Replace fast-glob with tinyglobby and update deps and CI actions #1
Replace fast-glob with tinyglobby and update deps and CI actions #1nakrovati wants to merge 6 commits into
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughUpgrade CI/release workflows, bump pnpm and devDependencies, replace ChangesRepository updates and transform refactor
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)
23-29: Pin workflow actions to commit SHAs instead of floating major version tags.Lines 23–29 currently use floating tags (
@v6,@v5,@v6). For improved security and release integrity, pin each action to its full commit SHA and rotate intentionally:- name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@<40-char-sha> - name: Install pnpm - uses: pnpm/action-setup@v5 + uses: pnpm/action-setup@<40-char-sha> - name: Set node - uses: actions/setup-node@v6 + uses: actions/setup-node@<40-char-sha>🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/ci.yml around lines 23 - 29, Replace the floating action tags with pinned commit SHAs: for the actions used (actions/checkout, pnpm/action-setup, actions/setup-node) update their usages to reference the specific full commit SHA instead of `@v6` / `@v5` / `@v6`; locate the three lines using "uses: actions/checkout", "uses: pnpm/action-setup", and "uses: actions/setup-node" and substitute each tag with the corresponding full commit SHA obtained from the action's repository (and add a short comment noting the SHA and date for rotation policy).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@package.json`:
- Around line 59-69: The package.json declares engines.node as ">=18" but
includes vitest (vitest@3.2.4) and ESLint (eslint@9.39.4) which require Node
>=20.0.0 and >=18.18.0 respectively; update the engines.node constraint in
package.json (the "engines.node" field) to ">=20.0.0" (or a compatible >=20
range) so vitest and eslint requirements are satisfied, then run npm install and
CI to validate; look for references to vitest and eslint in the
dependencies/devDependencies to confirm compatibility.
In `@src/transform.ts`:
- Line 14: Change the suppression comment in src/transform.ts from "//
`@ts-expect-error`: No typinggs needed" to use the correct spelling "typings"
(i.e., "// `@ts-expect-error`: No typings needed") so the rationale reads
correctly; update the comment text near the existing `@ts-expect-error` usage to
fix the typo without altering behavior.
- Line 149: The current extraction for emitsContent uses content.match on a
regex with `.*?` which fails on multiline arrays; update the match in
src/transform.ts where emitsContent is assigned (the content.match(...) call
that sets emitsContent) to use a dot-all-aware pattern (either enable the regex
`s`/dotAll flag or replace `.*?` with a character class that matches newlines,
e.g., `[\s\S]*?`) so multiline `emits` arrays are captured; keep the same
capture group and fallback behavior (?.[1] || '').
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 23-29: Replace the floating action tags with pinned commit SHAs:
for the actions used (actions/checkout, pnpm/action-setup, actions/setup-node)
update their usages to reference the specific full commit SHA instead of `@v6` /
`@v5` / `@v6`; locate the three lines using "uses: actions/checkout", "uses:
pnpm/action-setup", and "uses: actions/setup-node" and substitute each tag with
the corresponding full commit SHA obtained from the action's repository (and add
a short comment noting the SHA and date for rotation policy).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: c79c8a5b-6365-4c56-b0d3-b90c6af9e434
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (9)
.github/workflows/ci.yml.github/workflows/release.ymlpackage.jsonsrc/cli-lib.test.tssrc/cli-lib.tssrc/index.tssrc/transform.test.tssrc/transform.tssrc/transformFile.ts
| "@antfu/eslint-config": "^3.16.0", | ||
| "@babel/traverse": "^7.29.0", | ||
| "@types/babel__core": "^7.20.5", | ||
| "@types/babel__traverse": "^7.20.5", | ||
| "@types/babel__traverse": "^7.28.0", | ||
| "@types/node": "18.15.11", | ||
| "bumpp": "^9.4.1", | ||
| "eslint": "^9.2.0", | ||
| "bumpp": "^10.4.1", | ||
| "eslint": "^9.39.4", | ||
| "npm-run-all": "^4.1.5", | ||
| "rimraf": "^5.0.7", | ||
| "tsup": "^8.0.2", | ||
| "vitest": "^1.6.0" | ||
| "rimraf": "^5.0.10", | ||
| "tsup": "^8.5.1", | ||
| "vitest": "^3.2.4" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python - <<'PY'
import json, urllib.parse, urllib.request
packages = {
"eslint": "9.39.4",
"vitest": "3.2.4",
"tsup": "8.5.1",
"bumpp": "10.4.1",
"@antfu/eslint-config": "3.16.0",
"@babel/traverse": "7.29.0",
}
for name, version in packages.items():
encoded = urllib.parse.quote(name, safe="")
url = f"https://registry.npmjs.org/{encoded}/{version}"
with urllib.request.urlopen(url, timeout=20) as r:
data = json.load(r)
print(f"{name}@{version} -> engines.node={data.get('engines', {}).get('node')}")
PYRepository: unovue/detypes
Length of output: 2640
🏁 Script executed:
# Find and read package.json to see current engine specification
git ls-files | grep -E "^package\.json$"Repository: unovue/detypes
Length of output: 70
🌐 Web query:
eslint 9.39.4 node version requirement
💡 Result:
ESLint 9.39.4 requires Node.js ^18.18.0, ^20.9.0, or >=21.1.0.
Citations:
- 1: https://eslint.org/docs/v9.x/use/getting-started
- 2: https://eslint.org/docs/next/use/migrate-to-9.0.0
- 3: https://app.unpkg.com/eslint@9.39.2/files/README.md
🌐 Web query:
vitest 3.2.4 minimum node version
💡 Result:
Node.js >= 20.0.0
Citations:
- 1: https://vitest.dev/guide/migration.html
- 2: https://www.npmjs.com/package/vitest/v/3.0.3?activeTab=dependencies
- 3: vitest-dev/vitest@v3.2.4...v4.0.0
🌐 Web query:
tsup 8.5.1 node engine requirement
💡 Result:
tsup 8.5.1 requires Node.js ^14.18.0 or higher.
Citations:
🏁 Script executed:
cat -n package.json | grep -A 3 -B 3 '"engines"'Repository: unovue/detypes
Length of output: 199
Tighten Node engine floor to accommodate vitest 3.2.4 requirements.
Lines 59–69 include vitest@3.2.4, which requires Node.js >=20.0.0. The current engines.node: ">=18" declaration is incompatible with this dependency. ESLint 9.39.4 also requires at least Node.js 18.18.0. Update the engine constraint to:
"engines": {
- "node": ">=18"
+ "node": ">=20"
},🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@package.json` around lines 59 - 69, The package.json declares engines.node as
">=18" but includes vitest (vitest@3.2.4) and ESLint (eslint@9.39.4) which
require Node >=20.0.0 and >=18.18.0 respectively; update the engines.node
constraint in package.json (the "engines.node" field) to ">=20.0.0" (or a
compatible >=20 range) so vitest and eslint requirements are satisfied, then run
npm install and CI to validate; look for references to vitest and eslint in the
dependencies/devDependencies to confirm compatibility.
There was a problem hiding this comment.
Vitest 3.2.4 supports Node.js 18 - https://npmx.dev/package-code/vitest/v/3.2.4/package.json.
The older version of ESLint used in the library also didn't support Node.js <18.18.0 - https://npmx.dev/package-code/eslint/v/9.2.0/package.json
There was a problem hiding this comment.
@nakrovati, you're absolutely right on both points. I apologize for the incorrect review comment.
-
Vitest 3.2.4 and Node 18: As you pointed out, Vitest 3.x supports Node.js 18. The >=20.0.0 requirement only applies to Vitest 4.0, not 3.x. The existing learning in my knowledge base already captures this.
-
ESLint pre-existing constraint: ESLint v9.0.0 introduced the Node.js requirement of
^18.18.0 || ^20.9.0 || >=21.1.0, dropping support for all versions prior to v18.18.0. Sinceeslint@9.2.0(the version used before this PR) had the same requirement, the slight looseness ofengines.node: ">=18"relative to ESLint's actual minimum of18.18.0was a pre-existing condition, not something introduced by this PR. This PR doesn't make the situation any worse.
I'll record this for future reviews.
✏️ Learnings added
Learnt from: nakrovati
Repo: unovue/detypes PR: 1
File: package.json:59-69
Timestamp: 2026-04-04T23:55:49.992Z
Learning: In the unovue/detypes repository, the engines.node field is ">=18". ESLint 9.x (from v9.0.0 onwards, including v9.2.0 used before PR `#1` and v9.39.4 used after) requires Node.js ^18.18.0 || ^20.9.0 || >=21.1.0. This slight looseness of engines.node relative to ESLint's actual minimum (18.18.0 vs 18.0.0) is a pre-existing condition that predates PR `#1`, not a regression introduced by it. Do not flag this as a new issue in PRs to this repo.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
🧠 Learnings used
Learnt from: nakrovati
Repo: unovue/detypes PR: 1
File: package.json:59-69
Timestamp: 2026-04-04T23:51:17.463Z
Learning: When reviewing a Node project’s package.json, do not flag Vitest engine incompatibility if the project uses vitest@^3.x (e.g., 3.2.4) and its engines.node is >=18. The Node.js >=20.0.0 engine requirement was introduced in Vitest 4.0, not Vitest 3.x; Vitest 3.x supports Node.js 18.
2a03cea to
16e5f1a
Compare
3a48a76 to
9c8c034
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)
23-29: 🏗️ Heavy liftConsider pinning GitHub Actions to commit SHAs for supply chain security.
The workflow uses mutable tag references (
@v6,@v5) instead of immutable commit SHAs. Tag references can be moved by attackers with repository access, creating a supply chain risk. This pattern also appears in.github/workflows/release.yml.While this is a pre-existing pattern (not introduced by this PR), consider migrating to SHA pinning with version comments for better supply chain security:
- uses: actions/checkout@<SHA> # v6.x.x🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 23 - 29, The workflow uses mutable action tags (actions/checkout@v6, pnpm/action-setup@v5, actions/setup-node@v6) which should be pinned to commit SHAs for supply-chain security; update each `uses:` entry to the corresponding immutable commit SHA (keeping a trailing comment with the human-readable tag like `# v6.x.x`) and apply the same SHA-pin changes in the other workflow file referenced (.github/workflows/release.yml), ensuring you replace each tag reference with the exact commit SHA for that action while preserving version comments for readability.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 23-29: The workflow uses mutable action tags (actions/checkout@v6,
pnpm/action-setup@v5, actions/setup-node@v6) which should be pinned to commit
SHAs for supply-chain security; update each `uses:` entry to the corresponding
immutable commit SHA (keeping a trailing comment with the human-readable tag
like `# v6.x.x`) and apply the same SHA-pin changes in the other workflow file
referenced (.github/workflows/release.yml), ensuring you replace each tag
reference with the exact commit SHA for that action while preserving version
comments for readability.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: f5228861-8134-459c-bc7b-afe30c16be09
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (9)
.github/workflows/ci.yml.github/workflows/release.ymlpackage.jsonsrc/cli-lib.test.tssrc/cli-lib.tssrc/index.tssrc/transform.test.tssrc/transform.tssrc/transformFile.ts
✅ Files skipped from review due to trivial changes (3)
- src/transformFile.ts
- src/cli-lib.test.ts
- src/index.ts
455e152 to
7702705
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
src/transform.ts (1)
141-142:⚠️ Potential issue | 🟠 Major | ⚡ Quick winUse a newline-safe, bounded
emitscapture regex.Line 142 can fail for multiline arrays and can over-capture due greedy
.*with optional closing bracket. Use a bounded bracket capture like[\s\S]*?to reliably restoredefineEmits(...).Suggested fix
- // eslint-disable-next-line regexp/optimal-quantifier-concatenation - emitsContent = content.match(/\semits:\s(\[.*\]?)/)?.[1] || '' + emitsContent = content.match(/\semits:\s(\[[\s\S]*?\])/)?.[1] || ''🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/transform.ts` around lines 141 - 142, The current capture for emitsContent uses a greedy single-line regex and can fail on multiline arrays; update the match in the emitsContent assignment to use a newline-safe, non-greedy bracket capture (e.g., capture the contents between square brackets with a pattern like \[([\s\S]*?)\]) so multiline emits arrays are correctly captured and you don't over-capture; modify the code that assigns emitsContent (the content.match(...) call) to use this bounded, non-greedy regex and keep the fallback to '' unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 23-29: CI workflow currently references mutable action tags
(actions/checkout@v6, pnpm/action-setup@v5, actions/setup-node@v6); replace each
`uses:` entry with the corresponding full commit SHA for the specific release
you intend to pin (e.g., actions/checkout@<full-sha>,
pnpm/action-setup@<full-sha>, actions/setup-node@<full-sha>) so the workflow
uses immutable references, and update the commit SHAs when you intentionally
upgrade the actions; locate those three `uses:` lines and swap the tag suffixes
for the matching full commit SHAs from each action's GitHub repository.
In @.github/workflows/release.yml:
- Around line 12-20: Replace floating major tags with pinned commit SHAs for
each action referenced (actions/checkout, pnpm/action-setup, actions/setup-node)
by updating their version strings to the corresponding full commit SHA;
additionally, in the actions/checkout step (the block using actions/checkout)
add persist-credentials: false to disable credential persistence. Ensure the
three action uses are updated to SHA pins and that only the checkout step
includes the persist-credentials: false key.
---
Duplicate comments:
In `@src/transform.ts`:
- Around line 141-142: The current capture for emitsContent uses a greedy
single-line regex and can fail on multiline arrays; update the match in the
emitsContent assignment to use a newline-safe, non-greedy bracket capture (e.g.,
capture the contents between square brackets with a pattern like \[([\s\S]*?)\])
so multiline emits arrays are correctly captured and you don't over-capture;
modify the code that assigns emitsContent (the content.match(...) call) to use
this bounded, non-greedy regex and keep the fallback to '' unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: dc51766b-7f07-4c81-b66f-f20fd9eab63b
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (10)
.github/workflows/ci.yml.github/workflows/release.ymlpackage.jsonpnpm-workspace.yamlsrc/cli-lib.test.tssrc/cli-lib.tssrc/index.tssrc/transform.test.tssrc/transform.tssrc/transformFile.ts
✅ Files skipped from review due to trivial changes (4)
- pnpm-workspace.yaml
- src/index.ts
- src/cli-lib.test.ts
- src/transformFile.ts
| uses: actions/checkout@v6 | ||
|
|
||
| - name: Install pnpm | ||
| uses: pnpm/action-setup@v2 | ||
| uses: pnpm/action-setup@v5 | ||
|
|
||
| - name: Set node | ||
| uses: actions/setup-node@v3 | ||
| uses: actions/setup-node@v6 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/ci.yml"
echo "== File = $FILE"
if [ -f "$FILE" ]; then
nl -ba "$FILE" | sed -n '1,120p'
else
echo "Missing $FILE"
exit 1
fi
echo
echo "== uses: lines containing actions/checkout, pnpm/action-setup, actions/setup-node"
rg -n "uses:\s*(actions/checkout|pnpm/action-setup|actions/setup-node)@" "$FILE" || true
echo
echo "== All uses: action references in ci.yml (for context)"
rg -n "uses:\s*[^#\s]+@" "$FILE" || true
echo
echo "== Check if any commit-SHA pinning is used in ci.yml"
rg -n "uses:\s*[^#\s]+@[0-9a-f]{7,40}\b" "$FILE" || trueRepository: unovue/detypes
Length of output: 154
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/ci.yml"
echo "== File = $FILE"
test -f "$FILE"
echo
echo "== First 120 lines with line numbers (fallback to awk)"
awk '{printf "%5d %s\n", NR, $0}' "$FILE" | sed -n '1,120p'
echo
echo "== uses: lines containing actions/checkout, pnpm/action-setup, actions/setup-node"
rg -n "uses:\s*(actions/checkout|pnpm/action-setup|actions/setup-node)@" "$FILE" || true
echo
echo "== All uses: action references in ci.yml (context)"
rg -n "uses:\s*[^#\s]+@" "$FILE" || true
echo
echo "== Check if any uses are pinned to commit-SHA in ci.yml"
rg -n "uses:\s*[^#\s]+@[0-9a-f]{7,40}\b" "$FILE" || trueRepository: unovue/detypes
Length of output: 1853
Pin GitHub Actions to commit SHAs (ci.yml supply-chain hardening)
.github/workflows/ci.yml uses unpinned action tags on Lines 23/26/29: actions/checkout@v6, pnpm/action-setup@v5, and actions/setup-node@v6. Pinning these uses: to full commit SHAs reduces CI supply-chain risk.
