[turip]

Patch the TypeSpec workspace test and generation dependency graph, covering its 14 high and 11 medium non-compiler Dependabot records. Align Vitest and coverage at 4.1.12, explicitly select Vite 8.1.6, and enforce patched devalue, fast-uri, js-yaml, postcss, and source-map-js versions. Include the nanoid patch identified by the live audit.

Validation:

• make update-openapi: regenerated OpenAPI, Python SDK, v3 SDKs, and Go API outputs without any tracked generated changes.
• make test-api-spec, Go emitter checks, generated TypeScript SDK type checks, and formatting checks for changed configuration files.
• Live audit leaves only the TypeSpec compiler/openapi3 advisory, addressed separately by the compiler upgrade PR.

The compiler and existing TypeSpec patches are unchanged in this PR.

Summary by CodeRabbit

• Chores
  • Updated development tooling and workspace package versions.

Confidence Score: 5/5

This PR appears safe to merge; no actionable issues were found.

Summary

Updates the TypeSpec workspace’s generation and test dependencies.

• TypeSpec tests and generators use patched dependency versions.

No actionable issues found. Tests and generation were not run during this review.

Acknowledgment: turip states that the remaining TypeSpec compiler/OpenAPI advisory is being addressed separately; this PR intentionally leaves the compiler unchanged.

_{Reviews (1) · Last reviewed commit: "fix(api/spec): patch generation and test..." · Reviewed by Greptile}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: openmeterio/openmeter
• Branch: feat/security-typespec-tooling
• File: .coderabbit.yaml
• Commit: 0635ea8
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 47fa75eb-e01a-48a5-ab70-5dadfd5a8acd

📥 Commits

Reviewing files that changed from the base of the PR and between 54ab862 and 0635ea8.

⛔ Files ignored due to path filters: 1

• api/spec/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing: 3

• api/spec/package.json
• api/spec/packages/typespec-go/package.json
• api/spec/pnpm-workspace.yaml

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📝 Walkthrough

The API spec development dependencies now use updated Vitest versions, and the API spec package adds Vite. The pnpm workspace adds six package overrides and removes comments about the Vite maturity-gate exclusion.

Changes: API spec dependencies

Layer / File(s)	Summary
Update API spec tooling dependencies api/spec/package.json, api/spec/packages/typespec-go/package.json	api/spec/package.json adds Vite 8.1.6 and updates @vitest/coverage-v8 and vitest to 4.1.12. The TypeSpec Go package updates vitest to 4.1.12.
Add workspace package overrides api/spec/pnpm-workspace.yaml	Adds version overrides for devalue, fast-uri, js-yaml, nanoid, postcss, and source-map-js. Removes comments about the Vite maturity-gate exclusion; the configuration value is unchanged.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Suggested reviewers: tothandras

Merge Risk: ⚪ Minimal · up to 0635e

The dependency updates and workspace overrides present no identified merge-blocking risk.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies dependency vulnerability fixes in the api/spec generation and test tooling, which matches the main changes.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}