[mtrezza]

Closes #3498

Changes

inquirer 13.2.2 → 14.2.3. It is a direct production dependency, used only by the --createUser and --createMFA CLI helpers in Parse-Dashboard/CLI/mfa.js. The lock file resolves the @inquirer/* sub-packages to the latest versions allowed by inquirer's ranges (@inquirer/core 12.0.5, @inquirer/prompts 8.7.4, @inquirer/number 4.2.5, @inquirer/checkbox 5.2.7), which are the versions shipped with inquirer 14.2.4.

• 13.2.3 – 13.2.5: Replaced wrap-ansi with fast-wrap-ansi; input handles numeric default values.
• 13.3.0: Keypresses before a prompt is rendered are ignored; checkbox returns items that are both checked and disabled; the select/checkbox cursor can hover disabled options; new theme options for localization.
• 13.3.1 – 13.4.3: Editor shows a loading message while validating (13.4.0); Windows rendering and freeze fixes; TypeScript-only type improvements; dependency bumps.
• 14.0.0: Inquirer throws on a non-registered prompt type instead of falling back to input; new opt-in INQUIRER_KEYBINDINGS environment variable (vim/emacs keybindings); cursor position fix for line wraps; dropped rxjs in favor of an internal Observable.
• 14.0.1: Rolled back mute-stream to v3; Node engine ranges set to >=23.5.0 || ^22.13.0 || ^20.17.0.
• 14.0.2: Fixed security warnings in @inquirer/external-editor.
• 14.1.0: @inquirer/core 12 (useState setter accepts a reducer; affects custom prompts only); search gains an initialValue option; number floating-point step fixes; explicit undefined default handling in number, confirm and editor.
• 14.2.0: password gains toggleMask, enabled by default (ctrl+t reveals the input); localized yes/no parsing for confirm.
• 14.2.1: @inquirer/type pinned to an exact version.
• 14.2.2: Keystrokes batched with the key that settled a prompt no longer reach later handlers; confirm trims whitespace from answers.
• 14.2.3: search stale-choice fix; confirm always accepts y/n; expand/rawlist whitespace handling.
• Sub-package fixes from the 14.2.4 release set (resolved through inquirer's ranges): number treats whitespace-only input as empty; checkbox ignores input while validation is pending; prompt cleanup cancels a pending initial render on cancel/abort.

Breaking Changes

None for this project. The only upstream breaking change (14.0.0: a non-registered prompt type throws) does not apply, because mfa.js only uses the built-in select, input, number, confirm and password prompt types.

Behavior Changes in the CLI Helpers

• Password prompt (--createUser): now shows a ctrl+t toggle visibility hint, and ctrl+t reveals the typed password, because toggleMask defaults to true. The default is kept; the entered value is unaffected.
• Confirm prompts (@inquirer/confirm 6.0.4 → 6.3.4): 6.0.4 matched answers by prefix (/^(y|yes)/i, /^(n|no)/i), so yeah or yup gave Yes, nope or nah gave No, and only answers starting with neither letter (e.g. maybe, 1, or n with a leading space) silently took the default. 6.3.4 trims and lowercases the answer and accepts only y/ye/yes or n/no; anything else shows You must answer with "Yes" or "No" and the prompt waits. Space-padded answers such as n now count as No instead of silently becoming Yes. Pressing Enter still answers Yes on the 3 confirm prompts in mfa.js, which have no explicit default.
• Number prompts: whitespace-only input now falls back to the default (6 digits, 30 seconds). Previously it was parsed as 0, which produced an unusable MFA config with mfaDigits: 0 and mfaPeriod: 0.
• Pasted or piped input: keys typed before a prompt renders are ignored (13.3.0), and keys that arrive in the same write as the Enter that answers a prompt no longer reach the next prompt (14.2.2, @inquirer/core 12). Pasting or piping several answers at once into --createUser or --createMFA can therefore lose keystrokes; interactive typing is unaffected.

Smoke Test

Both CLI helpers were run through Parse-Dashboard/index.js in a pseudo-terminal with scripted keystrokes, against a production install (npm ci --omit=dev) of the base branch (inquirer 13.2.2) and of this branch (inquirer 14.2.3), on Node 22.19.0. The clipboard call was stubbed.

Scenario	inquirer 13.2.2	inquirer 14.2.3
--createUser, Enter on all 3 confirm prompts	Yes / Yes / Yes	Yes / Yes / Yes
--createUser, answer maybe to a confirm prompt	Silently takes the default (Yes)	Shows You must answer with "Yes" or "No", prompt stays open
--createUser, password prompt	[input is masked], no hint, ctrl+t has no effect	[input is masked] and ctrl+t toggle visibility, ctrl+t reveals the input
--createUser, typed password in the generated config	Unchanged	Unchanged
--createUser and --createMFA, Enter on the algorithm select	SHA1	SHA1
--createUser and --createMFA, Enter on digits / period	6 / 30	6 / 30
--createMFA, whitespace-only digits / period	0 / 0 (mfaDigits: 0, mfaPeriod: 0)	6 / 30 (defaults)
Exit code, all 5 scenarios	0	0

Code Changes Required

None — the upgrade is a drop-in replacement. Only package.json and package-lock.json change. The lock file diff is limited to inquirer's own dependency tree: rxjs and the nested @inquirer/core helper packages are removed, and fast-string-width, fast-string-truncated-width and fast-wrap-ansi are added.

Node Engine Note

inquirer 14.2.3 declares Node >=23.5.0 || ^22.13.0 || ^20.17.0, while engines.node in this repository allows >=22.12.0 <23.0.0, so Node 22.12.x is outside inquirer's declared range. This gap is not introduced by this PR: the current inquirer 13.2.2 and all its @inquirer/* packages already require ^22.13.0 on Node 22. The CI engine check compares only the minimum version of each range, so it does not detect this. Closing the gap would require raising the Node 22 minimum in engines.node to 22.13.0 in a separate PR, which affects consumers.

Summary by CodeRabbit

• Chores
  • Updated internal project metadata. No user-facing feature or behavior changes are noted.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 2bef1a95-3b42-458f-a1da-1b4d0a1e43a4

Commits

Reviewing files that changed from the base of the PR and between 1986e2b and ecb240e.

Files selected for processing: 2

• package-lock.json
• package.json

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

The project upgrades inquirer from 13.2.2 to 14.2.3. The lockfile updates its prompt packages and transitive dependencies, changes package engine ranges, and removes rxjs.

Changes: Inquirer dependency update

Layer / File(s)	Summary
Update Inquirer and locked packages package.json, package-lock.json	inquirer is updated to 14.2.3. The lockfile refreshes related prompt packages and dependencies, updates engine ranges, and removes rxjs.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: Minimal · up to ecb24

The dependency upgrade introduces no established merge-blocking defect.

Pre-merge checks: 7

Check name	Status	Explanation
Title check		The title starts with the allowed prefix refactor: and clearly describes the Inquirer dependency upgrade. The change description begins with a capitalized word.
Linked Issues check		Direct issue [#3498] requires upgrading inquirer from 13.2.2 to 14.2.3. package.json declares inquirer at 14.2.3. The package-lock.json root dependency and the resolved @inquirer/* packages …
Out of Scope Changes check		The reviewed changes are limited to package.json and package-lock.json. The lockfile changes update the dependency tree required by inquirer 14.2.3, including its @inquirer/* packages and tran…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Security Check		No security vulnerability pattern is introduced. The reviewed range changes only package.json and package-lock.json, with official npm registry URLs and integrity hashes for the Inquirer packages. App…
Engage In Review Feedback		No review feedback comments or actionable findings were supplied. The engagement requirement is therefore not applicable.
Description check		The description identifies the linked issue, explains the dependency upgrade and affected CLI behavior, documents breaking and engine considerations, and reports smoke-test results. It does not use th…

Full details: Linked Issues check

Explanation

Direct issue [#3498] requires upgrading inquirer from 13.2.2 to 14.2.3. package.json declares inquirer at 14.2.3. The package-lock.json root dependency and the resolved @inquirer/* packages are updated consistently. The issue has no additional project-specific coding or test requirement.

Full details: Out of Scope Changes check

Explanation

The reviewed changes are limited to package.json and package-lock.json. The lockfile changes update the dependency tree required by inquirer 14.2.3, including its @inquirer/* packages and transitive packages. No unrelated source, configuration, or test changes are present.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Full details: Security Check

Explanation

No security vulnerability pattern is introduced. The reviewed range changes only package.json and package-lock.json, with official npm registry URLs and integrity hashes for the Inquirer packages. Application code is unchanged; inquirer remains limited to the existing local CLI prompt helper in Parse-Dashboard/CLI/mfa.js. No new shell execution, dynamic evaluation, authentication, authorization, or network-handling code appears in the diff.

Full details: Description check

Explanation

The description identifies the linked issue, explains the dependency upgrade and affected CLI behavior, documents breaking and engine considerations, and reports smoke-test results. It does not use the template headings or include the Tasks checklist, but the required information is otherwise complete.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}