Skip to content

Upgrade all packages to latest versions for security #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ChristopherAlphonse wants to merge 2 commits into from
Closed

Upgrade all packages to latest versions for security #53

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e250d07
Upgrade all packages to latest versions for security
ChristopherAlphonse Dec 6, 2025
9d4beb0
Update biome.json
ChristopherAlphonse Dec 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion biome.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@
"style": {
"useConst": "error",
"useTemplate": "error",
"useShorthandArrayType": "error"

},
Comment on lines 50 to 54
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot Dec 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

find . -name "biome.json" -o -name ".biome.json" | head -5

Repository: ChristopherAlphonse/logger

Length of output: 82

🏁 Script executed:

cat biome.json | head -60

Repository: ChristopherAlphonse/logger

Length of output: 1236

🌐 Web query:

Biome v2 style rules migration removed recommendations

💡 Result:

Short answer: In Biome v2 the "style" rules were removed from the recommended set (they no longer emit errors by default). The v2 upgrade/migration tooling will try to preserve your prior behavior (the migrate command updates severities so previously-recommended style rules continue to error), but you should still review the migrated config because some rules were dropped from the recommended set and/or not migrated automatically (e.g., reports of specific rules like noDelete not being added back by migrate). [1][2][3]

What to do

  • Run the official migrate command: npx @biomejs/biome migrate --write and/or the ESLint/Prettier helpers. Review biome.json(.c) after migration. [4][1]
  • Manually re-enable any style rules you want to keep (set their severity in your config) if migrate didn’t restore them. [1][2]
  • If you find a rule missing that you expected to be migrated, check the Biome issue tracker and open a bug (example issue for noDelete). [3]

Sources
[1] Biome upgrade-to-v2 / migration notes (style rules no longer emit errors; migrate updates severities).
[2] Biome blog / v2 release notes (notes that style rules aren’t recommended anymore).
[3] GitHub issue showing an example rule (noDelete) that wasn’t migrated.
[4] Biome migrate docs (migrate CLI and ESLint/Prettier helpers).

🏁 Script executed:

python3 << 'EOF'
import json

try:
    with open('./biome.json', 'r') as f:
        content = f.read()
    json.loads(content)
    print("✓ JSON is valid")
except json.JSONDecodeError as e:
    print(f"✗ JSON is INVALID: {e}")
    print(f"  Error at line {e.lineno}, column {e.colno}")
    print(f"  Message: {e.msg}")
EOF

Repository: ChristopherAlphonse/logger

Length of output: 156

Fix invalid JSON syntax in the style section configuration.

The trailing comma on line 52 after "useTemplate": "error", followed by whitespace on line 53 creates malformed JSON. In Biome v2, style rules are no longer part of the recommended ruleset; if you had them previously enabled, explicitly set their severity or remove them.

Replace the blank line with one of these options:

   "style": {
     "useConst": "error",
     "useTemplate": "error",
-    
+    "useShorthandArrayType": "off"
   },

Or restore the rule if it should remain enabled:

   "style": {
     "useConst": "error",
     "useTemplate": "error",
+    "useShorthandArrayType": "error"
   },
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"style": {
"useConst": "error",
"useTemplate": "error",
"useShorthandArrayType": "error"
},
"style": {
"useConst": "error",
"useTemplate": "error",
"useShorthandArrayType": "off"
},
🤖 Prompt for AI Agents 
In biome.json around lines 50 to 54, the "style" object contains a trailing
comma after "useTemplate": "error" and an extraneous blank line which makes the
JSON invalid; to fix it either remove the trailing comma and blank line so the
object is valid, remove the entire "style" object if you no longer want those
rules, or explicitly list/restore any style rules you need with proper comma
placement and no blank dangling comma to ensure valid JSON.

"complexity": {
"noExcessiveCognitiveComplexity": "warn"
Expand Down
38 changes: 19 additions & 19 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,30 +48,30 @@
"example:error": "tsx examples/error-handling-demo.ts"
},
"dependencies": {
"chalk": "^5.3.0",
"chalk": "^5.6.2",
"crypto-js": "^4.2.0",
"ollama": "0.5.17",
"openai": "5.20.1"
"ollama": "0.6.3",
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot Dec 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Search for ollama imports and usage
rg -n --type=ts --type=js 'from\s+["\']ollama|import\s+.*\s+from\s+["\']ollama' -A 10

Repository: ChristopherAlphonse/logger

Length of output: 138

🏁 Script executed:

#!/bin/bash
# Also search for ollama usage more broadly
rg -n 'ollama' --type=ts --type=js --type=json -B 2 -A 2

Repository: ChristopherAlphonse/logger

Length of output: 13924

🏁 Script executed:

#!/bin/bash
# Check package.json for ollama version and dependencies
cat -n package.json | grep -A 5 -B 5 ollama

Repository: ChristopherAlphonse/logger

Length of output: 431

🌐 Web query:

ollama 0.6.3 release notes breaking changes API

💡 Result:

Short answer: There are no wide-reaching API signature breaks in v0.6.3, but one change can break integrations — the default access scope for newly created resources (models, tools, knowledge) is now private by default (so existing workflows that relied on new resources being public may fail unless you explicitly set scopes). See the 0.6.3 changelog (Apr 12, 2025). [1]

Relevant items:

  • Default access scopes set to private for all resources (breaking for integrations that assumed public defaults). [1]
  • Fixes around tool-server/session auth and tool-server indexing (restores previous behavior; not an API breaking change but relevant to tool integrations). [1]
  • Minor CLI/docation issues (e.g., /set parameter num_thread not listed) tracked on GitHub. [2]

Sources:

  • Ollama changelog — v0.6.3 (Apr 12, 2025). [1]
  • GitHub issue about /set parameter num_thread (related to v0.6.3). [2]

🌐 Web query:

ollama Node.js client 0.6.3 vs 0.5.17 compatibility

💡 Result:

Short answer: v0.6.3 (published in the ollama-js GitHub releases) is a newer release than the npm-published package (npm currently shows v0.5.17). v0.6.3 includes API additions (e.g., server version function, logprobs, browser websearch/webcrawl features) so it is not strictly a drop-in identical build to 0.5.17 — expect new features and small API surface changes; if you rely on the npm package, installing via npm currently yields 0.5.17. Sources: GitHub releases (v0.6.3) and npm/jsDelivr package listings. [1][2][3]

If you want, I can list the concrete API diffs or point to the exact commits/files that changed between 0.5.17 and 0.6.3.

Sources:

  • GitHub releases (v0.6.3 changelog). [1]
  • npm package page (shows v0.5.17). [2]
  • jsDelivr/npm registry listing showing available versions. [3]

🌐 Web query:

ollama-js npm package version 0.6.3 0.5.17

💡 Result:

I can't find an npm release for ollama@0.6.3. The npm registry shows latest published version 0.5.17. [1] jsDelivr/other CDNs list up to 0.6.2 but not 0.6.3. [2][3]

Sources:

  • npm package page (shows version 0.5.17). [1]
  • jsDelivr package listing (shows up to 0.6.2). [2]
  • jsDelivr CDN file index (versions list including 0.5.17, 0.6.2). [3]

🌐 Web query:

ollama Node.js client generate list API breaking changes

💡 Result:

Short summary of breaking changes affecting "generate" and "list" when upgrading Ollama clients (Node.js and others):

  • generate: old convenience overloads removed — clients must use the unified request form (a single generate request object) and the streaming handler pattern instead of string/prompt-based overloads. Example: replace generate(model, prompt, ...) with a single generate({ model, prompt, options, ... }) call (and use the streaming/observer API if streaming). [1][2]

  • list (models): listing APIs simplified — listModels/list (or equivalent) now return via the consolidated method and may throw a single library exception type; older variants or helper overloads were removed. Expect changed signatures and different error/exception types. [1]

  • Options/params rename/validation: certain option names accepted by Ollama native endpoints differ from OpenAI names (e.g., num_predict vs max_tokens); some endpoints now validate/reject unknown option keys. Update request option names to the native Ollama names. [3]

Pointers:

  • These changes were documented in client library changelogs (example: Ollama4j shows removal of generate overloads and simplification of listModels plus exception-type and signature changes). Adjust your Node.js client calls to the unified request-object patterns and native parameter names. [1]
  • Check the latest Ollama API docs for the exact request-field names for /api/generate and the current list/models endpoint before upgrading. [2][3]

Sources:
[1] Ollama4j changelog / releases (breaking changes: generate overloads removed; listModels simplified).
[2] Ollama API reference (generate endpoint request shape).
[3] Ollama GitHub issue re: native API option names (max_tokens vs num_predict).

Ollama version 0.6.3 does not exist on npm registry.

The package.json specifies "ollama": "0.6.3", but the npm registry only publishes up to version 0.5.17 (with 0.6.2 available on some CDNs). This version specification cannot be resolved and will cause installation failures. Update to an available version (e.g., 0.5.17 or 0.6.2 if available on your package registry). Verify the intended version and confirm it is actually published before merging.

🤖 Prompt for AI Agents 
In package.json around line 53, the dependency "ollama": "0.6.3" references a
non-existent npm version and will break installs; change the version to a
published release such as "0.5.17" (or "0.6.2" if your registry has it) and save
the file, then run npm install (or yarn) to verify resolution; if a newer
internal registry is intended, confirm and replace with the exact tag/registry
URL or move the dependency to a resolved source before merging.

