chore(deps): bump @cloudflare/vite-plugin from 1.15.2 to 1.28.0 - #125
Closed
dependabot[bot] wants to merge 1 commit into
Closed
chore(deps): bump @cloudflare/vite-plugin from 1.15.2 to 1.28.0#125dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [@cloudflare/vite-plugin](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vite-plugin-cloudflare) from 1.15.2 to 1.28.0. - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vite-plugin-cloudflare/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vite-plugin@1.28.0/packages/vite-plugin-cloudflare) --- updated-dependencies: - dependency-name: "@cloudflare/vite-plugin" dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
This PR doesn't fully meet our contributing guidelines and PR template. What needs to be fixed:
Please edit this PR description to address the above within 2 hours, or it will be automatically closed. If you believe this was flagged incorrectly, please let a maintainer know. |
|
Thanks for your contribution! This PR doesn't have a linked issue. All PRs must reference an existing issue. Please:
See CONTRIBUTING.md for details. |
|
This pull request has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window. Feel free to open a new pull request that follows our guidelines. |
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/cloudflare/vite-plugin-1.28.0
branch
March 13, 2026 19:13
anandgupta42
added a commit
that referenced
this pull request
Jun 1, 2026
…bt/SQL (#856) * feat: [AI-REVIEW] dbt PR review — signed verdict engine, reviewer agent, CLI + Action Add `dbt-pr-review`: Cloudflare-style AI code review specialized for dbt/SQL. Every blocking verdict is backed by a deterministic engine call (column-lineage blast radius, query `equivalence`, PII classification, A–F grade) and signed into a replayable verdict envelope — not LLM prose. - `altimate/review/`: typed engine — `FindingV1`, rubric-as-data, signed `VerdictEnvelope`, non-LLM risk-tiering, dbt-aware diff filter, orchestrator, Dispatcher-backed runner, GitHub poster, `.altimate/review.yml` loader - `dbt_pr_review` tool + read-only `reviewer` agent + `/dbt-pr-review` skill - `altimate review` CLI command (local + CI; JSON/markdown; gate exit code) - general-purpose `github/review` Action (any customer repo) - 43 unit/integration tests; docs at `usage/dbt-pr-review.md` Safety invariant: undecidable `equivalence` downgrades to WARNING, never BLOCK. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * harden: deterministic dbt anti-pattern detector lane (2/13 → 14/14 catch rate) Empirically hardened dbt-pr-review against a 30-scenario corpus of real-world dbt/SQL PR failures (sourced from r/dataengineering, dbt-core issues, Datafold/ Tobiko/dbt blogs), validated in FULL mode against the altimate-bigquery-demo project (BigQuery, public thelook data). Root cause found: the engine fed RAW Jinja SQL to altimate-core, so static analysis (`check`/`equivalence`) returns nothing on real dbt models — baseline catch rate was 2/13. The high-frequency failures are dbt-STRUCTURAL (Jinja config, the diff, schema.yml) which the SQL-AST engine can't see, so they belong in the orchestrator. - `review/dbt-patterns.ts`: 13 conservative, high-precision detectors on the raw model + diff — LEFT→INNER-via-WHERE, cross join, fan-out-before-aggregate, incremental-without-is_incremental(), non-idempotent clock fns, materialization flip / incremental→table, SELECT *, NOT IN (nullable), ROW_NUMBER dedup without tiebreaker, surrogate-key change, partition-pruning-defeating function, COUNT distinctness change, PII-into-mart — plus schema.yml `unique`/`not_null` test removal. - New categories: `join_risk`, `fanout`, `dedup`, `sql_correctness` (+ blockOn). - Fix: resolve `manifestPath` against the review cwd, not `process.cwd()` — a relative path was silently missing and degrading every review to lint-only. - 18 detector unit tests; result: 14/14 corpus scenarios caught, 0 false positives on benign-change controls. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * harden: consume dbt-compiled SQL for the engine lanes + fix equivalence mapping Research (dbt-Fusion, Datafold, Recce, SQLFluff) confirmed the clean way to feed the SQL engine is dbt's OWN compiled output — render-then-analyze — NOT regex/ minijinja Jinja stripping. dbt-Fusion itself renders Jinja (a minijinja fork) then analyzes the rendered SQL. - `review/compiled.ts`: resolve `target/compiled/<project>/<model>` (HEAD) and `target-base/compiled/...` (BASE, Recce convention) — dbt's own rendered SQL. - orchestrate: engine lanes (equivalence/check/grade/PII) now consume COMPILED SQL when present; the `dbt-patterns` lane keeps RAW Jinja (it needs config/ is_incremental/etc.). Falls back to raw + stays undecidable when uncompiled — never fabricated. - `run.ts`: wire the compiled resolver (project name from dbt_project.yml). - runner equivalence mapping fix: the core flags column-reorder as `minor` but still sets equivalent:true for a row-changing filter (noting a `semantic` diff). Treat ANY semantic/major/breaking difference as NOT equivalent so a dropped/added-row predicate is never cleared as safe; band the engine's numeric confidence (0..1) to high/medium/low. Known core gap (filed separately): altimate-core `checkEquivalence` cannot yet produce a verdict on BigQuery COMPILED SQL (3-part backtick-quoted relations / dialect + schema-key resolution) — it decides correctly on parseable SQL but returns undecidable on real BQ output. That is a core (Rust) dialect fix, not a Jinja problem. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: dbt-pr-review — render-then-analyze (compiled SQL) + dbt-patterns lane Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * harden: +32 dbt anti-pattern detectors — 30 new real-world use-cases caught Expanded the deterministic dbt-patterns battery from 13 → 45 detectors and proved 30 previously-uncatchable use-cases now catch, live against the BigQuery-backed altimate-bigquery-demo (NEW-SCENARIO CATCH RATE: 30/30, 0 false positives; original 14-scenario harness still 14/14; benign-change controls clean). New detectors (all raw-SQL + diff, high precision, conservative severities): COALESCE/NVL removed, SELECT DISTINCT add/remove, UNION↔UNION ALL, GROUP BY grain change, DML/DDL in a model (critical), stray LIMIT, random()/uuid non-determinism, =/!= NULL, type narrowing (contract), full_refresh=true, incremental without unique_key, max()-subquery defeating partition pruning, ORDER BY without LIMIT, leading-wildcard LIKE, JOIN ON 1=1, hardcoded relation (vs ref/source), var() without default, hardcoded date literal, TIMESTAMP→date truncation, HAVING without GROUP BY, CASE without ELSE, removed WHERE predicate, comma/cross join, NATURAL JOIN, self-join, window without PARTITION BY, BETWEEN on timestamp, float equality, division without zero-guard, AND/OR without parens, OFFSET without ORDER BY, multiple COUNT(DISTINCT). +36 unit tests (incl. precision controls: benign additive column, division-by- literal, safe_divide all clean). 100 review tests pass; typecheck + marker clean. Eval harness: scripts/review_eval2.py in the demo repo. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * harden: declarative rule catalog — 208 self-verifying dbt/SQL review use-cases Adds a data-driven rule engine (review/rule-catalog.ts): each rule carries its match pattern, a positive `example` (must fire) and a `counter` (must stay clean), so the catalog is both the detector set AND its test corpus. This scales detection to hundreds of checks while staying high-precision, and complements the 45 programmatic detectors in dbt-patterns.ts. - 208 rules across SQL correctness, NULL handling, joins/fan-out, aggregation, windows, set ops, date/time, types, performance/cost, materialization, incremental, dbt conventions, tests/contracts, snapshots, security/PII, and warehouse-specific anti-patterns (BigQuery, Snowflake, Redshift, Databricks), plus style/maintainability. Sources: SQLFluff, dbt best-practice + warehouse docs, dbt-core issues, r/dataengineering. - Relevance gate: a rule only fires when its signal is IN THE DIFF, never on an unrelated edit to a matching file — verified 0 false positives on benign-change controls (additive column, comment-only, legit coalesce). - Self-test (review-rule-catalog.test.ts): all 208 examples fire, all counters stay clean, catalog >= 200. Live regression: original 14/14 + extended 30/30 still catch. 102 review tests pass; typecheck + marker clean. Total review coverage: 45 programmatic detectors + 208 catalog rules = 253 checks (vs ~2 real-world scenarios the original engine caught). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat: [AI-5980] scale dbt PR-review catalog to 1090 self-verified rules Add a data-driven rule-generator layer (`rule-generators.ts`) so the review catalog scales past 1000 distinct, real-world checks without hand-writing each literal. Each generated entry is a self-verifying rule (auto positive `example` + `counter`) validated by the existing self-test harness. - `genFns` — non-portable / dialect-specific functions across string, date/time, conditional/null, conversion, aggregate, JSON, array/struct, geospatial, hash/encoding, math/bitwise, window, system/session, Spark, BigQuery, Snowflake, Postgres, Redshift, Trino/DuckDB, try-safe, and legacy families. Curated to NON-standard names only (ANSI functions excluded for precision). - `genReserved` — reserved-word-as-alias checks (ANSI + warehouse keywords). - `genTypes` — non-portable type names used in `CAST`. - `genOps` — dialect-specific operators (`::`, `->>`, `#>>`, `@>`, `~*`, `<=>`). - Wire `GENERATED` into `CATALOG`; raise self-test floor to >= 1000. Result: 1090 rules total (45 detectors + 1090 catalog). All fire on their example, stay clean on their counter, no duplicate ids, verified flowing through the production `evaluateCatalog` path. 102 review tests pass; marker check clean; typecheck clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat: dbt PR review — LLM advisory layer + 3-layer trust orchestration Finalizes the reviewer as three cooperating layers ordered by trust, where only the deterministic engine can block: - Layer 3 (new): `ai-review.ts` — an LLM reviewer lane that reasons over the diff + compiled SQL + PR description, GROUNDED in the engine findings it must not duplicate. Transport only; the prompt and response parsing live in core. Clamped to <= warning so it enriches the review but never blocks. Bounded prompt (per-file diff cap, max files, timeout). - Layer 1/2 wiring: `orchestrate.ts` restructured around the trust ordering — engine findings (equivalence, lineage/blast-radius, PII, grade, AST lint) are authoritative; the deterministic catalog fills raw-diff/Jinja gaps; the LLM lane is advisory. Verdict invariant preserved: only layer-1 engine findings gate the merge. - AST migration: most dbt-specific detection moved into core AST/minijinja rules, so `dbt-patterns.ts` is slimmed and `rule-generators.ts` is removed (superseded by the self-verifying catalog + core rules). - Native bindings: `native/altimate-core.ts`, `types.ts`, `dbt/manifest.ts` expose the new core methods (AST lint, equivalence, structural diff, AI-review prompt/parse) through the dispatcher. Tests: review orchestration, dbt-patterns, rule catalog, native method registration, and dbt-manifest edge cases. Full altimate suite green (one pre-existing dbt-adapter spawn E2E failure, unrelated). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: dbt PR review — 3-layer architecture + real-world issue corpus - Rewrites the dbt PR Review page around the three-layer trust model (authoritative engine → deterministic catalog → advisory LLM reviewer), clarifying that only layer-1 engine findings block. - Adds the real-world issue corpus page — a sourced catalog of dbt/SQL pitfalls (Discourse/Slack/Reddit/SO/blogs), each a reproducible test the reviewer must catch with zero false positives on the correct version. - Registers both pages in the nav. - Updates the GitHub Action description to reflect the layered model (deterministic verdict + advisory LLM comments). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: dbt PR review eval harnesses + duckdb dev-dep Adds the reproducible evaluation harnesses referenced by the corpus docs: - `review-realworld-eval.ts` — detection + precision on the sourced issue corpus (must catch the bad version, zero FPs on the correct one). - `review-dialect-coverage.ts` — 10-dialect coverage check. - `review-value-eval.ts` — value-correctness eval (runs SQL on a local DuckDB, e.g. jaffle_shop). Moves `duckdb` to `devDependencies` — it is used only by these eval harnesses; runtime code uses `@altimateai/drivers/duckdb`, so it must not be a production dependency of the published CLI. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: dbt PR review — AI advisory lane can never block + per-item resilience Addresses the two TS findings from the consensus re-review of the LLM advisory layer. verdict.ts (M1, the headline invariant): advisory LLM findings could BLOCK the merge in `gate` mode. Core `clamp_to_advisory` emits `warning` for confident findings, the AI lane never marks confidence `unknown`, and the rule-2 warning-pattern threshold (default 3) counted them — so ≥3 AI warnings (or a prompt-injected "emit 5 warnings") forced REQUEST_CHANGES, violating the documented "advisory never blocks" contract. `computeIdealVerdict` now excludes AI findings (`evidence.tool === "ai-review"`) from the warning accumulation. ai-review.ts (M4 + robustness): one malformed parsed finding (e.g. an out-of-enum severity) made `makeFinding` throw, and the unguarded loop dropped the ENTIRE AI batch. Added a per-item try/catch (skip+log the bad item) and a transport-layer severity clamp (only `warning` survives; everything else → `suggestion`), replacing the blind `item.severity as Severity` cast — the lane can no longer emit `critical` regardless of what core returns. Adds a verdict regression test: ≥3 confident AI warnings (and a mixed batch) must stay COMMENT, not REQUEST_CHANGES. review.test.ts 64/0; full altimate suite green (1 pre-existing dbt-adapter E2E unrelated); typecheck + marker check clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: cap PR title length in AI-review prompt (bound injection surface) Consistency hardening from the consensus re-review: `prBody` was truncated to 1500 chars but `prTitle` was inserted verbatim, leaving an unbounded prompt / injection surface for an adversarially long title. Truncate the title to 200 chars to match the body cap. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: bump @altimateai/altimate-core 0.3.1 → 0.4.0 Picks up the released dbt-PR-review engine (core PR #125 + the consensus-review fixes: same-table EXCEPT soundness, L043 boolean-operator semantics, L015 qualifier-aware NULL guard), now published to npm as 0.4.0 — replacing the locally hand-swapped .node binding with the real release. Reconciles one stale lint expectation against the hardened engine: `altimate-core-native.test.ts` L041 — core tightened `TypedCoalesceMismatch` so `coalesce(col, 'false')` no longer fires (quoted 'false' is a string, not a boolean — a fixed false positive). Test now asserts L041 on a genuine clash (`coalesce(x, true, 'false')`), matching core's own regression. Full altimate suite green (3080 pass; the 1 fail is the pre-existing dbt-adapter spawn E2E, unrelated); typecheck + marker check clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(review-action): model + credential inputs for the advisory LLM lane The GitHub Action previously forwarded only GitHub env, so the optional layer-3 LLM reviewer had no way to receive a model or credentials when integrating into a target repo (e.g. altimate-ingestion) — it silently ran deterministic-only. Adds optional inputs and a configure step with two mutually-exclusive routes: - `altimate_api_key` (+ `altimate_instance`, `altimate_url`) → writes ~/.altimate/altimate.json → hosted altimate model. - `model` (+ `model_api_key`) → exports OPENCODE_CONFIG_CONTENT (model + provider apiKey) → bring-your-own provider. Neither set → the lane self-disables (deterministic-only), unchanged behaviour. The deterministic engine still needs no model/credentials; warehouse creds stay in the `dbt compile` step, never the review step. Adds `github/review/examples/altimate-ingestion.yml` — a complete copy-paste workflow (checkout depth-0 → dbt deps/compile/docs-generate → review) — and documents the two credential routes in the dbt PR Review docs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: add --no-ai to the dbt PR review CLI flags table The advisory LLM lane is now documented; surface its opt-out flag alongside the other review flags. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: address PR #856 code-review findings (cubic + CodeRabbit) Correctness: - config: return a fresh structuredClone of DEFAULT_REVIEW_CONFIG — callers mutate it (CLI manifestPath override), so the shared default leaked across reviews in the same process. - runner: key the check cache on the base-SQL VALUE (not just presence) so diff-scoped findings can't bleed between comparisons. - diff-filter: real glob matching (`**`/`*`/`?