Fix the npm ci break and pin the toolchain to the engines floor - #1
Merged
Conversation
Every CI run since the repository went public failed at `npm ci`, so the verify
workflow and both nightly skills syncs never passed:
npm error Missing: typescript@5.9.3 from lock file
The lockfile was generated by npm 11 on Node 24, but the workflows run Node 22,
whose bundled npm 10 resolves one optional peer differently: `vite-tsconfig-paths`
pulled in `tsconfck`, which peers on `typescript: ^5.0.0` against the root's
`^7.0.2`, so npm 10 wanted a nested copy the lockfile did not record.
Remove `vite-tsconfig-paths` rather than paper over the resolution difference. It
was deprecated, vitest already resolves tsconfig paths natively, and no tsconfig
consulted by vitest declares `paths` — the only mapping lives in
tsconfig.typecheck.json, which tsc reads directly. Dropping it deletes the peer
conflict at its source.
Regenerate the lockfile with the npm bundled at the `engines` floor; `npm ci` now
succeeds on npm 10.9.3, 10.9.8, and 11.11.0. Bump the transitive `hono` past
GHSA-8j4g-w8fx-2239, clearing production audit findings.
Pin Node once in .nvmrc and have both workflows read it, so CI keeps exercising
the oldest supported npm, and add a test that fails when the lockfile drifts out
of sync with package.json instead of leaving CI to discover it.
Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every CI run since the repository went public failed at
npm ci, soverifyand both nightly skills syncs never passed:Cause
The lockfile was generated by npm 11 on Node 24, but the workflows run Node 22, whose bundled npm 10 resolves one optional peer differently.
vite-tsconfig-pathspulled intsconfck, which peers ontypescript: ^5.0.0against the root^7.0.2, so npm 10 wanted a nestedtypescript@5.9.3that the lockfile never recorded. It was invisible locally because development machines run npm 11 with a populatednode_modules.Fix
Remove
vite-tsconfig-pathsinstead of papering over the resolution difference. It is deprecated, vitest resolves tsconfig paths natively now, and no tsconfig that vitest consults declarespaths— the only mapping lives intsconfig.typecheck.json, whichtscreads directly. That deletes the peer conflict at its source and drops a dead dependency.The lockfile is regenerated with the npm bundled at the
enginesfloor.npm cinow succeeds on npm 10.9.3, 10.9.8, and 11.11.0.Also here
honobumped past GHSA-8j4g-w8fx-2239, sonpm audit --omit=devreports zero findings..nvmrc, read by both workflows, so CI keeps exercising the oldest supported npm.tests/package/lockfile.test.tsfails when the lockfile drifts out of sync withpackage.json, rather than leaving CI to discover it. Verified it fails on a deliberately desynced lockfile.Verification
npm run verifypasses with 64 tests (61 before, plus 3 new).npm pack --dry-runis unchanged at 94 files with no development leakage. Remaining audit findings are dev-only, inside@earendil-works/pi-coding-agent, and their only fix is a downgrade to 0.75.3 that would contradict the release-tested pin.Made with Cursor