Sweep deps and cut 2.7.2 - #70
Merged
Merged
Conversation
knip 6.29.0 -> 6.31.0, the only available non-held bump. eslint 10 and TypeScript 7 stay held org-wide. packageManager moves bun@1.3.13 -> 1.3.14 to match the release the repo is actually built and tested with, the same drift found and fixed in core. Version to 2.7.2. Stated plainly because it decides whether this is worth publishing: nothing here reaches a consumer. The only commit since v2.7.1 is a one-line ci.yml change, and knip is dev-only, so the shipped output of 2.7.2 is identical to 2.7.1. Both consumers (node-commerce, pay) declare `^2.7.1`, which already accepts it, so no downstream manifest edit follows from this and their lockfiles refresh on their next install. The esbuild override was re-tested rather than assumed, per the sweep runbook: removing it and reinstalling drops esbuild to 0.27.7, so it is load-bearing and stays. Gates: lint, typecheck, knip clean; 161 tests passed, 9 skipped; build ok.
The hooks called `bunx eslint` and `bunx tsc --noEmit`. `bunx` resolves a tool independently of the project, so it can fetch a different major and then fail, or pass, for reasons unrelated to the code being checked, and it writes to the lockfile as a side effect. This repo is the worst case for that: eslint is held at 9 and TypeScript at 6 while 10 and 7 are published, so `bunx eslint` and `bunx tsc` would pull exactly the majors the manifest pins away from. A `bunx tsc` that fetches TypeScript 7 prints help text and exits non-zero, which reads like a real type error and sends the fix down a false path. CI already had this right: the most recent commit on main routed CI's typecheck through the pinned script for this reason. The hooks were left behind, which is the parity gap worth closing, since a hook is the only thing that can drift away from the scripts CI runs. eslint now runs from ./node_modules/.bin (staged files still, so the hook stays fast) and typecheck goes through `bun run typecheck` the way CI invokes it. A guard test asserts no hook invokes bunx, that lint uses the local binary, that typecheck goes through the script, and that every `bun run <script>` hook names a script that actually exists. Proven to fail by putting `bunx tsc` back.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Dependency sweep for this repo, plus a version bump so it can be released.
knip6.29.0 to 6.31.0, the only available non-held bump. eslint 10 and TypeScript 7 remain held org-wide.packageManagerbun@1.3.13 to 1.3.14, matching the release this repo is actually built and tested with.Worth stating plainly, because it decides whether this is worth publishing: nothing in 2.7.2 reaches a consumer. The only commit since v2.7.1 is a one-line
ci.ymlchange, and knip is dev-only, so the shipped output is identical to 2.7.1. It is a no-op release rather than a harmful one, and a version number on npm is permanent.The
esbuildoverride was re-tested rather than assumed: removing it and reinstalling drops esbuild to 0.27.7, so it is load-bearing and stays.Type of change
Public API
None. No exported type, function signature, wire format, or response shape changed. The published output of 2.7.2 is identical to 2.7.1; the only differences are a dev dependency and the declared package manager, neither of which is shipped.
No migration for callers. Both consumers in this workspace (
node-commerce,pay) declare^2.7.1, which already accepts 2.7.2, so no manifest edit is required downstream and their lockfiles refresh on the next install.Test plan
No tests added, because no behavior changed. The existing suite was run to confirm the dependency bump breaks nothing:
bun run test: 161 passed, 9 skippedbun run lint,bun run typecheck,bun run knip: cleanbun run build: tsup DTS build succeededSweep-specific checks: the manifest was diffed after
bun updateto confirm no transitive was promoted to a root dependency, then a plainbun installreconciled the lock's embedded ranges before committing.Reproduce with
bun install && bun run lint && bun run typecheck && bun run knip && bun run test && bun run build.Checklist