Upgrade stable runtimes and dependencies - #79
Conversation
📝 WalkthroughWalkthroughThe PR aligns local and CI runtimes with Python 3.14.6, Node.js 26.5.1, npm 12.0.2, and updated tool dependencies. It also updates AI service packages, frontend tooling, backend package pins, Vitest configuration, documentation, and architecture validation. ChangesRuntime and toolchain alignment
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Around line 27-28: Update the allowScripts entry for msw to use the resolved
package identity key "msw@2.15.0" instead of the unversioned "msw" key,
preserving the existing approval value.
- Around line 6-8: Update the package bootstrap and CI command paths associated
with the packageManager declaration to explicitly activate npm 12.0.2 before
running npm commands, or validate the active version with npm --version and fail
on mismatch. Keep the existing packageManager value as the single version source
and ensure all relevant bare-npm execution paths enforce it.
In `@README.md`:
- Around line 48-52: Align the README Python requirement with
ai-services/assistant-service/pyproject.toml’s requires-python range: document
3.14 as the minimum, while identifying 3.14.6 only as the CI/local
.python-version and uv.lock pin. Alternatively, raise requires-python to
>=3.14.6,<3.15 if that pin is the intended minimum.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d1b5e47f-d060-42bc-86ff-8a86befa878c
⛔ Files ignored due to path filters (2)
ai-services/assistant-service/uv.lockis excluded by!**/*.lockpackage-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (18)
.github/workflows/agent-governance.yml.github/workflows/ai-services-ci.yml.github/workflows/frontend-ci.yml.github/workflows/sonar.yml.nvmrcREADME.mdai-services/assistant-service/.python-versionai-services/assistant-service/README.mdai-services/assistant-service/pyproject.tomlai-services/assistant-service/tests/test_verify_token.pyapps/admin-frontend/package.jsonapps/admin-frontend/vitest.config.tsbackend/Directory.Packages.propsdocs/MONOREPO.mddocs/QUALITY.mddocs/adr/0032-stable-runtime-and-toolchain-compatibility-pins.mdpackage.jsonscripts/architecture_guard.py
| "node": ">=26.5.1" | ||
| }, | ||
| "packageManager": "npm@10.9.3", | ||
| "packageManager": "npm@12.0.2", |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Expect an explicit npm 12.0.2 activation and version check.
rg -n -C 3 'corepack|npm@12\.0\.2|setup-node|npm[[:space:]]+--version' \
.github README.md package.jsonRepository: evertonschuster/Agenza
Length of output: 1695
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- package files ---\n'
for f in package.json .nvmrc README.md; do
if [ -f "$f" ]; then
echo "== $f =="
sed -n '1,120p' "$f"
fi
done
printf '\n--- workflow files ---\n'
fd -a '\.y(a)?ml$' .github/workflows | sed 's#^\./##' | sort | while read -r f; do
echo "== $f =="
sed -n '1,180p' "$f"
done
printf '\n--- npm/bootstrap script references ---\n'
rg -n -C 3 --hidden --glob '!node_modules/**' 'npm[[:space:]]|corepack[[:space:]]|setup-node|npm install|ci|test|build|pnpm|yarn|bun' .Repository: evertonschuster/Agenza
Length of output: 251
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- package files ---'
for f in package.json .nvmrc README.md; do
if [ -f "$f" ]; then
echo "== $f =="
sed -n '1,120p' "$f"
fi
done
echo
echo '--- workflow files ---'
fd '\.y(a)?ml$' .github/workflows | sort | while read -r f; do
echo "== $f =="
sed -n '1,200p' "$f"
done
echo
echo '--- npm/bootstrap script references ---'
rg -n -C 3 --hidden --glob '!node_modules/**' 'npm[[:space:]]|corepack[[:space:]]|setup-node|npm install|ci|test|build|pnpm|yarn|bun' .Repository: evertonschuster/Agenza
Length of output: 50379
🌐 Web query:
Node 26 npm version
💡 Result:
As of August 3, 2026, Node.js 26 is in its "Current" release phase [1][2][3]. The most recent versions of Node.js 26 include npm version 11.x [4]. Specifically, the Node.js 26.6.0 release includes npm 11.18.0 [5]. Because Node.js bundles npm, the version of npm included depends on the specific minor/patch release of Node.js 26 you are using [4]. You can verify the version installed in your environment by running the command node -e 'console.log(require("child_process").execSync("npm -v").toString)' or simply running npm -v in your terminal.
Citations:
- 1: https://github.com/nodejs/release?tab=readme-ov-file
- 2: https://nodejs.org/en/about/previous-releases
- 3: https://github.com/nodejs/node/releases
- 4: https://devcenter0.assets.heroku.com/articles/nodejs-support
- 5: 2026-07-22, Version 26.6.0 (Current) nodejs/node#64655
🌐 Web query:
Corepack not enabled by default npm --version npm 26
💡 Result:
Corepack is not enabled by default, and it is not intended to manage npm by default even when Corepack itself is enabled [1][2]. Key details regarding your query: 1. Manual Enablement Required: Regardless of the Node.js version, Corepack must be explicitly enabled by running the command corepack enable [1][2]. It is never enabled by default upon installation [1][2]. 2. Interaction with npm: Even when Corepack is enabled, its shims for npm are not installed unless explicitly requested, because npm is already distributed with Node.js [3][4]. Consequently, Corepack does not intercept calls to npm; the global npm remains the default [1][2]. 3. Distribution Status: Corepack is distributed with Node.js versions 14.19.0 up to (but not including) 25.0.0 [3][5]. Future versions of Node.js will no longer include Corepack [5]. If you are using a specific version like npm 26 (or any other version), the behavior remains consistent: Corepack requires manual activation and does not manage npm by default [1][2].
Citations:
- 1: https://nodejs.org/docs/v22.14.0/api/corepack.html
- 2: https://nodejs.org/download/release/v23.7.0/docs/api/corepack.html
- 3: https://github.com/nodejs/corepack/
- 4: https://www.npmjs.com/package/corepack
- 5: https://nodejs.org/docs/latest-v23.x/api/corepack.html
🌐 Web query:
Node v26.3.0 npm version
💡 Result:
Node.js version 26.3.0, released on June 1, 2026 [1][2], includes npm version 11.16.0 [3][4][5].
Citations:
- 1: https://nodejs.org/en/blog/release/v26.3.0
- 2: https://github.com/nodejs/node/releases/tag/v26.3.0
- 3: https://nodejs.org/download/release/index.tab
- 4: https://versionlog.com/nodejs/26/
- 5: https://nodejs.org/en/download/archive/v26.3.0
🌐 Web query:
npm 12.0.2 release notes Node 26
💡 Result:
npm 12.0.2 was released on July 27, 2026 [1][2][3]. It is a maintenance release for the npm 12 CLI that includes bug fixes and minor internal improvements [1][4]. Key changes in npm 12.0.2 include: - Bug fixes: Included patches for 'pack' command behavior (honoring min-release-age-exclude) and 'owner' command improvements (using scoped registries for user lookups) [1][4]. - Documentation: Clarified breaking changes related to 'unknown-config' in the npm 12 changelogs [1][4]. - Chores: Updated internal node integration to correctly parse 'pack --json' object output [1][4]. Regarding Node.js 26: Node.js 26 is the current active release line as of August 3, 2026, having been first released on May 5, 2026 [5][6][7]. It is scheduled to enter Long-Term Support (LTS) on October 28, 2026 [5][7][8]. npm 12.0.2 is included in the Node.js 26 ecosystem via dependency updates in the Node.js repository [4]. While npm 12 is the current version associated with newer Node.js releases, the npm project and Node.js release teams have confirmed that npm 12 will not be backported to older Node.js versions [4].
Citations:
- 1: https://docs.npmjs.com/cli/v12/using-npm/changelog/
- 2: https://newreleases.io/project/npm/npm/release/12.0.2
- 3: https://github.com/npm/cli/releases
- 4: deps: upgrade npm to 12.0.2 nodejs/node#64882
- 5: https://github.com/nodejs/release
- 6: https://nodejs.org/en/about/previous-releases
- 7: https://github.com/nodejs/Release/blob/main/README.md
- 8: Release plan – v26.x Current nodejs/Release#1152
Activate npm 12.0.2 explicitly before npm commands.
packageManager: "npm@12.0.2" only identifies the intended package manager; it does not make bare npm use npm 12.0.2. With engines.node set to >=26.5.1, every bootstrap and CI path that runs npm should explicitly activate the specified version or assert npm --version.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` around lines 6 - 8, Update the package bootstrap and CI command
paths associated with the packageManager declaration to explicitly activate npm
12.0.2 before running npm commands, or validate the active version with npm
--version and fail on mismatch. Keep the existing packageManager value as the
single version source and ensure all relevant bare-npm execution paths enforce
it.
| "allowScripts": { | ||
| "msw": true |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
npm ls msw --all --json
npm install-scripts lsRepository: evertonschuster/Agenza
Length of output: 1765
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- package.json relevant allowScripts ---\n'
node - <<'JS'
const fs = require('fs');
const pkg = JSON.parse(fs.readFileSync('package.json','utf8'));
console.log(JSON.stringify(pkg.allowScripts, null, 2));
JS
printf '\n--- package-lock.json msw entries ---\n'
node - <<'JS'
const fs = require('fs');
const lock = JSON.parse(fs.readFileSync('package-lock.json','utf8'));
const entries = [];
for (const [k,v] of Object.entries(lock.packages || {})) {
if (k.includes('/msw') || k === 'node_modules/msw') {
entries.push({path:k, version:(v.version||'-'), resolved:(v.resolved||'-'), dev:(v.dev||false)});
}
}
for (const e of entries) console.log(JSON.stringify(e));
JS
printf '\n--- npm version and available npm-approve-scripts ---\n'
npm --version
npm help npm-approve-scripts >/tmp/npm-help-approve.txt 2>&1 || true
sed -n '1,120p' /tmp/npm-help-approve.txtRepository: evertonschuster/Agenza
Length of output: 251
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- package.json relevant allowScripts ---'
node - <<'JS'
const fs = require('fs');
const pkg = JSON.parse(fs.readFileSync('package.json','utf8'));
console.log(JSON.stringify(pkg.allowScripts, null, 2));
JS
printf '%s\n' ''
printf '%s\n' '--- package-lock.json msw entries ---'
node - <<'JS'
const fs = require('fs');
const lock = JSON.parse(fs.readFileSync('package-lock.json','utf8'));
const entries = [];
for (const [k,v] of Object.entries(lock.packages || {})) {
if (k.includes('/msw') || k === 'node_modules/msw') {
entries.push({path:k, version:(v.version||'-'), resolved:(v.resolved||'-'), dev:(v.dev||false)});
}
}
for (const e of entries) console.log(JSON.stringify(e));
JS
printf '%s\n' ''
printf '%s\n' '--- npm version and npm-approve-scripts help ---'
npm --version
npm help npm-approve-scripts >/tmp/npm-help-approve.txt 2>&1 || true
sed -n '1,120p' /tmp/npm-help-approve.txtRepository: evertonschuster/Agenza
Length of output: 631
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- npm approve-scripts docs ---'
npm help approve-scripts >/tmp/npm-help-approve.txt 2>&1 || true
sed -n '1,160p' /tmp/npm-help-approve.txtRepository: evertonschuster/Agenza
Length of output: 383
🌐 Web query:
npm-cli approve-scripts allowScripts package name version documented behavior
💡 Result:
The npm-cli commands npm approve-scripts and npm deny-scripts are utilities for managing the allowScripts field in a project's package.json file [1][2]. This field provides a mechanism to control which dependency install scripts (preinstall, install, postinstall, and prepare for non-registry sources) are permitted to run [1][3][4]. In newer versions of the npm CLI, these operations have been namespaced under npm install-scripts (e.g., npm install-scripts approve and npm install-scripts deny), with approve-scripts and deny-scripts remaining as supported aliases [3][5]. Key behavioral and documentation details include: Project Context Requirement: These commands operate only within projects that contain a package.json file [1][3]. They cannot be used globally (e.g., npm install -g), where the allow-scripts configuration or CLI flags must be used instead [1][4]. Asymmetric Pinning: By default, npm approve-scripts writes pinned entries (e.g., pkg@1.2.3) to the allowScripts field to restrict approval to the specific version reviewed [1][6][7]. Users can opt for "name-only" approval (allowing any version) by using the --no-allow-scripts-pin flag [1][3][6]. Conversely, npm deny-scripts always writes name-only entries ("pkg": false) to ensure a denied package is blocked regardless of its version [2]. Command Operations: --all: Approves or denies every package currently containing unreviewed install scripts in the project [1][2]. --allow-scripts-pending: A read-only flag for approve-scripts (or npm install-scripts ls) that lists packages with install scripts not yet covered by the allowScripts policy [1][5][2]. Identity Matching: The commands match against the dependency's resolved identity (the registry's resolved URL), not the package's self-reported name, preventing issues with aliased dependencies [8][4][9]. Explicit Denials: If a package is listed with false in allowScripts, it is explicitly blocked; existing allow entries for that package are removed if it is subsequently denied [2][7]. The approve-scripts command will not override existing false entries [7].
Citations:
- 1: https://docs.npmjs.com/cli/v11/commands/npm-approve-scripts/
- 2: https://docs.npmjs.com/cli/v11/commands/npm-deny-scripts/
- 3: https://docs.npmjs.com/cli/v12/commands/npm-install-scripts/
- 4: https://docs.npmjs.com/cli/v12/using-npm/config/
- 5: feat: namespace install-script approval commands under npm install-scripts npm/cli#9629
- 6: https://fossies.org/windows/www/node-v26.3.0-win-x64.zip/node-v26.3.0-win-x64/node_modules/npm/docs/content/commands/npm-approve-scripts.md
- 7: npm/cli@7068d42
- 8: feat: Phase 1 of
allowScriptsopt-in install-script policy npm/cli#9360 - 9: feat: Phase 1 of
allowScriptsopt-in install-script policy npm/cli#9360
Pin the msw install-script approval to the resolved version.
"msw": true approves install scripts by package name, so a lockfile update to another msw version would pass approval without changing this entry. Use the current resolved identity from package-lock.json: "msw@2.15.0": true.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` around lines 27 - 28, Update the allowScripts entry for msw to
use the resolved package identity key "msw@2.15.0" instead of the unversioned
"msw" key, preserving the existing approval value.
| | Node | 26.5.1 (`.nvmrc`, `engines.node`) | Same — `nvm use` picks it up automatically | | ||
| | npm | 12.0.2 (`packageManager`) | Same | | ||
| | .NET | 10.0.302 (`backend/global.json`, `rollForward: latestPatch`) | Same | | ||
| | Python | 3.12 (`requires-python`, CI) | 3.12 (`.python-version`, `uv.lock`) | | ||
| | Python | 3.14.6 (`requires-python`, CI) | 3.14.6 (`.python-version`, `uv.lock`) | | ||
| | Docker | 29.5 | Same (container runtime for Aspire Postgres) | |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n 'requires-python|python-version:|^\| Python|^3\.14' \
ai-services/assistant-service/pyproject.toml \
ai-services/assistant-service/.python-version \
.github/workflows \
README.md \
docsRepository: evertonschuster/Agenza
Length of output: 721
Align the Python minimum with requires-python.
ai-services/assistant-service/pyproject.toml uses requires-python = ">=3.14,<3.15", so the supported package floor is Python 3.14, not Python 3.14.6. Keep the documented minimum at 3.14 and list 3.14.6 only as the CI/local .python-version and uv.lock pin, or raise requires-python to >=3.14.6,<3.15 if older 3.14 patches are not supported.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` around lines 48 - 52, Align the README Python requirement with
ai-services/assistant-service/pyproject.toml’s requires-python range: document
3.14 as the minimum, while identifying 3.14.6 only as the CI/local
.python-version and uv.lock pin. Alternatively, raise requires-python to
>=3.14.6,<3.15 if that pin is the intended minimum.
Source: Coding guidelines
1 participant
What changed
uv.lockpackage-lock.jsonCompatibility fixes
Validation
Summary by CodeRabbit
Updates
uv0.11.32.Bug Fixes
Documentation