Skip to content

Add test guarding veraPDF default version against configuration drift - #15302

Merged
cderv merged 1 commit into
mainfrom
feature/verapdf-version-drift-guard
Nov 5, 2026
Merged

cderv merged 1 commit into
mainfrom
feature/verapdf-version-drift-guard

Conversation

@cderv

@cderv cderv commented Nov 5, 2026

Copy link
Copy Markdown
Member

The bundled veraPDF version is set in two places. VERAPDF in configuration decides which version the build uploads, but configuration isn't packaged, so quarto install verapdf in an installed Quarto falls back to the kDefaultVersion constant in src/tools/impl/verapdf.ts. In #15275, configuration was bumped to 1.30.3 while the constant stayed at 1.28.2, so users would have kept installing 1.28.2. Review caught it, but nothing checks it.

The mismatch is also invisible in a Windows dev checkout: the dev launcher sets VERAPDF from configuration, so the constant is never used there.

A new unit test reads VERAPDF from configuration and compares it to kDefaultVersion, so a bump that misses one of them fails CI. kDefaultVersion is now exported for the test, and configuration has a comment next to VERAPDF pointing to the second place.

Extending tests/smoke/check/check-versions-no-mismatch.test.ts was considered, but that test compares installed binaries through quarto check versions, and veraPDF is neither part of that command nor installed in every test environment. Shipping the dependency versions in a packaged file would remove the duplication, but that is more plumbing than a single value needs for now.

Checklist

I have (if applicable):

  • referenced the GitHub issue this PR closes
  • updated the appropriate changelog in the PR
  • ensured the present test suite passes
  • added new tests
  • created a separate documentation PR in Quarto's website repo and linked it to this PR
AI-assisted PR
  • AI tool used: Claude Code
  • Codebase grounding: local clone
  • Human review: I have reviewed, tested, and verified the AI-generated content before submitting.

Note: autonomous AI agents submitting PRs without human oversight are not permitted — see the Code of Conduct.

The veraPDF version is declared twice: VERAPDF in `configuration`
drives the build (archive-bin-deps uploads that version), while
packaged installs, which don't ship `configuration`, fall back to
kDefaultVersion in src/tools/impl/verapdf.ts when running
`quarto install verapdf`. The Windows dev launcher loads
`configuration` into the environment, so VERAPDF is set there and
the constant is never used. A bump that missed the constant would
go unnoticed in a Windows dev checkout and ship the old veraPDF to
users, which nearly happened in the v1.12 dependency update.

The new unit test compares the two values and fails CI on a
mismatch. The existing check-versions smoke test can't cover this:
it compares installed binaries through `quarto check versions`, and
veraPDF is neither part of that command nor installed in every test
environment.
@posit-snyk-bot

posit-snyk-bot commented Nov 5, 2026 •

Copy link
Copy Markdown
Collaborator

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@cderv
cderv merged commit c6373fa into main Nov 5, 2026
56 of 58 checks passed
@cderv
cderv deleted the feature/verapdf-version-drift-guard branch November 5, 2026 14:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants