feat: Limit permanent warning dismissal to affirmative actions - #292
Merged
dcalhoun merged 2 commits intoJun 25, 2024
Merged
Conversation
Permanently dismissing a warning while selecting the "cancel" option is confusing as generally cancelling a dialog does not persist selections.
This option is not so much a cancellation, but either a deferment of a highly-recommended action or an acceptance of actively choosing to not heed direct advice for solving an system issue. Rephrasing the option to align with this better communicates the choice and makes the permanent dismissal option more understandable.
dcalhoun
deleted the
feat/limit-permanent-warning-dismissal-to-affirmative-actions
branch
June 25, 2024 12:18
fluiddot
pushed a commit
that referenced
this pull request
Jun 27, 2024
* feat: Limit permanent warning dismissal to affirmative actions Permanently dismissing a warning while selecting the "cancel" option is confusing as generally cancelling a dialog does not persist selections. * feat: Rephrase download optimized version cancel option This option is not so much a cancellation, but either a deferment of a highly-recommended action or an acceptance of actively choosing to not heed direct advice for solving an system issue. Rephrasing the option to align with this better communicates the choice and makes the permanent dismissal option more understandable.
2 tasks
wojtekn
added a commit
that referenced
this pull request
Jul 29, 2026
…4357) ## Related issues - Fixes [Dependabot alert #292](https://github.com/Automattic/studio/security/dependabot/292) (GHSA-j3f2-48v5-ccww) ## How AI was used in this PR Claude Code traced the alert to its root cause, identified that `pi-coding-agent`'s bundled `npm-shrinkwrap.json` was pinning the vulnerable transitive dependency, confirmed a newer release ships the fix, applied the version bumps, and ran typecheck + the affected test suites. All findings were reviewed by me. ## Proposed Changes Dependabot flags a medium-severity denial-of-service in `protobufjs` (`>= 7.5.0, <= 7.6.4`) — an infinite loop in `.proto` option parsing, fixed upstream in 7.6.5. We don't depend on `protobufjs` directly; it arrives transitively through `pi-coding-agent` → `@google/genai`. The catch: `pi-coding-agent@0.81.0` publishes its own `npm-shrinkwrap.json` that hard-pins its entire subtree, including `protobufjs@7.6.4`. Because npm honors a package's bundled shrinkwrap, the nested copy can't be lifted by a root-level `npm dedupe`, an `install protobufjs@7.6.5`, or an `overrides` entry — the only clean fix is upgrading `pi-coding-agent` itself. Version 0.82.1 ships `protobufjs@7.6.5` in its shrinkwrap. This bumps `@earendil-works/pi-coding-agent` (and `@earendil-works/pi-ai`, declared in `apps/cli`) from `0.81.0` to `0.82.1`. Both the top-level and the nested `protobufjs` copies now resolve to 7.6.5, clearing the alert. The 0.82.x release notes are additive (new provider support, opt-in constrained tool sampling, fixes) with no breaking API changes; same remediation pattern as the earlier #288 brace-expansion bump. No user-visible behavior change. ## Testing Instructions - `npm install` resolves both `protobufjs` copies (top-level and the one nested under `pi-coding-agent`) to 7.6.5 — verify with `npm ls protobufjs`. - `npm run typecheck` passes across all workspaces (the pi packages have a wide type-import surface, so this confirms no signatures changed). - AI test suites pass: `npm test -- apps/cli/ai packages/common/ai apps/studio/src/components/studio-code-session apps/cli/remote-session` (498 tests). ## Pre-merge Checklist - [x] Have you checked for TypeScript, React or other console errors? --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related to #287 (comment).
Proposed Changes
feat: Limit permanent warning dismissal to affirmative actions
Permanently dismissing a warning while selecting the "cancel" option is
confusing as generally cancelling a dialog does not persist selections.
feat: Rephrase download optimized version cancel option
This option is not so much a cancellation, but either a deferment of a
highly-recommended action or an acceptance of actively choosing to not
heed direct advice for solving an system issue. Rephrasing the option to
align with this better communicates the choice and makes the permanent
dismissal option more understandable.
Testing Instructions
Verify permanent dismissal is disallowed when selecting the "cancel" option
1).
Pre-merge Checklist
Footnotes
There is no need to complete all of the linked testing steps, only those related for triggering the relevant warning dialog. ↩ ↩2 ↩3