[kevinelliott]

Requested by Kevin · project thread

Summary

Two independent fixes, one commit each.

Map: fflate, image-size and minimatch advisories

The Dependabot security-update runs on main fail with security_update_not_possible: the vulnerable packages are transitive and their parents pin them (for example @loaders.gl/compression@4.5.4 requires exactly fflate@0.7.4), so Dependabot has no update path. npm overrides force the patched versions:

Package	Was	Now	Pulled in by
fflate	0.7.4	0.7.5	@deck.gl/geo-layers → @loaders.gl/compression
image-size	0.7.4	2.1.0	@luma.gl/gltf → @loaders.gl/textures → texture-compressor
minimatch	10.2.6	11.0.8	typescript-eslint, ts-morph (via shadcn)

npm audit in map goes from 25 findings to 4. The remaining ones have no fix to apply: maplibre-gl (fixed only in 6.x, which deck.gl 9.4 cannot run on) and deepmerge (no patched release).

image-size jumps two majors. Its only consumer is texture-compressor, a build-time texture tool that the map never calls, so nothing at runtime depends on the old API.

Service: stations with no known location

On staging every station syncs with latitude/longitude 0. For those stations the service measured range from (0,0), so the range plausibility check rejected every message that carried a position, and the grid stayed empty.

• Distance and bearing are now computed only when the station is located. A positioned message from an unlocated station still indexes its H3 cell; it just records no range or sector.
• getStationMessageCounts added the requested window's cells on top of a count already taken from a shorter window, which inflated station message counts. The requested window is now authoritative.

The companion change that gives staging stations real coordinates is in airframesio/stack (STATION_ENRICH_URL).

Verification

• Map: npm ci, npm run lint, npm run typecheck, npm run build, npm run build:static all pass; npx shadcn --version still runs with minimatch 11.
• Service: npm test (14 tests, 3 new in test/ingest.test.ts), npm run typecheck, npm run build pass.
• Not verified against live staging traffic. Whether staging messages carry positions at all cannot be seen from here, so cells may still be sparse after deploy.

Screenshots

None: dependency overrides and backend logic only, no UI change.

---

Generated by Claude Code

---

Note

Medium Risk
Service ingest logic affects which coverage events are accepted and how counts are aggregated; map overrides change transitive dependency versions (including a major image-size bump on a build-time path).

Overview
Map app declares Node ≥22 and adds npm overrides so transitive deps use patched fflate, image-size, and minimatch when Dependabot cannot update pinned parents.

Coverage service treats stations at (0,0) as unlocated: it skips distance/bearing and directional range for those stations so positioned messages are not rejected by implausible range from the origin, while range checks still apply when real station coordinates exist. getStationMessageCounts no longer adds counts across overlapping time windows—the requested window is authoritative.

Adds ingest tests for unlocated vs located stations and implausible range.

^{Reviewed by Cursor Bugbot for commit b953f76. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 39 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7b780ef8-f76b-443a-8bc2-c4b3baae0516

Commits

Reviewing files that changed from the base of the PR and between fd87681 and b953f76.

Files ignored due to path filters: 1

• map/package-lock.json is excluded by !**/package-lock.json

Files selected for processing: 3

• map/package.json
• service/src/aggregation/coverage-store.ts
• service/test/ingest.test.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[cloudflare-workers-and-pages]

Deploying airframes-coverage with    Cloudflare Pages

Latest commit:	b953f76
Status:	✅  Deploy successful!
Preview URL:	https://10ca529d.airframes-coverage.pages.dev
Branch Preview URL:	https://claude-project-thread-xlxhmp.airframes-coverage.pages.dev

View logs

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5bcb2aa. Configure here.}

[cursor]

Stale comment

Left a non-blocking comment. Cursor Bugbot reported 1 unresolved potential issue, so this PR is not approved. Human review is needed and no reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Approved. Cursor Bugbot completed successfully on the current head with no unresolved findings that need human review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}