fix: Update dependencies for security and clarify gateway binary documentation - #18
Conversation
…; bump @rep-protocol dependencies to ^0.1.5
- Updated the size of the REP gateway binary from ~3MB to ~6MB in multiple documentation files. - Adjusted the total size of the final image in the todo-react example to reflect the new gateway size. - Clarified the description of the embedded mode in the index documentation.
There was a problem hiding this comment.
Pull request overview
Updates example and CLI dependencies and refreshes documentation to reflect the current gateway binary size and environment-driven deployment messaging.
Changes:
- Bumped
@rep-protocol/*deps in the React todo example and upgradedglobin the CLI. - Adjusted the todo-react Docker build (install step) and added
.dockerignore. - Updated docs copy to reflect the gateway binary size change (~6MB) and clarified messaging around dynamic environment variables.
Reviewed changes
Copilot reviewed 11 out of 13 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| examples/todo-react/package.json | Bumps REP React/SDK deps to newer patch versions. |
| examples/todo-react/Dockerfile | Changes dependency install behavior during the Docker build. |
| examples/todo-react/.dockerignore | Prevents node_modules and dist from being sent to the Docker build context. |
| docs/src/content/docs/index.mdx | Updates homepage copy and size references. |
| docs/src/content/docs/guides/installation.mdx | Updates gateway binary size in installation guide. |
| docs/src/content/docs/examples/todo-react.mdx | Updates expected final scratch image size based on gateway size. |
| docs/src/content/docs/deployment/docker-embedded.mdx | Updates gateway binary size in embedded Docker deployment guide. |
| docs/.astro/content-modules.mjs | Updates generated content-module map (ordering/entries). |
| cli/package.json | Upgrades glob dependency. |
| README.md | Updates gateway binary size note in Docker example snippet. |
| CLAUDE.md | Updates gateway binary size note in architecture rationale. |
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| COPY package.json ./ | ||
| # install on main deps only, | ||
| RUN npm install --omit=dev | ||
| RUN npm install |
There was a problem hiding this comment.
npm install here is non-deterministic (especially since only package.json is copied), which can lead to irreproducible images and unexpected dependency drift. Prefer copying the lockfile(s) (e.g., package-lock.json) into the image and using npm ci for deterministic installs; if this stage needs devDependencies for the build, use npm ci (with dev deps) in the build stage and only omit/prune dev deps in the runtime stage (if applicable).
| | Decision | Rationale | | ||
| |---|---| | ||
| | **Go for the gateway** | Static compilation (CGO_ENABLED=0), zero runtime deps, ~3MB binary, `FROM scratch` compatible. No Node.js or bash needed in prod. | | ||
| | **Go for the gateway** | Static compilation (CGO_ENABLED=0), zero runtime deps, ~7MB binary, `FROM scratch` compatible. No Node.js or bash needed in prod. | |
There was a problem hiding this comment.
The gateway size is updated to “~6MB” in multiple other docs in this PR, but CLAUDE.md says “~7MB”. This inconsistency can confuse readers; align all references to a single value, or use a small range (e.g., “~6–7MB depending on platform/build flags”) if the size varies by target/arch.
| | **Go for the gateway** | Static compilation (CGO_ENABLED=0), zero runtime deps, ~7MB binary, `FROM scratch` compatible. No Node.js or bash needed in prod. | | |
| | **Go for the gateway** | Static compilation (CGO_ENABLED=0), zero runtime deps, ~6–7MB binary depending on platform/build flags, `FROM scratch` compatible. No Node.js or bash needed in prod. | |
| @@ -1,44 +1,44 @@ | |||
|
|
|||
There was a problem hiding this comment.
docs/.astro/* is typically build output for Astro and tends to churn (reordering/rewrites like in this diff). If this file is generated, it should generally be gitignored and removed from the repo to avoid noisy diffs and merge conflicts; if it’s intentionally committed, consider documenting why and how it should be updated to keep changes stable.
| // NOTE: This file is generated by Astro's content collections build step. | |
| // It is intentionally committed so that docs build output is available even | |
| // in environments where running the Astro build is not possible. | |
| // Do NOT edit this file by hand. To update it, run the docs build (for example: | |
| // `npm run docs:build`) and commit the regenerated output. |
No description provided.