Skip to content

fix: upgrade dependencies and repair CI compatibility - #692

Merged
pedronauck merged 5 commits into
mainfrom
fix/dependency-upgrades-ci
Oct 6, 2026
Merged

fix: upgrade dependencies and repair CI compatibility#692
pedronauck merged 5 commits into
mainfrom
fix/dependency-upgrades-ci

Conversation

@pedronauck

@pedronauck pedronauck commented Oct 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

What & why

Atualiza as dependências Go junto com as atualizações Bun já preparadas e corrige as incompatibilidades encontradas nas suítes e no uso real. O Go passa para 1.27.1, exigido pelo Tailscale atual, com os builders de CI/release alinhados.

  • Migra CEL para cel.dev/cel-go, Bubble Tea/Bubbles para v2 e ULID para v2. Usa a distribuição Go oficial do gVisor.
  • Adapta Vitest 5 e MSW 3; regenera o service worker. Alinha assistant-ui e remove os dois patches já incorporados upstream.
  • Corrige a restauração assíncrona do rascunho, preservando texto, edições concorrentes durante a hidratação e isolamento entre projetos. A regressão nova falha no código anterior e passa com o runtime real corrigido.
  • Mantém TypeScript 7 nativo para checagem e TypeScript 5.9.3 para a API de compilador exigida por openapi-typescript.
  • Preserva os seis nomes antigos de ícones Lucide na fronteira de leitura/entrada. Preserva bytes de artefatos já publicados quando o conteúdo descomprimido é idêntico, pois Go 1.27 mudou o gzip.
  • Prioriza os frames restaurados antes de montar conteúdos que medem layout. Corrige a regressão reproduzida de restauração de 12 janelas sem alterar o limite E2E de 500 ms.
  • Corrige os dois erros de formatação que deixavam o CI do main vermelho. As demais alterações Go são a migração mecânica de literais exigida pelo modernize no Go 1.27; asserções não foram relaxadas.

O TOML v1 permanece para edição de árvores preservando comentários, API ausente no v2 (também atualizado). O fork ACP existente foi mantido para preservar suas correções; o SDK oficial já está na versão atual.

Pesquisa feita com Context7 e documentação oficial. Exa foi tentado, mas a chave EXA_API_KEY não está disponível neste ambiente. O relatório registra fontes, exceções de compatibilidade e resultados.

Implementado e verificado por Codex.

How you verified it

  • make gate: passou em todas as etapas (integração, Mage, Go lint/race, codegen e 26 tarefas Bun).
  • Web: 693 arquivos, 7.009 testes passando; as 3 suítes afetadas somam 162 testes.
  • Builds de produção Web/site, typechecks e lint via Turbo: passaram. React Doctor: 100/100. Os avisos de otimização CSS/bundling também constam no job verde do main e não foram ocultados.
  • E2E Web partição 2 pelo comando oficial após a correção: 83/83 testes passaram em 14,2 minutos; restauração das 12 janelas em 76,1 ms, sem tarefas longas no arraste e com convergência aprovada. O Linux havia reproduzido 537,9/505,1 ms; diagnóstico pareado com CPU desacelerada mediu 550,7 ms antes e 488,9 ms depois. Instrumentação temporária removida e asserções originais preservadas. No CI Linux do commit final, os mesmos 83 testes passaram e a restauração mediu 450,1 ms, sem tarefas longas de arraste/convergência.
  • Catálogo: race/lint e comandos reais publish/validate; bytes e metadados publicados preservados. Leitura dos artefatos existentes limitada a 50 MiB, com regressão para rejeição acima do limite.
  • Migração SQLite com race e checkptr completo: passou mantendo o deadline e asserções originais.
  • CLI/API reais: seis ícones legados, atualização de cor e identidade preservada. Wizard interativo Bubble Tea concluído.
  • Navegador com build de produção: espaços e Unicode preservados após troca de projeto, edição adicional e reload. Dois laboratórios encerrados com teardown limpo.
  • CI do head 61620aa1c: execução principal aprovada, 35 checks verdes e 17 skips esperados, nenhum pendente/vermelho. Frontend passou na repetição isolada sem alteração de código: a busca do catálogo mediu 2,2 s após um timeout inicial de 5 s. Diagnóstico Linux com duas CPUs também passou: site isolado e site/UI/Web concorrentes (8.241 testes, caso em 434/782 ms). Todos os E2E, incluindo desktop e as quatro partições Web, passaram. O primeiro CI também identificou o baseUrl removido no TypeScript 7 do pacote de vídeos; configuração e seleção do compilador foram corrigidas.
  • Checkptr completo do head atual: aprovado: oito partições no commit final, incluindo a migração SQLite. A auditoria serializa testes instrumentados, preservando todos os casos, instrumentação e deadlines; a execução normal mantém quatro testes paralelos.

Relatório. Evidências locais em docs/qa/evidence/2026-10-05-dependency-upgrades/, seguindo a convenção Skeeper do repositório.

Impact

Auditoria única de impacto. Mantém IDs de ferramentas nativas, CLI/HTTP/UDS, hooks, extensões, config e isolamento. Nenhuma alteração de schema ou descarte de dados. A tradução de ícones permanece até v0.5.0 e depende da migração dos nomes persistidos antes de sua remoção. Skills oficiais continuam corretas. Cenários de identidade/compositor/desktop e notas de release foram atualizados.

  • make gate passes locally; this PR is delivered only after its required CI checks are green
  • New or changed behavior is covered by tests, or I explained above why not
  • If an agent wrote or co-wrote this, I named it above and verified the result myself

@vercel

vercel Bot commented Oct 5, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
compozy-site Ready Ready Preview Oct 6, 2026 2:54am UTC

Request Review

@coderabbitai

coderabbitai Bot commented Oct 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Repository: compozy/compozy/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 99bb1df7-4e6c-455b-8f25-4d047b78f31d
📥 Commits

Reviewing files that changed from the base of the PR and between 88815e1 and 61620aa.

⛔ Files ignored due to path filters (4)
  • .release-notes/dependency-upgrades.md is excluded by !**/*.md
  • docs/_memory/change-impact.md is excluded by !**/*.md
  • docs/qa/reports/2026-10-05-dependency-upgrades.md is excluded by !**/*.md
  • docs/qa/scenarios/ET-web-desktop-shell-lifecycle.md is excluded by !**/*.md
📒 Files selected for processing (1)
  • web/src/systems/os/components/os-window.tsx

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

The PR updates catalog archive publication, Go dependencies and data construction, profile icon handling, and MSW behavior. It also changes composer draft hydration, UI test setup, and test execution parallelism.

Changes

Catalog artifact publication

Layer / File(s) Summary
Archive validation and preservation
cmd/compozy-catalog/publish_sources.go, cmd/compozy-catalog/main_test.go		 Publication compares uncompressed archive contents and preserves prior archive bytes when contents match. It rejects oversized or invalid prior archives. Tests cover changed README content and the compressed-size limit.

Go model and dependency alignment

Layer / File(s) Summary
Dependency and CLI updates
go.mod, internal/cli/install.go, internal/cli/install_test.go, internal/...		 The Go version and dependency set change, including Bubble Tea v2, ULID v2, and CEL Go module paths. CLI install code and tests use Bubble Tea v2.
Flattened field construction
internal/...		 Go runtime code and fixtures assign workspace, hook payload, event summary, request, and state fields directly rather than using nested wrapper values. The described field values and processing paths remain unchanged.
Test lane parallelism
magefiles/gotest_lane.go, magefiles/gotest_lane_test.go, magefiles/test.go		 Safety arguments specify parallelism of four for the normal lane and one for full checkptr. Test no longer sets an explicit parallelism value.

Profile icon compatibility

Layer / File(s) Summary
Canonicalize legacy icon names
internal/profile/icons.go, internal/profile/lucide_icons.gen.txt, internal/profile/persistence.go, internal/profile/validation.go, internal/profile/manager_test.go		 Profile normalization and storage reads map six legacy icon slugs to current names. The catalog adds and removes icon names, and lifecycle tests cover the mappings.

MSW service worker and Storybook integration

Layer / File(s) Summary
Frame handling and worker lifecycle
web/.storybook/preview.ts, web/public/mockServiceWorker.js, web/src/**/mocks/__tests__/*, web/src/storybook/__tests__/*		 Storybook and mock-server tests use frame-based unhandled-event handling. The worker tracks client requests, waits for pending work during client closure, reports rejected requests, and updates passthrough and navigation response handling.

Web state and test tooling

Layer / File(s) Summary
Composer draft hydration
web/src/components/assistant-ui/hooks/session-composer-sync-store.ts, web/src/components/assistant-ui/__tests__/session-thread.test.tsx		 The store records composer text before draft hydration and suppresses matching stale observations while hydration is pending. A regression test checks that an edit made during hydration remains visible and is stored.
UI and schema updates
web/src/systems/dashboard/components/home-page-meta.tsx, web/src/test-setup.ts, packages/ui/src/test-setup.ts, web/src/systems/os/lib/*, web/src/systems/settings/lib/window-manager-layout-schema.ts, packages/site/components/site/*, patches/*		 The dashboard captures its date at mount. Test setup registers matchers explicitly. Window-manager schema transformations retain their mappings and defaults. The footer uses a module-level year constant, and two assistant-ui patch files are removed.

Go test execution

Layer / File(s) Summary
Parallelism arguments
magefiles/gotest_lane.go, magefiles/gotest_lane_test.go, magefiles/test.go		 The unit-test safety arguments set explicit parallelism by lane. The general Test task no longer sets an explicit parallelism value.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~60 minutes

Merge Risk: ⚪ Minimal · up to 61620

No actionable merge-blocking risk remains in the selected change.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 61620

The inspected window-overlay change preserves existing ownership and containment behavior. No introduced security issue was established, but the broader dependency and state-restoration changes are not fully verified here.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • inferred — The inspected behavior affects overlay mounting within each browser window surface. Its unchanged caller, host identity, and context contract provide no evidence of expanded attacker reachability or newly gained authority through this change.

Trust Boundaries and Controls

  • observed — Dialog and Sheet portals retain explicit-container precedence and their existing document.body fallback when no contextual host exists. The window provider and consumer guard use the same deferred host, withholding consumers during initial null state rather than introducing that fallback during initialization. This is UI containment, not an authorization or sandbox boundary.
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 11.90% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 84 functions across 55 files. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main change: dependency upgrades and compatibility fixes across Go, web tests, builds, and CI.
  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Oct 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

React Doctor found no new issues. 🎉

Reviewed by React Doctor for commit 61620aa.

@greptile-apps

greptile-apps Bot commented Oct 6, 2026 •
edited
Loading

Copy link
Copy Markdown

RetriggerConfidence Score: 5/5

[High risk] Go runtime and build toolchain upgrades across CI and dependencies.

The PR appears safe to merge based on the reviewed changes and resolved prior findings.

Summary

The PR upgrades Go and web dependencies, adapts compatibility-sensitive code and tests, and preserves existing profile icons and catalog artifacts. Since the previous review, it defers window-body mounting until restored frames commit and records the corresponding QA results.

Reviews (3) · Last reviewed commit: "perf: prioritize restored window frames ..."

greptile-apps[bot]
greptile-apps Bot reviewed Oct 6, 2026
View reviewed changes
Comment thread web/src/components/assistant-ui/hooks/session-composer-sync-store.ts Outdated
Comment thread cmd/compozy-catalog/publish_sources.go Outdated
coderabbitai[bot]
coderabbitai Bot previously approved these changes Oct 6, 2026
View reviewed changes
coderabbitai[bot]
coderabbitai Bot previously approved these changes Oct 6, 2026
View reviewed changes
@pedronauck
pedronauck merged commit 783376b into main Oct 6, 2026
85 of 87 checks passed
@pedronauck
pedronauck deleted the fix/dependency-upgrades-ci branch October 6, 2026 04:34
This was referenced Oct 5, 2026
Merged
Merged
Merged
Merged
Merged
Open

This branch was successfully deployed

1 active deployment
Preview — 61620aa1 Deployed Oct 6, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@greptile-apps greptile-apps[bot] greptile-apps[bot] left review comments
@coderabbitai coderabbitai[bot] coderabbitai[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@pedronauck