[sfmskywalker]

Cherry-pick of #8977 (main d02fbc9) into release/3.10.0.

Cherry-pick was clean. No conflict resolution was required.

Test results

npm ci --prefix studio/samples/react/workflow-definition-editor-sample/workflow-definition-editor-app
# added 23 packages; found 0 vulnerabilities

npm ci --prefix design/video/elsa-readme-video
# added 253 packages; found 0 vulnerabilities

npm ci --prefix studio/src/wrappers
# failed: 404 for @elsa-workflows/elsa-studio-wasm@3.4.0 on f.feedz.io
# (private registry/auth; not a cherry-pick conflict)

  

[cursor]

@elsa-workflows-bot review

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Essentials
• Run ID: dd477cb7-9bae-4239-baa4-c9c190c38fec

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[Low impact] No merge-blocking defect was identified in the checked changes; full wrapper installation and WASM behavior remain unverified because the existing private package cannot be fetched.

Summary

Updates npm dependencies across the video project, React editor sample, and React wrapper.

• The workflow editor sample uses a newer Vite release.
• The React wrapper uses newer packages for its build and development tools.
• The README video project locks newer CSS parsing and source map packages.

No actionable issues were found. The sample’s asset test and production build passed on both base and head. The wrapper’s exact locked public dependencies passed library builds, ESM/CJS rendering checks, UUID checks, Storybook production builds, and Storybook HTTP checks on both revisions. These checks identified no merge-blocking regression. The PR description also reports successful installs for the sample and video project.

Acknowledged limitation — sfmskywalker: the wrapper installation stops at the existing private-registry package, @elsa-workflows/elsa-studio-wasm@3.4.0, with HTTP 404 from f.feedz.io. The supplied reason is private registry/auth access, not a cherry-pick conflict; this is not reported as a new defect.

T-Rex validation blocked

Retrying the unchanged full wrapper installation received the same HTTP 404 for the locked Feedz package. Full installation, its asset-copy lifecycle, and browser-side WASM initialization remain unverified. The isolated public-dependency checks did not replace or fabricate the private package.

_{Reviews (1) · Last reviewed commit: "chore(deps): bump the npm_and_yarn group..." · Reviewed by Greptile}

[elsa-workflows-review-bot]

Elsa 3 Code Review: APPROVE + MEDIUM-HIGH @ c08a2a7

Code Review, Round 1/6

Faithful pick of d02fbc9: changed lines and file list are identical to the main commit, with no extra or missing hunks. Base is release/3.10.0.

CI: all checks green on c08a2a7.

Notes: The studio/src/wrappers lockfile is not built by PR CI, and it could not be restored locally because a private package feed needs auth. Accepted because that lockfile is byte-identical to main and PR CI is green.

— Code Review (Elsa 3), via Elsa Review