Visitar URL original
chore(dependency): update snyk orb by ajfarkas · Pull Request #7003 · uswds/uswds · GitHub
Skip to content

chore(dependency): update snyk orb - #7003

Open
ajfarkas wants to merge 2 commits into
developfrom
aj/7002-update-snyk
Open

chore(dependency): update snyk orb#7003
ajfarkas wants to merge 2 commits into
developfrom
aj/7002-update-snyk

Conversation

@ajfarkas

@ajfarkas ajfarkas commented Oct 6, 2026

Copy link
Copy Markdown
Collaborator

Summary

Updated snyk orb to 2.3.0.

Breaking change

This is not a breaking change.

Related issue

Closes #7002

Related pull requests

none

Preview link

none

Problem statement

This is a CI dependency, and the old version was potentially blocking debugging.

Solution

The newer version allows for easier debugging of CI issues due to better documentation and interaction with other packages. The newer version also comes with security fixes.

Major changes

  • snyk updated
  • snyk orb for Circle CI updated

AI disclosure

What AI tools did you use to create this MR?

  • No AI
  • Chat
  • Completions (e.g. Copilot)
  • Coding Agent

Author's checklist

  • The changes on this PR are strictly limited to the ticket requirements (i.e., no scope creep)
  • I personally witnessed this code working in a local environment
  • Automated tests are passing
  • [n/a] I have manually tested accessibility using physical devices and relevant assistive technology
    • [List the physical devices and assistive technology here]
  • I understand all the code and could debug it without AI 6 months from now

Testing and review

  1. On local, run npm run test:ci
  2. Confirm test passes

@github-actions

github-actions Bot commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

✅ All commits on this PR have a verified signature. Thanks!

@coderabbitai

coderabbitai Bot commented Oct 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Repository: uswds/uswds/.coderabbit.yaml
  • Review profile: QUIET
  • Plan: Advanced
  • Run ID: c7b10ea3-f298-427a-9b2f-c634b6273c11
📥 Commits

Reviewing files that changed from the base of the PR and between 9665e07 and 4d142de.

📒 Files selected for processing (1)
  • .agents/skills/uswds-code-review/references/uswds-anchors.md

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📝 Summary

Summary by CodeRabbit

  • Chores
    • Updated the security-scanning tools used in development and automated CI checks. These maintenance changes do not alter application features or end-user behavior; no other user-facing changes are included in this release.

Walkthrough

The Snyk development dependency changes from 1.1306.2 to 1.1307.4. The lockfile records Snyk’s bundled dependencies. The CircleCI Snyk orb changes from 1.1.2 to 2.3.0, and the reference document reflects the orb version change.

Changes

Snyk tooling update

Layer / File(s) Summary
Snyk versions and lockfile
package.json, package-lock.json, .circleci/config.yml, .agents/skills/uswds-code-review/references/uswds-anchors.md		 The Snyk development dependency changes to 1.1307.4, and the CircleCI Snyk orb changes to 2.3.0. The lockfile records Snyk’s bundled dependencies and removes their corresponding standalone entries. The reference document records the orb version change; its organization setting remains uswds.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 4d142

The updated CI Snyk step remains configured for the uswds organization. No identified issue blocks merging this tooling update.

🚥 Pre-merge checks | ✅ 10
✅ Passed checks (10 passed)
Check name Status Explanation
Title check ✅ Passed The title follows the required Conventional Commit syntax and accurately describes the Snyk orb update. It does not mention the accompanying Snyk package update, but it still describes a real part of …
Description check ✅ Passed The description directly explains the Snyk package and CircleCI orb updates, their purpose, related issue, and reported testing.
Linked Issues check ✅ Passed Issue #7002 requests a Snyk update to address CI debugging blockers and improve security and developer experience. The PR updates the snyk devDependency from 1.1306.2 to 1.1307.4 in `package.jso…
Out of Scope Changes check ✅ Passed The diff changes only the Snyk package, its lockfile data, the CircleCI Snyk orb, and the repository reference that documents the CI scan version. The lockfile changes support the package update. The …
Breaking Change Declared ✅ Passed The description contains exactly one template statement: "This is not a breaking change." The pull request changes only CI configuration, dependency manifests, the lockfile, and an agent reference doc…
No New Runtime Dependency ✅ Passed PASS. The PR changes only the snyk entry under devDependencies in package.json; the dependencies field is unchanged. The diff contains no files under packages/**/src/**/*.js, so it adds no p…
Regression Test Targets The Change ✅ Passed PASS. The authoritative diff changes only the CircleCI Snyk orb, the Snyk package and lockfile entries, and an agent documentation reference. It does not change production JavaScript under packages/**…
New Api Surface Follow-Ups ✅ Passed PASS: The pull request changes only Snyk dependency versions, lockfile entries, the CircleCI orb, and an agent-documentation reference. It adds no $theme-* setting, public Sass mixin or function, `d…
Accessibility Verification Declared ✅ Passed PASS: The pull request changes only Snyk versions in CircleCI, package metadata, the lockfile, and agent documentation. The reviewed diff does not change ARIA attributes, focus management, keyboard ha…
Theme Token Discipline ✅ Passed The reviewed pull request changes only Snyk configuration and lockfile files. It does not change any *.scss file under packages/, so the theme token discipline conditions do not apply.
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@ajfarkas ajfarkas self-assigned this Oct 6, 2026
@ajfarkas
ajfarkas requested a review from ryparker October 6, 2026 19:34
ryparker
ryparker reviewed Oct 6, 2026
View reviewed changes

@ryparker ryparker left a comment •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks AJ, the orb bump looks safe: 2.x only drops protect and the scan-iac job, neither of which we use, and the new install step (retries, checksum, CLI cache) worked in build 12601. The lockfile regenerates cleanly.

A couple requests before approving:
1. Please update .agents/skills/uswds-code-review/references/uswds-anchors.md:252, which still references snyk/snyk@1.1.2.
2. Could you adjust the problem statement? The failure in build 12597 was a Snyk server-side 504 Gateway Timeout (SNYK-0003) that passed on rerun, and the old orb was already downloading CLI 1.1307.4, so this PR doesn't change the CLI version CI runs. It's still a worthwhile maintenance bump, but it won't prevent that failure if it recurs.

@ajfarkas
ajfarkas force-pushed the aj/7002-update-snyk branch from ce4d41c to 4d142de Compare October 8, 2026 13:24
@ajfarkas

ajfarkas commented Oct 8, 2026

Copy link
Copy Markdown
Collaborator Author

@ryparker thanks for catching that. Honest question: is it really current practice to duplicate code in agent instructions? That seems fragile, for this reason.

@ryparker

ryparker commented Oct 9, 2026

Copy link
Copy Markdown
Member

@ryparker thanks for catching that. Honest question: is it really current practice to duplicate code in agent instructions? That seems fragile, for this reason.

Fair point. Agent docs should point to the source file rather than copy values an agent can already read. Feel free to open a follow-up that does that for uswds-anchors.md.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ryparker ryparker ryparker approved these changes

Assignees

@ajfarkas ajfarkas

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Update Snyk to unblock debugging CI build issue

2 participants

@ajfarkas @ryparker