fix(deps): bump stack-auth to 0.42.2 - #905
Conversation
…-profile to 0.42.2 stack-auth 0.42.2 moves jsonwebtoken from 9.3.1 to 10.4.0. The other three crates release in lockstep with stack-auth from the same monorepo, so their exact pins move together to stay in sync. Signed-off-by: Toby Hede <toby@cipherstash.com>
|
freshtonic
left a comment
freshtonic
left a comment
There was a problem hiding this comment.
Requesting changes — the dependency change itself is correct, but as it stands this lands on main without shipping.
The bump is right
- The four exact pins move to 0.42.2 in lockstep, which is correct:
stack-auth0.42.2 requiresstack-profile0.42.2, so they can't move independently. Cargo.tomlandCargo.lockagree, and the whole CI suite is green.jsonwebtoken9.3.1 → 10.4.0 swaps theringbackend foraws-lc-rs. Two ways that could have bitten here, both checked and fine:stack-authtarget-gatesjsonwebtokentocfg(not(target_arch = "wasm32")), soaws-lc-rs(no wasm32 support) stays out of the wasm build; andaws-lc-sysis already onmainviarustls/quinn, so no new CMake/C toolchain requirement is introduced on the native matrix.
Blocking: no changeset
@cipherstash/protect-ffi is a published package, and this PR changes the Rust dependencies that produce its native binaries — but it carries no changeset (see changeset-bot above). Consequences, following release.yml:
- No changeset means no version bump, so no Version Packages PR entry for the
@cipherstash/protect-ffifixed group. - The
gatejob asks npm which committed versions are missing. With no version bump there is nothing missing, so the FFI branch is skipped and no new binaries publish. - The patched
jsonwebtokentherefore sits onmainbut never reaches anyone consuming@cipherstash/protect-ffior@cipherstash/stack.
Worth flagging separately: ffi-preflight is workflow_dispatch-only and is meant to be pointed at changeset-release/main. No changeset means no Version Packages branch, so the pre-flight that actually builds and smoke-tests the native artifacts never gets a target either. The one job that would exercise aws-lc-rs across Windows/musl/aarch64 doesn't run at any point in this flow.
A patch-level changeset for @cipherstash/protect-ffi should be enough — the fixed group carries the six platform packages with it.
Happy to re-approve once that's added. If the intent was deliberately to let this ride along with a later release rather than publish on its own, say so and dismiss this — but in that case it's worth being explicit, because a security-motivated dependency patch that doesn't publish is easy to mistake for one that did.
(Also note this duplicates cipherstash/protectjs-ffi#154. Given that repo's own description says protect-ffi is "Implemented in @cipherstash/stack", it's worth confirming which one is canonical so the two don't drift.)
Patch-level changeset for @cipherstash/protect-ffi so the jsonwebtoken 9.3.1 -> 10.4.0 fix actually publishes through the fixed platform-package group instead of landing on main with nothing to release. Signed-off-by: Toby Hede <toby@cipherstash.com>
|
Good catch — added a patch-level changeset for |
lint:ffi-changeset flagged this: npm trusted publishing for the seven protect-ffi packages is still pointed at cipherstash/protectjs-ffi during the absorption, not this repo. An active changeset here would bump all seven through the fixed group and misattribute the next stack release. Deferred per the check's own instructions -- the phase-4 cutover PR renames it back. Signed-off-by: Toby Hede <toby@cipherstash.com>
|
Correction to my last comment — the active changeset broke CI. This repo has a temporary guard (`scripts/lint-no-ffi-changeset.mjs`) for the in-progress protect-ffi absorption from `cipherstash/protectjs-ffi`: npm trusted publishing for the seven protect-ffi packages is still pointed at that repo, not this one, so an active changeset here would bump all seven through the fixed group and misattribute the next `stack` release. Deferred it per the check's own instructions (`.md` → `.md.deferred`, commit 415ab2d) — it'll get renamed back in the phase-4 cutover PR that repoints trusted publishing. Net effect: this PR alone won't publish the fix, same as before, but now for a documented reason rather than a missing changeset. The actual publish path for this jsonwebtoken bump right now is a manual `workflow_dispatch` of protectjs-ffi's Release workflow after cipherstash/protectjs-ffi#154 merges — that repo doesn't use changesets, versioning there is a manual trigger, not automatic on merge. |
…radicted Review findings on the cutover PR, all four in its own additions. **Six orphaned fixtures.** CIP-3719 said to delete "its self-test, fixtures"; the first pass deleted the self-test and left `scripts/__tests__/fixtures/lint-no-ffi-changeset/` behind, then recorded in the plan that no fixtures existed. That conclusion came from checking `scripts/fixtures/` — the wrong directory. The self-test used a tmpdir for two cases only; the rest resolved these six files. Nothing referenced them once the test was gone, and `test:scripts` passes either way, which is why the claim needed checking rather than inferring. Deleted, and the plan's correction reversed rather than left to mislead the next reader. **Prose contradicted its own checklist, twice.** AGENTS.md and the protect-ffi README asserted publishing had moved while the same commit left the plan's "Repoint npm trusted publishing" box unticked; and the plan's summary claimed "Phases 3 and 5 are built" over four unticked Phase 5 boxes. Both reconciled in the direction of what is true: the repoint is done, and all four Phase 5 items verified against the tree — the `./diagnostics` subpath with `import` and `require` conditions, the doctor probe that keeps the separate auth probe, the missing-binary e2e, and both changesets. The repoint box carries what is genuinely still open: npm accepts a publisher scoped to `npm stage publish` alone, which reads as enabled and fails every `npm publish`, and that setting is unverified on all seven. **Step 2's verification criterion was stale.** It told a reviewer to expect a patch bump of the six Stack packages. `.changeset/prisma-next-0-17.md` takes them to major through the fixed group, on `origin/main` already and with no FFI changeset in play. Left as-is it invites reading an unrelated major as evidence the FFI bump misbehaved. AGENTS.md also now names #905 as carrying a parked changeset, since AGENTS.md is the file agents actually read and a `.md.deferred` is inert rather than loud now that the guard is gone. CIP-3719
