📝 CodeRabbit Chat: Implement requested code changes#341
Open
coderabbitai[bot] wants to merge 2 commits intomainfrom
Open
📝 CodeRabbit Chat: Implement requested code changes#341coderabbitai[bot] wants to merge 2 commits intomainfrom
coderabbitai[bot] wants to merge 2 commits intomainfrom
Conversation
… pnpm audit - Added fallback to npm bulk advisory endpoint when pnpm audit endpoint is retired. - Improved resilience by parsing legacy and new audit outputs uniformly. - Updated audit utilities to fetch installed package versions and query bulk advisories. - Enhanced validate-audit.js to await asynchronous runAuditJson for advisory validation. - Added comprehensive tests for the shared audit helper including bulk advisory fallback. - Updated Makefile audit target to run audit:validate for consistent validation. This enables seamless audit compliance checks despite registry audit endpoint changes. Co-authored-by: devboxerhub[bot] <devboxerhub[bot]@users.noreply.github.com>
Reviewer's GuideRefactors bulk advisory normalization in audit-utils.js by extracting helper functions for adding and processing package advisories, improving deduplication logic and structure while preserving behavior, along with a minor formatting change. Sequence diagram for bulk advisory normalization helperssequenceDiagram
participant Caller
participant Normaliser as normaliseBulkAdvisories
participant PackageNormaliser as normalisePackageAdvisories
participant Adder as addNormalisedAdvisory
participant Extractor as extractGithubAdvisoryId
Caller->>Normaliser: normaliseBulkAdvisories bulkPayload
Note over Normaliser: Create advisories object
Normaliser->>Normaliser: Object.entries bulkPayload
loop for each packageName and packageAdvisories
Normaliser->>PackageNormaliser: normalisePackageAdvisories advisories, packageName, packageAdvisories
PackageNormaliser->>PackageNormaliser: Check Array.isArray packageAdvisories
alt packageAdvisories is not array
PackageNormaliser-->>Normaliser: return
else packageAdvisories is array
loop for each advisory in packageAdvisories
PackageNormaliser->>Adder: addNormalisedAdvisory advisories, packageName, advisory
Adder->>Extractor: extractGithubAdvisoryId advisory url
Extractor-->>Adder: githubAdvisoryId
Adder->>Adder: Compute advisoryKey
Adder->>Adder: Check advisoryKey in advisories
alt advisoryKey exists
Adder-->>PackageNormaliser: return without change
else advisoryKey does not exist
Adder->>Adder: Set advisories advisoryKey with advisory, github_advisory_id, package_name
Adder-->>PackageNormaliser: return
end
end
PackageNormaliser-->>Normaliser: return
end
end
Normaliser-->>Caller: advisories
Flow diagram for normaliseBulkAdvisories refactorflowchart TD
A[normaliseBulkAdvisories receives bulkPayload] --> B{bulkPayload is null or undefined?}
B -->|yes| C[Use empty object for iteration]
B -->|no| D[Use bulkPayload entries]
C --> E[Iterate Object.entries]
D --> E[Iterate Object.entries]
E --> F[For each entry get packageName and packageAdvisories]
F --> G[Call normalisePackageAdvisories with advisories, packageName, packageAdvisories]
G --> H{packageAdvisories is an array?}
H -->|no| I[Return without changes]
H -->|yes| J[Iterate advisories in packageAdvisories]
J --> K[For each advisory call addNormalisedAdvisory]
K --> L[addNormalisedAdvisory receives advisories, packageName, advisory]
L --> M[Compute githubAdvisoryId via extractGithubAdvisoryId]
M --> N[Compute advisoryKey as githubAdvisoryId or packageName colon id or unknown]
N --> O{advisoryKey already in advisories?}
O -->|yes| P[Return without adding duplicate]
O -->|no| Q[Store advisory object keyed by advisoryKey with github_advisory_id and package_name]
P --> R[Continue iteration]
Q --> R[Continue iteration]
R --> S[All entries processed]
S --> T[Return advisories object]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Contributor
Author
|
Important Review skippedThis PR was authored by the user configured for CodeRabbit reviews. CodeRabbit does not review PRs authored by this user. It's recommended to use a dedicated user account to post CodeRabbit review feedback. ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
4 tasks
![codescene-delta-analysis[bot]](https://avatars.githubusercontent.com/in/53921?s=60&v=4){kind=small}
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="security/audit-utils.js" line_range="164" />
<code_context>
- if (advisoryKey in advisories) {
- continue;
- }
+function normalisePackageAdvisories(advisories, packageName, packageAdvisories) {
+ if (!Array.isArray(packageAdvisories)) {
+ return;
</code_context>
<issue_to_address>
**issue (complexity):** Consider inlining the trivial normalisePackageAdvisories logic into normaliseBulkAdvisories while keeping addNormalisedAdvisory as the single helper for per-advisory normalisation.
