Track the floating esp-web-tools@10 tag - #84
Conversation
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018kfrZXtvjTzUL1gGTHGhVw
WalkthroughBoth installer pages update the ChangesInstaller module update
Estimated code review effort: 1 (Trivial) | ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Warning |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@auto.htm`:
- Line 13: Pin the esp-web-tools installer URL to an explicit immutable version
instead of the floating `@10` selector in auto.htm:13 and index.htm:13, keeping
both entry points on the same pinned artifact. If dependency updates are
intended, document and follow an approved release-management policy rather than
allowing runtime version changes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: d72658c2-c025-4c0d-a81a-33f24e9b3d60
📒 Files selected for processing (2)
auto.htmindex.htm
| <script | ||
| type="module" | ||
| src="https://unpkg.com/esp-web-tools@10.1.0/dist/web/install-button.js?module" | ||
| src="https://unpkg.com/esp-web-tools@10/dist/web/install-button.js?module" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Files present:"
git ls-files | rg '(^|/)auto\.htm$|(^|/)index\.htm$' || true
echo
echo "Relevant script refs:"
for f in auto.htm index.htm; do
if [ -f "$f" ]; then
echo "--- $f ---"
sed -n '1,30p' "$f" | nl -ba
fi
done
echo
echo "Check unpkg versions if network available:"
python3 - <<'PY'
import json, urllib.request, urllib.error
for spec in ["esp-web-tools@10/index.json", "esp-web-tools@^10/index.json"]:
try:
req = urllib.request.urlopen("https://unpkg.com/" + spec, timeout=10)
data = json.load(req)
print(spec)
if "files" in data:
print(" directory listing")
if "version" in data:
print(" resolved version:", data["version"])
if "latest" in data:
print(" latest:", data["latest"])
except Exception as e:
print(spec, "ERROR", repr(e))
PYRepository: wled/WLED-WebInstaller
Length of output: 275
🏁 Script executed:
#!/bin/bash
set -u
echo "--- auto.htm lines ---"
python3 - <<'PY'
with open("auto.htm", encoding="utf-8") as f:
for i, line in enumerate(f, 1):
if i <= 30:
print(f"{i}: {line}", end="")
PY
echo
echo "--- index.htm lines ---"
python3 - <<'PY'
with open("index.htm", encoding="utf-8") as f:
for i, line in enumerate(f, 1):
if i <= 30:
print(f"{i}: {line}", end="")
PY
echo
echo "--- matching script src refs ---"
python3 - <<'PY'
from pathlib import Path
for path in Path(".").glob("*.htm"):
src = None
with open(path, encoding="utf-8") as f:
for i, line in enumerate(f, 1):
if "src=" in line and "esp-web-tools" in line:
src = line.strip()
print(f"{path}:{i}:{src}")
break
PY
echo
echo "--- unpkg resolution probes ---"
python3 - <<'PY'
import json, urllib.request, urllib.error, re
specs = ["esp-web-tools@10/index.json", "esp-web-tools@10.0.0/index.json", "esp-web-tools@latest/index.json", "esp-web-tools@10/dist/web/install-button.js?module=true"]
for spec in specs:
url = "https://unpkg.com/" + spec
try:
with urllib.request.urlopen(url, timeout=10) as r:
body = r.read(8000).decode("utf-8", errors="replace")
is_json = spec.endswith(".json")
data = json.loads(body) if is_json else None
print(f"OK {spec}, status={r.status}, length={r.headers.get('x-unpkg-cache')}")
if data is not None:
print(" version:", data.get("version"), "latest:", data.get("latest"), "semver:", data.get("semver"))
except Exception as e:
print(f"ERR {spec}: {type(e).__name__}: {e}")
PYRepository: wled/WLED-WebInstaller
Length of output: 3588
Pin the installer dependency and update both entry points.
@10 resolves to the latest esp-web-tools v10 at runtime, so minor/patch releases can change the production installer without a repo change. Use a versioned/pinned artifact for both auto.htm and index.htm; if updates are expected, make this an approved release-management policy.
📍 Affects 2 files
auto.htm#L13-L13(this comment)index.htm#L13-L13
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@auto.htm` at line 13, Pin the esp-web-tools installer URL to an explicit
immutable version instead of the floating `@10` selector in auto.htm:13 and
index.htm:13, keeping both entry points on the same pinned artifact. If
dependency updates are intended, document and follow an approved
release-management policy rather than allowing runtime version changes.
Mentioned by : wled#84
|
I personally dont like the floating version tag, as this opens the door to having a breaking change of ESPWebTools directly impact the functionality of the webinstaller. And it kinda opens the door to a supply chain attack. |
2 participants
The installer is pinned to
esp-web-tools@10.1.0. This switchesindex.htmandauto.htmto the floating@10tag so the installer picks up patch releases within v10 automatically (the current release is 10.4.0).Most of what you gain is on the Improv Wi-Fi side, in 10.3.0: the network picker keeps scanning while the form is open and merges results (so a network the first scan missed still shows up), each network shows signal strength, RSSI and whether it is secured, the strongest one is preselected, a device that reports the Improv stopped state now says so instead of leading the user through a form that cannot succeed, and Firefox is recognized as a supported WebSerial browser. 10.4.0 fixes a scan race and default-selection bug in that same picker.
10.3.0 also updates esptool-js to 0.6.0 and adds the optional
serialTypemanifest field for projects shipping separate CDC and UART builds.Summary by CodeRabbit