mirror of
https://github.com/kuhyx/utils.git
synced 2026-11-10 20:27:15 +01:00
Krzysztof kuhy Rudnicki
0e78c8b752
Finishes the last two of the eleven manifests in this repo. Exact-pins every devDependency and takes three majors -- @testing-library/jest-dom 6 -> 7, jsdom 29 -> 30, pnpm 10.13.1 -> 11.24.0 -- with lint and coverage green in both (ts_core 42/42, web_ui 102/102, 100% branches). **TypeScript stays at 6.0.3, and this is the campaign's first real unsatisfiable conflict.** TS 7.0.2 is latest, but typescript-eslint 8.68.0 -- itself the latest release -- declares `typescript: ">=4.8.4 <6.1.0"` and throws "does not support TS 7.0" as eslint loads its config. There is no 9.x. Taking TS 7 would mean dropping every type-aware lint rule from both packages, so the compiler waits for the linter. Recorded as a `transitive:` allowlist entry, which is a predicate rather than a date: the gate re-checks the blocker each run and the entry clears itself when upstream ships support. First use of the allowlist, and the loud banner now prints on every run here. **pnpm 11 also made the gate wrong, and the gate was fixed rather than pnpm.** pnpm 11 quarantines packages published inside a 24h window -- a supply-chain measure against the period when a compromised publish is live -- and refused @testing-library/react 16.3.3, published 18h earlier. Reporting a repo as behind a version its package manager will not install is a finding nobody can act on: the hook fails, and so does the fix it asks for. `quarantine.py` now narrows npm's "latest" to the newest release old enough to install, bounded above by `dist-tags.latest` so a maintenance-line release never outranks the tag. It fetches the FULL packument (7MB for react, 16MB for typescript) and so runs only after a finding already exists -- a clean run pays nothing, which a test asserts by making the fetch raise. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK
30 lines
1.2 KiB
YAML
30 lines
1.2 KiB
YAML
# Dependencies deliberately held below latest stable, and why.
|
|
#
|
|
# Two entry classes, and the distinction is load-bearing:
|
|
#
|
|
# blocked_by: transitive:<pkg>@<ver>
|
|
# A PREDICATE. The gate re-evaluates the blocker on every run and the
|
|
# entry clears itself the moment upstream moves. It must NOT carry
|
|
# `expires` -- a calendar date nobody can act on only turns the gate red
|
|
# for a reason no commit can fix.
|
|
#
|
|
# anything else
|
|
# Discretionary. Requires `expires`, capped at 90 days, and fails once
|
|
# past.
|
|
#
|
|
# Every entry prints loudly on every gate run and at session start. An
|
|
# exception nobody sees any more is a suppression.
|
|
|
|
exceptions:
|
|
- ecosystem: npm
|
|
package: typescript
|
|
pinned: "6.0.3"
|
|
latest_known: "7.0.2"
|
|
reason: >-
|
|
typescript-eslint 8.68.0 -- itself the latest release -- declares
|
|
`typescript: ">=4.8.4 <6.1.0"` and throws "typescript-eslint does not
|
|
support TS 7.0" when eslint loads its config. No 9.x exists. Taking TS 7
|
|
would mean dropping every type-aware lint rule from ts_core and web_ui
|
|
until upstream catches up, so the compiler waits for the linter.
|
|
blocked_by: "transitive:typescript-eslint@8.68.0"
|