"openai": "6.10.0"
},
"devDependencies": {
"@biomejs/biome": "^1.9.4",
"@semantic-release/changelog": "^6.0.0",
"@semantic-release/commit-analyzer": "^10.0.0",
"@semantic-release/git": "^10.0.0",
"@semantic-release/github": "^9.0.0",
"@semantic-release/npm": "^9.0.0",
"@biomejs/biome": "^2.3.8",
"@semantic-release/changelog": "^6.0.3",
"@semantic-release/commit-analyzer": "^13.0.1",
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot Dec 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

find . -name "package.json" -type f | head -5

Repository: ChristopherAlphonse/logger

Length of output: 84

🏁 Script executed:

cat -n package.json | sed -n '55,75p'

Repository: ChristopherAlphonse/logger

Length of output: 886

🌐 Web query:

semantic-release 25.0.2 breaking changes release notes

💡 Result:

v25.0.2 (2025-11-07) contains only a bugfix (update of read-package-up) and lists no breaking changes. The breaking changes for the v25 series were introduced in v25.0.0: raised minimum Node.js requirements (minimum for v24 range is v24.10.0 and a minimum of Node v22.14 is now required). [1]

Sources:
[1] semantic-release releases (v25.0.2 and v25.0.0) — GitHub.

🏁 Script executed:

find . -path ./.git -prune -o -type f \( -name ".github" -o -name ".gitlab-ci.yml" -o -name ".circleci" \) -print 2>/dev/null | head -10

Repository: ChristopherAlphonse/logger

Length of output: 52

🏁 Script executed:

find . -type f \( -name ".github" -o -name "*.yml" -o -name "*.yaml" \) | grep -E "(workflow|\.github|ci)" | head -20

Repository: ChristopherAlphonse/logger

Length of output: 338

🏁 Script executed:

cat -n package.json | grep -A 5 -B 5 "engines"

Repository: ChristopherAlphonse/logger

Length of output: 359

🏁 Script executed:

find . -type f \( -name ".nvmrc" -o -name ".node-version" -o -name ".tool-versions" \) 2>/dev/null

Repository: ChristopherAlphonse/logger

Length of output: 78

🏁 Script executed:

cat -n .nvmrc

Repository: ChristopherAlphonse/logger

Length of output: 91

🏁 Script executed:

cat -n .github/workflows/semantic-release.yml

Repository: ChristopherAlphonse/logger

Length of output: 8116

Update Node.js version to satisfy semantic-release v25.0.2 requirements.

The CI/CD release workflow is incompatible with the semantic-release v25 dependencies. semantic-release v25.0.2 requires Node.js v22.14+ or v24.10.0+, but the release pipeline (.github/workflows/semantic-release.yml) and .nvmrc are configured for Node 20.x. Update the following:

  • .nvmrc: change from 20.0.0 to 22.14.0 (or higher v22/v24)
  • .github/workflows/semantic-release.yml: change node-version: 20.x to 22.x or 24.x in all three job setups (lines 33, 89, 155, 193)
  • package.json engines: change node >=20.0.0 to node >=22.14.0
🤖 Prompt for AI Agents 
In package.json around line 59 (and also update related CI files .nvmrc and
.github/workflows/semantic-release.yml at the lines noted in the review), the
Node engine requirement must be bumped to satisfy semantic-release v25.0.2:
change package.json "engines" entry from "node >=20.0.0" to "node >=22.14.0";
update .nvmrc from 20.0.0 to 22.14.0 (or a newer 22/24 LTS); and in
.github/workflows/semantic-release.yml replace node-version: 20.x with
node-version: 22.x (or 24.x) at the specified job locations (lines ~33, ~89,
~155, ~193), then run CI locally or via a test workflow to verify the new Node
version resolves the semantic-release dependency requirement.

"@semantic-release/git": "^10.0.1",
"@semantic-release/github": "^12.0.2",
"@semantic-release/npm": "^13.1.2",
"@semantic-release/release-notes-generator": "^14.1.0",
"@types/crypto-js": "^4.2.2",
"@types/jest": "^29.5.12",
"@types/node": "^24.9.1",
"jest": "^29.7.0",
"rimraf": "^5.0.5",
"semantic-release": "^21.0.0",
"ts-jest": "^29.1.2",
"tslib": "^2.8.0",
"tsx": "^4.19.2",
"typescript": "^5.6.3",
"vite": "^7.0.5",
"@types/jest": "^30.0.0",
"@types/node": "^24.10.1",
"jest": "^30.2.0",
"rimraf": "^6.1.2",
"semantic-release": "^25.0.2",
"ts-jest": "^29.4.6",
"tslib": "^2.8.1",
"tsx": "^4.21.0",
"typescript": "^5.9.3",
"vite": "^7.2.6",
"vite-plugin-dts": "^4.5.4"
},
"engines": {
Expand Down
Loading