You can simplify this by inlining `normalisePackageAdvisories` back into `normaliseBulkAdvisories` while keeping the useful `addNormalisedAdvisory` helper. This removes an extra layer of indirection without changing behaviour.
```js
function addNormalisedAdvisory(advisories, packageName, advisory) {
const githubAdvisoryId = extractGithubAdvisoryId(advisory?.url);
const advisoryKey =
githubAdvisoryId ?? `${packageName}:${String(advisory?.id ?? 'unknown')}`;
if (advisoryKey in advisories) {
return;
}
advisories[advisoryKey] = {
...advisory,
github_advisory_id: githubAdvisoryId,
package_name: packageName,
};
}
// Drop normalisePackageAdvisories and inline its trivial logic:
function normaliseBulkAdvisories(bulkPayload) {
const advisories = {};
for (const [packageName, packageAdvisories] of Object.entries(bulkPayload ?? {})) {
if (!Array.isArray(packageAdvisories)) continue;
for (const advisory of packageAdvisories) {
addNormalisedAdvisory(advisories, packageName, advisory);
}
}
return advisories;
}
```
This keeps the normalisation logic for each advisory encapsulated, but makes the per-package control flow visible in one place.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| if (advisoryKey in advisories) { | ||
| continue; | ||
| } | ||
| function normalisePackageAdvisories(advisories, packageName, packageAdvisories) { |
There was a problem hiding this comment.
issue (complexity): Consider inlining the trivial normalisePackageAdvisories logic into normaliseBulkAdvisories while keeping addNormalisedAdvisory as the single helper for per-advisory normalisation.
You can simplify this by inlining normalisePackageAdvisories back into normaliseBulkAdvisories while keeping the useful addNormalisedAdvisory helper. This removes an extra layer of indirection without changing behaviour.
function addNormalisedAdvisory(advisories, packageName, advisory) {
const githubAdvisoryId = extractGithubAdvisoryId(advisory?.url);
const advisoryKey =
githubAdvisoryId ?? `${packageName}:${String(advisory?.id ?? 'unknown')}`;
if (advisoryKey in advisories) {
return;
}
advisories[advisoryKey] = {
...advisory,
github_advisory_id: githubAdvisoryId,
package_name: packageName,
};
}
// Drop normalisePackageAdvisories and inline its trivial logic:
function normaliseBulkAdvisories(bulkPayload) {
const advisories = {};
for (const [packageName, packageAdvisories] of Object.entries(bulkPayload ?? {})) {
if (!Array.isArray(packageAdvisories)) continue;
for (const advisory of packageAdvisories) {
addNormalisedAdvisory(advisories, packageName, advisory);
}
}
return advisories;
}This keeps the normalisation logic for each advisory encapsulated, but makes the per-package control flow visible in one place.
Base automatically changed from
fix-ci-audit-failure-frontend-pwa-k31pyk
to
main
April 17, 2026 11:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Code changes was requested by @leynos.
The following files were modified:
security/audit-utils.jsSummary by Sourcery
Enhancements: