Skip to content

Updating packages and removing figma#484

Closed
bapplejax wants to merge 2 commits intomainfrom
updating-packages-04-07-2026
Closed

Updating packages and removing figma#484
bapplejax wants to merge 2 commits intomainfrom
updating-packages-04-07-2026

Conversation

@bapplejax
Copy link
Copy Markdown
Contributor

Description

Updating several packages and testing locally to ensure no more vulnerabilities.
Removed figma integration as was causing lodash version to have a critical vulnerability.

Motivation and Context

Many packages needed updating at once and moving to Vite major version.

How Has This Been Tested?

Locally running project

@bapplejax bapplejax requested a review from marshyski April 7, 2026 18:08
@bapplejax bapplejax self-assigned this Apr 7, 2026
Copilot AI review requested due to automatic review settings April 7, 2026 18:08
@codecov
Copy link
Copy Markdown

codecov bot commented Apr 7, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.59%. Comparing base (bb9d830) to head (1e6535b).

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #484      +/-   ##
==========================================
- Coverage   99.59%   99.59%   -0.01%     
==========================================
  Files          51       51              
  Lines         997      995       -2     
  Branches      346      344       -2     
==========================================
- Hits          993      991       -2     
  Misses          4        4              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates frontend/tooling dependencies to address vulnerabilities, including removing the Figma code-connect integration and moving the build tooling to a new major Vite version.

Changes:

  • Remove @figma/code-connect from devDependencies.
  • Upgrade Vite and related tooling (including @vitejs/plugin-react) and bump TypeScript.
  • Update Storybook’s Vite framework package version.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread package.json Outdated
Comment on lines 22 to 27
@@ -27,8 +27,7 @@
"unpublish:ui-kit": "npx figma connect unpublish"
Copy link

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

publish:ui-kit / unpublish:ui-kit still run npx figma connect ..., but @figma/code-connect has been removed from devDependencies (and there’s no other figma package in the lockfile). These scripts will now fail (or unexpectedly download a package at runtime via npx). Remove these scripts or replace them with the new intended publishing flow/tooling.

Copilot uses AI. Check for mistakes.
Comment thread package.json
Comment on lines 36 to 41
"@storybook/addon-a11y": "10.2.13",
"@storybook/addon-docs": "10.2.13",
"@storybook/addon-links": "10.2.13",
"@storybook/addon-vitest": "10.2.13",
"@storybook/react-vite": "10.2.13",
"@storybook/react-vite": "10.3.4",
"@testing-library/dom": "10.4.1",
Copy link

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@storybook/react-vite is bumped to 10.3.4, but the root storybook package and most Storybook addons are still pinned to 10.2.13. @storybook/react-vite@10.3.4 has a peerDependency on storybook ^10.3.4, so this version skew can lead to npm peer warnings and runtime incompatibilities. Align the Storybook-related packages to the same release (either all 10.3.4+ or revert @storybook/react-vite to 10.2.13).

Copilot uses AI. Check for mistakes.
Comment thread package.json
Comment on lines 45 to 49
"@types/node": "20.19.9",
"@types/react": "19.2.7",
"@vitejs/plugin-react": "^5.1.4",
"@vitejs/plugin-react": "^6.0.1",
"@vitest/browser-playwright": "^4.1.2",
"@vitest/coverage-v8": "^4.1.2",
Copy link

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

With the Vite/plugin updates, some dependencies now require newer Node versions (e.g., @vitejs/plugin-react@6 declares node ^20.19.0 || >=22.12.0). Consider adding an explicit engines.node constraint in package.json (and/or documenting it) so local dev/CI environments don’t drift onto unsupported Node versions.

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown
Member

@marshyski marshyski left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@bapplejax bapplejax closed this Apr 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants