In `@THIRD-PARTY-NOTICES`:
- Around line 8722-8725: THIRD-PARTY-NOTICES currently lists minimatch@9.0.5 but
package.json and the lockfile resolve to minimatch@10.2.2; regenerate the
THIRD-PARTY-NOTICES file from the project's lockfile (e.g., package-lock.json /
yarn.lock / pnpm-lock.yaml) or rerun the license-notice generation script used
in this repo so the entry for minimatch (and any other packages) matches the
resolved versions in the lockfile and the package.json specification.
| }, | ||
| "lint-staged": { | ||
| "*": "oxfmt", | ||
| "!**/THIRD-PARTY-NOTICES": "oxfmt", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check for any other lint-staged configurations in the codebase
fd -t f "package.json" | head -20 | xargs grep -l "lint-staged" | while read f; do
echo "=== $f ==="
grep -A 10 '"lint-staged"' "$f" || true
doneRepository: yext/pages
Length of output: 594
🌐 Web query:
lint-staged negation patterns glob config keys documentation
💡 Result:
In lint-staged, the configuration object keys are glob patterns (matched with micromatch), and the values are the command(s) to run for files that match each glob. [1]
Negation patterns you can use as config keys
Because lint-staged uses micromatch, you can use negation / extglob patterns directly in the key to exclude files and avoid overlapping rules, e.g.: [1][2]
{
"!(*.ts)": "prettier --write",
"*.ts": ["eslint --fix", "prettier --write"]
}Other documented negation examples in lint-staged include: [1]
!(*test).js→ match*.jsexcept files ending intest.js!(*.css|*.js|*.jsx)→ match everything except those extensions
How matching behaves (important for writing negations)
lint-staged notes that when your glob has no /, micromatch enables matchBase, so patterns like *.js (and negated variants like !(*test).js) match by basename anywhere in the repo. [1]
Sources: lint-staged README (Configuration / Filtering files) [1], micromatch README (negation + extglobs) [2].
Use documented extglob syntax for negation patterns: replace "!**/THIRD-PARTY-NOTICES" with "!(**/THIRD-PARTY-NOTICES)".
The pattern syntax used here diverges from lint-staged's documented approach. Official lint-staged documentation (via micromatch) shows negation patterns using extglob syntax—e.g., "!(*.ts)", "!(*test).js"—not the !prefix form used here. While ! prefix negation is a common glob convention, it is not the documented pattern style for lint-staged config keys, and using undocumented syntax risks incompatibility or unexpected behavior.
Additionally, the transition from "*" to "!**/THIRD-PARTY-NOTICES" changes pattern matching behavior: the original pattern (no slashes) enabled micromatch's matchBase option and matched all staged files by basename; the new pattern contains /, disabling matchBase, and now relies on full-path matching. Ensure this behavioral shift aligns with the intended behavior.
Use the documented extglob form instead:
🔍 Suggested fix using documented extglob negation
- "!**/THIRD-PARTY-NOTICES": "oxfmt",
+ "!(**/THIRD-PARTY-NOTICES)": "oxfmt",📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "!**/THIRD-PARTY-NOTICES": "oxfmt", | |
| "!(**/THIRD-PARTY-NOTICES)": "oxfmt", |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@package.json` at line 55, Replace the undocumented negation prefix used in
package.json ("!**/THIRD-PARTY-NOTICES") with the documented micromatch extglob
form "!(**/THIRD-PARTY-NOTICES)" in the lint-staged config; update the pattern
string in the package.json entry so lint-staged sees the extglob negation, and
verify that the change in path structure (presence of a slash) does not
inadvertently disable matchBase behavior—if you need basename matching instead
of full-path matching, adjust the pattern accordingly (e.g., remove the slash or
use an alternate glob) to preserve original matching semantics.
| The following npm package may be included in this product: | ||
|
|
||
| - minimatch@9.0.3 | ||
| - minimatch@9.0.5 | ||
|
|
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check package.json for minimatch dependency
echo "=== package.json ==="
rg -n '"minimatch"\s*:' -g 'package.json' . --max-count=5
echo -e "\n=== Lockfiles ==="
# Check lockfiles for resolved minimatch version
rg -n 'minimatch@' -g 'pnpm-lock.yaml' -g 'package-lock.json' -g 'yarn.lock' . | head -20
echo -e "\n=== THIRD-PARTY-NOTICES ==="
# Check THIRD-PARTY-NOTICES for listed version
rg -n 'minimatch@' THIRD-PARTY-NOTICESRepository: yext/pages
Length of output: 559
Regenerate THIRD-PARTY-NOTICES to reflect the correct minimatch version.
Line 8724 lists minimatch@9.0.5, but package.json specifies ^10.2.2 which resolves to 10.2.2 in the lockfile. THIRD-PARTY-NOTICES is out of sync with the actual resolved dependency and creates a compliance mismatch. Regenerate the file from the lockfile to ensure licenses are accurate.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@THIRD-PARTY-NOTICES` around lines 8722 - 8725, THIRD-PARTY-NOTICES currently
lists minimatch@9.0.5 but package.json and the lockfile resolve to
minimatch@10.2.2; regenerate the THIRD-PARTY-NOTICES file from the project's
lockfile (e.g., package-lock.json / yarn.lock / pnpm-lock.yaml) or rerun the
license-notice generation script used in this repo so the entry for minimatch
(and any other packages) matches the resolved versions in the lockfile and the
package.json specification.
3 participants
https://yext.atlassian.net/browse/VULN-42320