Suggested hardening patch
- - name: Checkout
- uses: actions/checkout@v6
+ - name: Checkout
+ uses: actions/checkout@<full-commit-sha>
- - name: Install pnpm
- uses: pnpm/action-setup@v5
+ - name: Install pnpm
+ uses: pnpm/action-setup@<full-commit-sha>
- - name: Set node
- uses: actions/setup-node@v6
+ - name: Set node
+ uses: actions/setup-node@<full-commit-sha>🧰 Tools
🪛 zizmor (1.25.2)
[error] 23-23: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 26-26: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 29-29: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 23 - 29, CI workflow currently
references mutable action tags (actions/checkout@v6, pnpm/action-setup@v5,
actions/setup-node@v6); replace each `uses:` entry with the corresponding full
commit SHA for the specific release you intend to pin (e.g.,
actions/checkout@<full-sha>, pnpm/action-setup@<full-sha>,
actions/setup-node@<full-sha>) so the workflow uses immutable references, and
update the commit SHAs when you intentionally upgrade the actions; locate those
three `uses:` lines and swap the tag suffixes for the matching full commit SHAs
from each action's GitHub repository.
| - uses: actions/checkout@v6 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Install pnpm | ||
| uses: pnpm/action-setup@v2 | ||
| uses: pnpm/action-setup@v5 | ||
|
|
||
| - name: Set node | ||
| uses: actions/setup-node@v3 | ||
| uses: actions/setup-node@v6 |
There was a problem hiding this comment.
Harden release workflow: pin actions and disable checkout credential persistence.
In .github/workflows/release.yml (release steps), the workflow uses floating major action tags (actions/checkout@v6, pnpm/action-setup@v5, actions/setup-node@v6). Pin these to full commit SHAs, and add persist-credentials: false to the checkout step to reduce token/credential exposure.
Suggested hardening patch
- - uses: actions/checkout@v6
+ - uses: actions/checkout@<full-commit-sha>
with:
fetch-depth: 0
+ persist-credentials: false
- - name: Install pnpm
- uses: pnpm/action-setup@v5
+ - name: Install pnpm
+ uses: pnpm/action-setup@<full-commit-sha>
- - name: Set node
- uses: actions/setup-node@v6
+ - name: Set node
+ uses: actions/setup-node@<full-commit-sha>🧰 Tools
🪛 zizmor (1.25.2)
[warning] 12-14: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 12-12: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 20-20: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): this step
(cache-poisoning)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 12 - 20, Replace floating major
tags with pinned commit SHAs for each action referenced (actions/checkout,
pnpm/action-setup, actions/setup-node) by updating their version strings to the
corresponding full commit SHA; additionally, in the actions/checkout step (the
block using actions/checkout) add persist-credentials: false to disable
credential persistence. Ensure the three action uses are updated to SHA pins and
that only the checkout step includes the persist-credentials: false key.
74efc42 to
7a85ab0
Compare
Update PNPM to version 10.34.3, because the current version of PNPM has many vulnerabilities: https://github.com/pnpm/pnpm/security.
Remove `npm-run-all` - it is unused, deprecated, and has many dependencies.
7a85ab0 to
6952b3d
Compare
fast-globwithtinyglobby-tinyglobbyhas 15 fewer dependencies (2 vs. 17)npm-run-all- it's unused and outdatedSummary by CodeRabbit
Chores
Refactor
Configuration
Tests