[janithjay]

Purpose

Two CI checks fail on main and on every PR. This PR fixes both.

1. E2E tests. thunder-id/samples#12 moved the quickstarts from pnpm to npm. We still install them with pnpm, which blocks their build scripts (ERR_PNPM_IGNORED_BUILDS), so the install fails before any test runs.

2. Security audit. pnpm audit --audit-level=high reports new advisories:

• next (critical GHSA-2464-fhr4-w9xw, high GHSA-p3m5-59mp-jv5r): 15.5.25. Patched in 15.5.28.
• dompurify (critical GHSA-cg2g-xh64-v4q7, high GHSA-mrv2-3pqr-j5jr): 3.4.13. Patched in 3.4.17.
• zod (high GHSA-mrhx-c7xc-m3w5): 4.4.3 through eslint-plugin-react-hooks. Patched in 4.6.6.
• body-parser (high GHSA-27r3-jxmh-p828): 1.20.6 through express. Patched in 1.20.9 / 2.4.0.
• undici (high GHSA-xjj6-f33q-929c): 7.30.0 in tests/e2e. Patched in 7.30.1.

Approach

E2E

• prepare-samples.ts: write the local SDK tarballs into each quickstart's package.json (overrides, plus the direct dependencies) and install with npm install.
• run-e2e-suite/action.yml and run-e2e.sh: start the quickstarts with npx --no-install instead of pnpm exec.

Security audit (followed fix-npm-vulnerability; no new overrides needed)

• next → 15.5.28 (packages/nextjs, playgrounds/nextjs), dompurify → 3.4.17 (catalog), undici → ^7.30.1 (tests/e2e).
• zod: lockfile refreshed to 4.6.7; the existing range already allows it.
• body-parser: removed the body-parser and body-parser>qs overrides. They forced express 5 onto body-parser 1.x. Without them, express resolves the patched body-parser@2.4.0 and qs@6.16.1.
• pnpm-lock.yaml only changes the packages above and their own dependencies.

Related Issues

• N/A

Related PRs

• Add README banners for every sample, a skill to render them, and switch the samples to npm samples#12

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.
• Cross-SDK parity. Exactly one of parity/prs-raised or parity/prs-not-needed added.
  • If parity/prs-raised, the port links are posted as a reply on the parity check's comment.

Security checks

• Followed secure coding standards.
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

[github-actions]

🔀 Cross-SDK feature parity, no ports needed

This pull request is labelled parity/prs-not-needed: nothing here has to ship in the other ThunderID SDKs. If that changes, swap the label for parity/prs-raised.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: thunder-id/javascript-sdks
• Branch: main
• File: .coderabbit.yaml
• Commit: ecd5729
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: d70179f9-0f22-4952-b077-43e05afa723a

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.