fix: update template bundle #1048
Conversation
WalkthroughThe pull request modifies the Changes
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
packages/engine-cli/template/designer/public/mock/bundle.json (1)
14039-14054: Consider adding integrity hashes for security.The package configurations should include integrity hashes for the CDN URLs to prevent supply chain attacks.
Add integrity hashes like:
{ "packages": [ { "name": "TinyVue组件库", "package": "@opentiny/vue", "version": "3.14.0", "destructuring": true, "script": "https://unpkg.com/@opentiny/vue@~3.14/runtime/tiny-vue.mjs", + "scriptIntegrity": "sha384-...", "css": "https://unpkg.com/@opentiny/vue-theme@~3.14/index.css", + "cssIntegrity": "sha384-..." }, { "name": "element-plus组件库", "package": "element-plus", "version": "2.4.2", "script": "https://unpkg.com/[email protected]/dist/index.full.mjs", + "scriptIntegrity": "sha384-...", "css": "https://unpkg.com/[email protected]/dist/index.css", + "cssIntegrity": "sha384-..." } ] }
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
packages/engine-cli/template/designer/public/mock/bundle.json(33 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: push-check
🔇 Additional comments (1)
packages/engine-cli/template/designer/public/mock/bundle.json (1)
14040-14047: Verify the @opentiny/vue package version and URL.The package configuration uses unpkg URLs with a tilde range
~3.14which could potentially pull in breaking changes. Consider pinning to exact version.Let's verify the package version and URL:
✅ Verification successful
Package version and URLs are correctly configured
The configuration is valid and working as expected. The package version is properly pinned to 3.14.0, and the unpkg URLs correctly resolve within the compatible version range. Both resources are accessible and functional.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Check if the specified version exists and is the latest 3.14.x curl -s https://registry.npmjs.org/@opentiny/vue | jq -r '."dist-tags".latest' # Verify the unpkg URLs are accessible curl -I https://unpkg.com/@opentiny/vue@~3.14/runtime/tiny-vue.mjs curl -I https://unpkg.com/@opentiny/vue-theme@~3.14/index.cssLength of output: 1902
| { | ||
| "name": "element-plus组件库", | ||
| "package": "element-plus", | ||
| "version": "2.4.2", | ||
| "script": "https://unpkg.com/[email protected]/dist/index.full.mjs", | ||
| "css": "https://unpkg.com/[email protected]/dist/index.css" | ||
| } |
There was a problem hiding this comment.
💡 Codebase verification
The current version (2.4.2) is several versions behind the latest stable release (2.9.3). While no security vulnerabilities are present in the current version, upgrading is recommended to benefit from the latest improvements and bug fixes.
- Update version to "2.9.3" in the package field
- Update script URL to "https://unpkg.com/[email protected]/dist/index.full.mjs"
- Update css URL to "https://unpkg.com/[email protected]/dist/index.css"
🔗 Analysis chain
Verify the element-plus package version and URL.
The element-plus configuration uses exact version pinning which is good for stability. However, we should verify if 2.4.2 is the latest stable version and check for any security advisories.
Let's verify the package version and security:
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Check latest version
curl -s https://registry.npmjs.org/element-plus | jq -r '."dist-tags".latest'
# Check for security advisories
gh api graphql -f query='
{
securityVulnerabilities(first: 5, ecosystem: NPM, package: "element-plus") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'
# Verify the unpkg URLs are accessible
curl -I https://unpkg.com/[email protected]/dist/index.full.mjs
curl -I https://unpkg.com/[email protected]/dist/index.css
Length of output: 2468
English | 简体中文
PR
PR Checklist
Please check if your PR fulfills the following requirements:
PR Type
What kind of change does this PR introduce?
Background and solution
What is the current behavior?
按物料最新协议更新cli工具中的bundle.json
Issue Number: N/A
What is the new behavior?
Does this PR introduce a breaking change?
Other information
Summary by CodeRabbit
New Features
@opentiny/vueversion 3.14.0element-plusversion 2.4.2Refactor