` with path semantics) for exclude patterns — the old endsWith strip silently failed on `**/*.sql`. - finding: deterministic dedupe tie-break (startLine,title,body) so equal- severity duplicates resolve identically regardless of lane ordering. - schema-context: drop ambiguous bare-name keys when two DIFFERENT tables (different schema/db) collide — was silently overwriting metadata; the same table across sources (manifest+catalog) still merges. - orchestrate: a rename only breaks lineage when the dbt MODEL NAME changes — a pure directory move (same basename) no longer false-blocks. - run: skip the git base-ref lookup when both changedFiles and getContent are supplied (non-git CI integrations). - risk-tier: scope materialization/incremental detection to ADDED/REMOVED diff lines (not context), and make `project_config` (dbt_project.yml) a FULL-tier floor. Action (github/review): - Pin the installer to the resolved release version (was floating latest). - Pass inputs as ENV and build an arg array — `base`/`head` are PR-controllable, so interpolating them into the shell was an injection vector. Docs / eval: - Correct the misleading "GitLab supported via --post" claim (--post is GitHub-only); add a language to the architecture code fence; add --no-ai. - dialect-coverage eval: fail-fast on dispatcher error (was hiding it as "not flagged" and corrupting coverage); use a defined table in the not_in case. - value-eval: remove the duplicate BENIGN nvl scenario (inflated the FP denominator) and fix the misleading `guarded-division-sf` name. Typecheck + marker check clean; full altimate suite passes (the 2 failures are pre-existing env-dependent E2E from main — dbt-adapter spawn + validators wave-5 — untouched by this branch). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: disable the new `reviewer` agent in the all-primary-disabled test The branch adds a `reviewer` primary agent (agent.ts), so the existing "defaultAgent throws when all primary agents are disabled" test no longer disables ALL primary agents — `reviewer` stays visible and defaultAgent returns it instead of throwing. Disable `reviewer` too, preserving the test's intent. (Default-agent selection is unchanged: `builder` is still first/visible, so the "returns build" test passes; only the all-disabled case needed updating.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: second-round PR #856 review follow-ups (cubic + CodeRabbit) Bugs the bots found in the first round of fixes, plus deferred items: - diff-filter: the `**` directory prefix now matches whole segments (`(?:[^/]*/)*`) instead of `.*`, so it can't match mid-segment; normalize backslashes before glob-testing (Windows paths). [Also fixes a block-comment that `*/` had terminated early.] - schema-context: extend the collision guard to QUALIFIED keys — two different tables sharing `schema.table` (across databases) now drop that ambiguous key too, keyed on full `db.schema.name` identity (bare + qualified unified). - git/run: resolve a renamed file's OLD side from its old path (a rename map is threaded into makeContentResolver) — was reading the new path at base. - post-github: paginate ALL PR comments before the marker dedup (busy PRs could miss the prior summary past page 1 and spam duplicates); only treat a positioning-specific 422 as inline-fallback, report other 422s as real errors. - cli/review: surface a GitHub review-post error instead of always printing success. - action: fail fast when `model_api_key` is set without `model` (was silently ignored). Typecheck + marker check clean; review + agent suites green (the 2 failures are the pre-existing env-gated E2E from main). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps @cloudflare/vite-plugin from 1.15.2 to 1.28.0.
Release notes
Sourced from
@cloudflare/vite-plugin's releases.... (truncated)
Changelog
Sourced from
@cloudflare/vite-plugin's changelog.... (truncated)
Commits
25b090aVersion Packages (#12840)b980af6Add sandbox support to@cloudflare/vite-plugin(#12794)c2b76bcSupport local explorer/cdn-cgi/routes (#12855)a31ee0b[workers-playground] Migrate from Cloudflare Pages to Cloudflare Workers (#12...64edac7Warn when theassetsfield is provided for auxiliary Workers (#12834)a6ddbdbSupport Vitest 4 in@cloudflare/vitest-pool-workers(#11632)24f807bVersion Packages (#12789)de65c58containers: Remove experimental flag from enabling egress interception for co...1beea21Replace public EBI Postgres database with local mock server in tests (#12784)96c6480fix: Vite plugin playgrounds PostgreSQL test query (#12783)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)