Conversation
…ction failure PR #34 dependency changes broke @grpc/grpc-js gRPC connectivity in the Docker container. The workflow bundle compiles correctly but the Temporal client cannot connect (gRPC error 14 UNAVAILABLE, ECONNREFUSED 127.0.0.1:7233). This blocks ALL post publishing.
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_cbf31353-040a-4a3a-acdf-3c24c1ec9012) |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates package.json by adding several new dependencies (including @mantine/modals, @postiz/wallets, @solana/wallet-adapter-react, sweetalert2, and viem), downgrading sharp, and removing various overrides. It also downgrades vitest and its companion packages. The feedback points out a critical version mismatch where vitest is set to 3.1.4 while @vitest/coverage-v8 and @vitest/ui are reverted to 1.6.0. To prevent runtime errors and test failures, it is recommended to align vitest to version 1.6.0 as well.
| "vite": "^8.2.1", | ||
| "vite-tsconfig-paths": "^5.1.4", | ||
| "vitest": "3.2.6" | ||
| "vitest": "3.1.4" |
There was a problem hiding this comment.
There is a version mismatch between vitest (3.1.4) and its companion packages @vitest/coverage-v8 and @vitest/ui (both reverted to 1.6.0). Mixing major versions of Vitest packages can lead to runtime errors, API incompatibilities, or failure to run tests and generate coverage. Please align vitest to version 1.6.0 to ensure compatibility.
| "vitest": "3.1.4" | |
| "vitest": "1.6.0" |
The Build workflow has been red on every push to dev and main since at least 2026-09-10 (PRs #33-#36). The failing step is "Test bootstrap / OAuth consent (jest)": those suites guard against running on a shared database and throw 'Use isolated local test services' unless DATABASE_URL points at 127.0.0.1:15491 (or :15432) and REDIS_URL at 127.0.0.1:16391 (or :16379). CI provided neither, so beforeAll threw, prisma stayed undefined, and afterAll then failed with "Cannot read properties of undefined (reading 'oAuthAuthorization')" — surfacing as 42 failed / 11 passed of 53. Add Postgres 17 and Redis 7.2 service containers on exactly those ports, push the Prisma schema into the throwaway database before the run, and add --runInBand because the suites share one database and create/delete rows by known ids. Verified locally against the same images, ports, env and commands: Test Suites: 5 passed, 5 total Tests: 53 passed, 53 total Jest exits cleanly, so no --forceExit is needed. This does not make CI a trustworthy gate on its own. The ESLint workflow is still red (eslint 8.57 cannot consume the flat eslint.config.mjs, and fixing that needs eslint 9 plus @typescript-eslint 8), and it is "Build & Publish Crove Containers" — not this workflow — that produces the deployable image. Those are separate follow-ups.
1 participant
What kind of change does this PR introduce?
Bug fix — scope: dependencies (
package.json,pnpm-lock.yaml). Reverts the dependency changes from PR #34 that broke Temporal gRPC connectivity, blocking ALL post publishing.Why was this change needed?
PR #34's dependency overrides broke
@grpc/grpc-jsgRPC connectivity in the Docker container. The Temporal client returned gRPC error 14 (UNAVAILABLE) for ALL targets (includinglocalhost:7233), preventing ALL post publishing. The root cause: theprotobufjs@7.5.5override bumped protobufjs from 7.5.4 → 7.6.6 which has a breaking change with@grpc/grpc-js@1.14.3— gRPC handshake fails even though TCP connects. Combined with thehappy-dom@20override affecting gRPC's DNS resolver, the entire gRPC stack became unusable.Technical Details & Scope
package.json+pnpm-lock.yamlto the pre-C4 state (commitabf11fc9)protobufjsback to 7.5.4 (working with grpc-js 1.14.3)pnpm.overrides(tar, form-data, protobufjs, shell-quote, fast-uri, hono, immutable, handlebars, happy-dom, grpc-js)Verification & Testing
pnpm install— 38.2s, no errorspnpm --filter ./apps/backend run build— exit 0pnpm --filter ./apps/orchestrator run build— exit 0QA
pnpm install— expect no ERR_PNPM_JSON_PARSEpnpm list protobufjs @grpc/grpc-js --depth 0— expect protobufjs 7.5.4, grpc-js 1.14.3pnpm --filter ./apps/backend run build— expect exit 0docker exec temporal-admin-tools tctl --address temporal:7233 workflow list— expect non-emptyChecklist:
pnpm run build).pnpm dlx tsx scripts/branding-guard.ts).Note
Medium Risk
Restores production-critical Temporal/gRPC behavior but re-opens transitive dependency versions that C4 had pinned; Vitest/sharp version shifts may affect CI and image processing until security overrides are re-applied safely.
Overview
Reverts the dependency lockfile changes from PR #34 that made Temporal’s gRPC client fail (UNAVAILABLE) in Docker and blocked all post publishing.
pnpm.overridesis rolled back to the smaller pre-C4 set: the ten security-related pins (protobufjs,@grpc/grpc-js,happy-dom,tar,form-data, etc.) are removed so transitive versions match the last working stack (e.g.protobufjs7.5.4 with@grpc/grpc-js1.14.3).Direct dependencies are restored that had been dropped in the C4 bump—UI/wallet stack (
@mantine/modals, Solana adapters,@postiz/wallets,sweetalert2+ dark theme,viem) and dev@tailwindcss/vite.sharpis downgraded from^0.35.0to^0.33.4, and Vitest-related dev packages are moved back to older versions (vitest3.1.4,@vitest/*1.6.0vs the newer 3.2.6 line).C4 security overrides are intentionally deferred to a follow-up PR after isolating which pin breaks gRPC.
Reviewed by Cursor Bugbot for commit aa2e4df. Configure here.