Security Audit and fixes#1716
Merged
Merged
Conversation
|
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughThis pull request systematically restructures documentation metadata handling by removing metadata exports from MDX content files and adding corresponding Next.js page modules that import and re-export metadata. It also refactors theme cookie management from Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~65 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
This was referenced Mar 30, 2026
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (4)
docs/app/docs/components/toggle-group/page.tsx (1)
1-8: Clean Next.js App Router migration pattern!This file correctly implements the Next.js 13+ App Router pattern for separating metadata and content. The structure is clean and follows conventions properly.
Optional: Add explicit type annotations for enhanced type safety
While TypeScript's inference handles this well, you could optionally add explicit types:
+import type { Metadata } from 'next' import toggleGroupMetadata from './seo' import Content from './content.mdx' -export const metadata = toggleGroupMetadata +export const metadata: Metadata = toggleGroupMetadata -export default function Page() { +export default function Page(): JSX.Element { return <Content /> }This is purely a nice-to-have improvement for explicitness.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/app/docs/components/toggle-group/page.tsx` around lines 1 - 8, This file is fine as-is; keep the current export of metadata from toggleGroupMetadata and the default Page component returning <Content />; if you want the optional type-safety improvement, add explicit type annotations by typing the exported metadata (e.g., declare metadata: Metadata = toggleGroupMetadata) and annotate the Page component signature (e.g., function Page(): JSX.Element) while leaving Content and toggleGroupMetadata usage unchanged.docs/app/docs/components/badge/page.tsx (1)
4-4: Consider adding explicit type annotations.While TypeScript can infer the types, adding explicit annotations would improve type safety and developer experience:
📘 Optional type annotations
+import type { Metadata } from 'next' + import badgeMetadata from './seo' import Content from './content.mdx' -export const metadata = badgeMetadata +export const metadata: Metadata = badgeMetadata -export default function Page() { +export default function Page(): JSX.Element { return <Content /> }Also applies to: 6-8
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/app/docs/components/badge/page.tsx` at line 4, The exported const metadata currently lacks an explicit type annotation (it is set to badgeMetadata); add a specific type annotation (e.g., import and use the appropriate Metadata type) and annotate the export as export const metadata: Metadata = badgeMetadata; also apply the same explicit type annotations to the other exports mentioned (lines 6–8) so each exported symbol has a clear declared type.docs/app/docs/components/strong/page.tsx (1)
4-4: Optional: Add explicit type annotation for metadata.Consider importing and using the
Metadatatype from Next.js for better type safety and self-documentation.📝 Optional type safety improvement
+import type { Metadata } from 'next' import strongMetadata from './seo' import Content from './content.mdx' -export const metadata = strongMetadata +export const metadata: Metadata = strongMetadata🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/app/docs/components/strong/page.tsx` at line 4, Annotate the exported metadata with Next.js's Metadata type: import the Metadata type from 'next' and change the export to explicitly type the symbol metadata (e.g., export const metadata: Metadata = strongMetadata) so the exported metadata is statically typed while still assigning the existing strongMetadata value.docs/tsconfig.json (1)
36-40: Consider cleaning up explicit.jsfile includes.These specific
.jsfile paths in theincludearray appear to be legacy entries. With"allowJs": trueand"**/*.ts","**/*.tsx"globs already present, these explicit includes are likely redundant unless they serve a specific purpose for type checking isolated JavaScript files.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/tsconfig.json` around lines 36 - 40, The tsconfig include array contains explicit .js entries ("app/docs/first-steps/installation/page.js", "app/docs/first-steps/introduction/page.js", "app/layout.js", "app/docs/first-steps/usage/page.js", "app/docsv2/page.mdx") that are likely redundant given "allowJs": true and the existing "**/*.ts"/"**/*.tsx" globs; remove these explicit .js/.mdx paths from the include array (or replace them with a broader glob like "**/*.{js,jsx,mdx}" if you intentionally need to type-check isolated JS/MDX files) so tsconfig only includes the intended file patterns, and verify no tests or build steps relied on those explicit entries after the change.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@docs/components/Main/NavBar/helpers/NavRoot/index.tsx`:
- Around line 135-138: The cookie-setting call using setThemeCookie('darkMode',
String(toggledState), { maxAge: 30 * 24 * 60 * 60, path: '/' }) is using an
unsupported js-cookie option; replace the maxAge option with expires (in days)
so the dark-mode cookie persists across sessions—e.g., set expires: 30 and keep
path: '/' and the same name/value; update the setThemeCookie invocation (and any
related helper wrapper) to use expires instead of maxAge.
In `@docs/components/navigation/Navigation.tsx`:
- Line 29: The current check for docs routes uses pathname.includes("/docs/")
which produces false positives (e.g., "/foo/docs/bar"); update the logic that
sets sections (the assignment using pathname, docsSections, defaultSections) to
use a stricter root-prefix check such as pathname.startsWith("/docs/") or a
regex like /^\/docs(\/|$)/ so only routes that begin with "/docs" select
docsSections; modify the expression that computes sections accordingly.
In `@package.json`:
- Around line 214-216: The lint-staged glob pattern "/*.{js,jsx,ts,tsx}" wrongly
starts with a slash so it won't match staged root-level files; update the
lint-staged config to remove the leading slash (change "/*.{js,jsx,ts,tsx}" to
"*.{js,jsx,ts,tsx}") so ESLint --fix runs on root JS/TS files, and verify the
pattern is used where lint-staged entries are defined.
---
Nitpick comments:
In `@docs/app/docs/components/badge/page.tsx`:
- Line 4: The exported const metadata currently lacks an explicit type
annotation (it is set to badgeMetadata); add a specific type annotation (e.g.,
import and use the appropriate Metadata type) and annotate the export as export
const metadata: Metadata = badgeMetadata; also apply the same explicit type
annotations to the other exports mentioned (lines 6–8) so each exported symbol
has a clear declared type.
In `@docs/app/docs/components/strong/page.tsx`:
- Line 4: Annotate the exported metadata with Next.js's Metadata type: import
the Metadata type from 'next' and change the export to explicitly type the
symbol metadata (e.g., export const metadata: Metadata = strongMetadata) so the
exported metadata is statically typed while still assigning the existing
strongMetadata value.
In `@docs/app/docs/components/toggle-group/page.tsx`:
- Around line 1-8: This file is fine as-is; keep the current export of metadata
from toggleGroupMetadata and the default Page component returning <Content />;
if you want the optional type-safety improvement, add explicit type annotations
by typing the exported metadata (e.g., declare metadata: Metadata =
toggleGroupMetadata) and annotate the Page component signature (e.g., function
Page(): JSX.Element) while leaving Content and toggleGroupMetadata usage
unchanged.
In `@docs/tsconfig.json`:
- Around line 36-40: The tsconfig include array contains explicit .js entries
("app/docs/first-steps/installation/page.js",
"app/docs/first-steps/introduction/page.js", "app/layout.js",
"app/docs/first-steps/usage/page.js", "app/docsv2/page.mdx") that are likely
redundant given "allowJs": true and the existing "**/*.ts"/"**/*.tsx" globs;
remove these explicit .js/.mdx paths from the include array (or replace them
with a broader glob like "**/*.{js,jsx,mdx}" if you intentionally need to
type-check isolated JS/MDX files) so tsconfig only includes the intended file
patterns, and verify no tests or build steps relied on those explicit entries
after the change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 268d4a4d-d46e-4c50-b627-55db6973dbdb
⛔ Files ignored due to path filters (3)
docs/package-lock.jsonis excluded by!**/package-lock.jsondocs/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlpackage-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (84)
.eslintrc.cjsdocs/.eslintrc.jsondocs/app/docs/components/accordion/content.mdxdocs/app/docs/components/accordion/page.tsxdocs/app/docs/components/alert-dialog/content.mdxdocs/app/docs/components/alert-dialog/page.tsxdocs/app/docs/components/aspect-ratio/content.mdxdocs/app/docs/components/aspect-ratio/page.tsxdocs/app/docs/components/avatar-group/content.mdxdocs/app/docs/components/avatar-group/page.tsxdocs/app/docs/components/avatar/content.mdxdocs/app/docs/components/avatar/page.tsxdocs/app/docs/components/badge/content.mdxdocs/app/docs/components/badge/page.tsxdocs/app/docs/components/blockquote/content.mdxdocs/app/docs/components/blockquote/page.tsxdocs/app/docs/components/button/content.mdxdocs/app/docs/components/button/page.tsxdocs/app/docs/components/callout/content.mdxdocs/app/docs/components/callout/page.tsxdocs/app/docs/components/card/content.mdxdocs/app/docs/components/card/page.tsxdocs/app/docs/components/code/content.mdxdocs/app/docs/components/code/page.tsxdocs/app/docs/components/dialog/content.mdxdocs/app/docs/components/dialog/page.tsxdocs/app/docs/components/em/content.mdxdocs/app/docs/components/em/page.tsxdocs/app/docs/components/heading/content.mdxdocs/app/docs/components/heading/page.tsxdocs/app/docs/components/kbd/content.mdxdocs/app/docs/components/kbd/page.tsxdocs/app/docs/components/progress/content.mdxdocs/app/docs/components/progress/page.tsxdocs/app/docs/components/separator/content.mdxdocs/app/docs/components/separator/page.tsxdocs/app/docs/components/strong/content.mdxdocs/app/docs/components/strong/page.tsxdocs/app/docs/components/switch/content.mdxdocs/app/docs/components/switch/page.tsxdocs/app/docs/components/table/content.mdxdocs/app/docs/components/table/page.tsxdocs/app/docs/components/tabs/content.mdxdocs/app/docs/components/tabs/page.tsxdocs/app/docs/components/text/content.mdxdocs/app/docs/components/text/page.tsxdocs/app/docs/components/toggle-group/content.mdxdocs/app/docs/components/toggle-group/page.tsxdocs/app/docs/components/toggle/content.mdxdocs/app/docs/components/toggle/page.tsxdocs/app/docs/components/tooltip/content.mdxdocs/app/docs/components/tooltip/page.tsxdocs/app/docs/components/visually-hidden/content.mdxdocs/app/docs/components/visually-hidden/page.tsxdocs/app/docs/contributing/before-you-start/content.mdxdocs/app/docs/contributing/before-you-start/page.tsxdocs/app/docs/contributing/component-coverage/content.mdxdocs/app/docs/contributing/component-coverage/page.tsxdocs/app/docs/contributing/component-maturity-rubric/content.mdxdocs/app/docs/contributing/component-maturity-rubric/page.tsxdocs/app/docs/contributing/contributing-to-rad-ui/content.mdxdocs/app/docs/contributing/contributing-to-rad-ui/page.tsxdocs/app/docs/contributing/setting-up-dev-environment/content.mdxdocs/app/docs/contributing/setting-up-dev-environment/page.tsxdocs/app/docs/first-steps/installation/content.mdxdocs/app/docs/first-steps/installation/page.tsxdocs/app/docs/first-steps/introduction/content.mdxdocs/app/docs/first-steps/introduction/page.tsxdocs/app/docs/first-steps/usage/content.mdxdocs/app/docs/first-steps/usage/page.tsxdocs/app/docs/guides/accessibility/content.mdxdocs/app/docs/guides/accessibility/page.tsxdocs/app/docs/guides/component-coverage/content.mdxdocs/app/docs/guides/component-coverage/page.tsxdocs/components/Main/Main.jsdocs/components/Main/NavBar/helpers/NavRoot/index.tsxdocs/components/Main/NavBar/index.jsdocs/components/navigation/Navigation.tsxdocs/eslint.config.mjsdocs/next.config.jsdocs/package.jsondocs/tsconfig.jsonpackage.jsonsrc/components/ui/Slider/stories/Slider.stories.tsx
💤 Files with no reviewable changes (37)
- docs/app/docs/components/code/content.mdx
- docs/app/docs/components/accordion/content.mdx
- docs/app/docs/components/strong/content.mdx
- docs/app/docs/components/badge/content.mdx
- docs/app/docs/components/heading/content.mdx
- docs/.eslintrc.json
- docs/app/docs/components/blockquote/content.mdx
- docs/app/docs/components/avatar/content.mdx
- docs/app/docs/components/aspect-ratio/content.mdx
- docs/app/docs/components/card/content.mdx
- docs/app/docs/components/text/content.mdx
- docs/app/docs/components/separator/content.mdx
- docs/app/docs/components/button/content.mdx
- docs/app/docs/components/callout/content.mdx
- docs/app/docs/components/progress/content.mdx
- docs/app/docs/components/em/content.mdx
- docs/app/docs/components/tabs/content.mdx
- docs/app/docs/components/kbd/content.mdx
- docs/app/docs/components/visually-hidden/content.mdx
- docs/app/docs/first-steps/usage/content.mdx
- docs/app/docs/guides/component-coverage/content.mdx
- docs/app/docs/components/avatar-group/content.mdx
- docs/app/docs/contributing/setting-up-dev-environment/content.mdx
- docs/app/docs/contributing/component-maturity-rubric/content.mdx
- docs/app/docs/components/tooltip/content.mdx
- docs/app/docs/components/table/content.mdx
- docs/app/docs/first-steps/installation/content.mdx
- docs/app/docs/contributing/before-you-start/content.mdx
- docs/app/docs/components/toggle-group/content.mdx
- docs/app/docs/components/dialog/content.mdx
- docs/app/docs/first-steps/introduction/content.mdx
- docs/app/docs/contributing/component-coverage/content.mdx
- docs/app/docs/components/switch/content.mdx
- docs/app/docs/components/toggle/content.mdx
- docs/app/docs/guides/accessibility/content.mdx
- docs/app/docs/contributing/contributing-to-rad-ui/content.mdx
- docs/app/docs/components/alert-dialog/content.mdx
This was referenced Mar 30, 2026
Contributor
CoverageThis report compares the PR with the base branch. "Δ" shows how the PR affects each metric.
Coverage improved or stayed the same. Great job! Run |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR applies the current security dependency updates and fixes the regressions introduced by those upgrades so the repo remains buildable and testable.
What Changed
docs/docs/to its own flat ESLint config for the newer Next/ESLint stackSliderstory type regression introduced during verificationcontent.mdxand keepingmetadatainpage.tsxVerification
npm test -- --cinpm run lintnpm run check:typesnpm run check:exportsnpm run build:rollupnpm run build-storybookcd docs && npm run lintcd docs && npm run buildNotes
Toolbar/Comboboxfiles that are not part of this PRSummary by CodeRabbit
New Features
Chores