Remove vulnerable nodemon dependency

[Aamir Jawaid (heyitsaamir)]

Summary

This clears the current npm audit findings without taking npm's suggested downgrade to nodemon@1.14.10. The vulnerable path is nodemon -> chokidar@3 -> braces@3.0.3, and latest nodemon still depends on that chokidar major while no patched braces 3.x exists.

Decisions

• Remove instead of force-fixing. npm audit fix --force would install an older major of nodemon, so this PR avoids that downgrade and drops the only direct nodemon dependency.
• Reuse the existing watcher. Other examples already use tsx watch; the tab example now follows that pattern instead of keeping a separate nodemon config.

Implementation details

• The tab example dev script still builds the client before starting the server-side watcher.
• The npm lockfile no longer includes the vulnerable nodemon, chokidar@3, or braces dependency chain.
• No runtime package code changes are included.

Sequence diagram

sequenceDiagram
    participant Dev as Developer
    participant Npm as npm scripts
    participant Vite as Vite build
    participant Tsx as tsx watch

    Dev->>Npm: npm run dev --workspace @examples/tab
    Npm->>Vite: build tab client assets
    Vite-->>Npm: dist/client ready
    Npm->>Tsx: watch src/index.ts with dotenv
    Tsx-->>Dev: restarts server on source changes

Loading

Validation

• npm audit --audit-level=high reports found 0 vulnerabilities.
• npx turbo build --filter=@examples/tab... passes.

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

Review effort: Lite
Findings: 2 · 1

Open (3)

• This changes the dev workflow from “rebuild server bundle then run node .” (previous nodemon… · New
• dev runs tsx directly, while the other scripts in this package use npx ... for CLIs. If tsx… · New
• npm run build:client is a blocking full build before the watcher starts, which can noticeably… · New

What changed in this PR

Removes the nodemon dependency from the tab example to eliminate an unpatched vulnerable dependency chain and switches the dev workflow to use tsx watch instead.

Changes:

• Replaced the tab example dev script from nodemon to tsx watch (while still building client assets first)
• Removed nodemon from devDependencies
• Deleted the now-unused nodemon.json configuration

File	Description
examples/​tab/​package.json	Updates dev script to use tsx watch and removes nodemon dependency.
examples/​tab/​nodemon.json	Removes nodemon configuration file since nodemon is no longer used.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Corina (corinagum)]

Copilot

1. tsx isn't declared. The new dev script calls tsx watch, but examples/tab/package.json doesn't list it. It resolves today only through the hoisted node_modules/tsx@4.23.15 that the other examples pull in. tab is the only one of the 25 examples that doesn't declare it, and the other 24 all pin "tsx": "^4.23.15". Please add the same to examples/tab devDependencies.

2. The new script stops rebuilding the client.

The tab example's dev script still builds the client before starting the server-side watcher.

It builds it once and then never again. The old nodemon.json watched ./src/** for ts,tsx and ran npm run build && npm start, so editing src/Tab/App.tsx rebuilt the vite client. The new script runs build:client a single time and then hands off to tsx watch src/index.ts, which only follows the module graph from the server entry. src/index.ts never imports the Tab components; it serves the built output via app.tab('test', path.resolve('dist/client')), so every client file sits outside the graph.

Confirmed this against tsx@4.23.15: with tsx watch src/index.ts running, editing a non-imported src/Tab/App.tsx produces no restart, while editing src/index.ts restarts as expected. So a React edit would appear to do nothing until the dev server is manually restarted.

Other examples already use tsx watch; the tab example now follows that pattern instead of keeping a separate nodemon config.

Those examples are server-only, which is why tsx watch is enough for them. tab is the only example with a vite-built browser client, and rebuilding it is precisely what the nodemon config was doing. The fix needs something like vite build --watch running alongside tsx watch. Note --include won't cover it on its own, because restarting the server just re-serves the same stale dist/client. Neither concurrently nor npm-run-all is in the repo today, so if you add a runner please keep it cross-platform instead of relying on shell backgrounding.

3. Rebase onto main. The branch currently conflicts.

Worth saying the direction is right: braces has no patched 3.x release, so removing nodemon is a genuine fix rather than a pin, which is why this is the one I'd like to keep.

[Copilot]

Copilot

1. tsx isn't declared. The new dev script calls tsx watch, but examples/tab/package.json doesn't list it. It resolves today only through the hoisted `no...

All three are addressed in 7984d41:

1. Added "tsx": "^4.23.15" to examples/tab devDependencies.

2. dev now uses concurrently (added as a devDependency, no shell backgrounding) to run two scripts together:

   • dev:client runs npx vite build --watch --outDir dist/client
   • dev:server runs tsx watch -r dotenv/config src/index.ts

   I checked it locally. With npm run dev running, editing src/Tab/App.tsx rebuilt dist/client, and /tabs/test/ returned 200. -k stops both processes if either one exits.

3. I merged main instead of rebasing, because I can't force-push. I resolved the conflicts by taking main's examples/tab/package.json and lockfile, then removed nodemon again and regenerated the lockfile with npm install. nodemon, braces and chokidar@3 are gone. The remaining npm audit findings come from jest, handlebars and sprintf-js. None of them go through this PR's dependencies, so I left them alone.