Round-2 review findings, all in this PR's own prose. Both axes reached the same place from different directions: the docs were written as though the cutover had completed, when what has completed is the first of seven steps. - AGENTS.md and the protect-ffi README asserted publishing works here in unqualified present tense. Nothing has published from this repository yet — 0.31.0 came from the old one, and the release, the verification and the archive are all still ahead. Both now say the path is configured rather than proven, and point at the plan for what is open. - AGENTS.md named #905 as carrying a parked changeset. That is transient state in durable doctrine: the line goes false the day #905 merges, and the fact is already recorded in the plan where such things belong. The general rule stays, the PR number goes. - The Phase 4 step-4 criterion had lost its "only after the versioned pre-flight is green" sentence when the box was ticked, so a reader skimming boxes no longer saw the ordering rule at all. Restored; the note below it still records that the repoint in fact ran ahead of the pre-flight, and why that was judged acceptable. - The changesets-`ignore` rationale still described the guard in the present tense, in a section the earlier reconciliation walked past. Left open deliberately: three independent reviews now suggest replacing the deleted guard with its inverse — fail CI on any `.changeset/*.md.deferred`, since such a file is inert to changesets and, as of this PR, inert to CI too. That is a design decision against CIP-3719's explicit instruction to delete the script, not a defect fix, so it is not taken here. CIP-3719
Brings #885's merge of main (8e9e10a) down into this branch so the stack can land as a unit. Fourteen conflicts; none resolved by picking a side blindly, and three needed the artefacts regenerated rather than chosen. REGENERATED, NOT PICKED. Both sides re-emitted the baseline and the 3.0.5 upgrade edge, and both hashes were wrong for the merged tree: this branch's bake the published 3.0.5 SQL under the pre-0.17 `sha256:`-prefixed hash, #885's bake 3.0.4-era SQL under 0.17's bare one. The right answer is neither — it is this branch's BYTES under #885's HASH FUNCTION. Re-ran each migration's own self-emit (`tsx migrations/<dir>/migration.ts`) and re-pinned `migration-v3.test.ts` to what came out: baseline bad30c9b… (was sha256:23c98b03… / 9447442333…) 3.0.5 upgrade edge 8c47bd1d… (was sha256:3b2b838b… / 4050dee89e…) `ops.json` is unchanged by the re-emit in both: `installSqlSha256` stays accde0030…, byte-identical to the published `@cipherstash/eql@3.0.5` tarball (verified by `npm pack`), and `createdAt` is preserved — it is the primary tie-break key in the migrator's neighbour ordering, not provenance. The 3.0.2 and 3.0.4 edges were NOT re-emitted and still bake 05860ae4… and 63104a81…, their own releases: `readVerifiedInstallSql()` reads the CURRENTLY installed bundle, so re-emitting a historical edge would bake today's SQL into it. THE 0.17 SCOPE RENAME BROKE TWO FILES THAT NOTHING WOULD HAVE CAUGHT TOGETHER. main's c795225 retired the whole `@prisma-next/*` scope for `@prisma/orm-*`. * `stale-vendored-space.test.ts` (added here in 810b069) imported six modules from it — a hard failure, so it announced itself. Ported, plus the two API changes behind it: `emitContractSpaceArtefacts` → `…Artifacts`, and `readMigrationsDir` now requires `{ migrationsDir }`. Its fixture then failed for a REAL reason worth keeping. It pinned the hash 1.0.0 published (`sha256:fc495f7f…`); under 0.17 the same bytes hash to `1030654387…` — which is exactly what `@cipherstash/stack-prisma@1.1.0` ships, so the fixture is re-pinned to a published artefact rather than a computed one. The stale-but-SILENT case is now 1.1.0's, and a new case pins 1.0.0's: its prefixed digest cannot equal a bare recomputation, so `readMigrationsDir` reports `hashMismatch` and that space IS caught. The suite covers both vendored generations; 16 tests, all green. * `skills/stash-prisma/SKILL.md` took a section from this branch that rides `rawSql` imported from `@prisma-next/postgres/migration` — two dead package names in the file whose whole job is telling a customer what to type, and nothing compiles a skill. 0.17 also replaced that recipe with PSL expression indexes, so the section was redundant as well as wrong. Kept only what main's version lacks — the EQL-upgrade-drops-your-indexes warning — rewritten against the surface that ships, and the changeset with it. New guard `scripts/__tests__/skills-retired-package-scopes.test.mjs`: no `skills/*/SKILL.md` may name a member of a retired scope. The scope WILDCARD stays legal, because `stash-prisma` has to be able to say the scope is retired — so the rule is `@prisma-next/<pkg>`, never `@prisma-next/*`. Verified against the defect: reinstate the line and it fails naming file, line and specifier. CORRECTED WHILE RESOLVING, both verified against the registry rather than reasoned about: * AGENTS.md and `packages/protect-ffi/README.md` both said no FFI release had run from this repository and to "treat the path as configured rather than proven". False since 0.32.0: its SLSA provenance names github.com/cipherstash/stack and .github/workflows/release.yml. Written while 0.31.0 was newest and never revisited. Both now carry the fact and the one-line curl that re-checks it. * The plan doc's Phase-4 note warned that #905 had to rename its parked changeset before merging. It merged as f7abfec without doing so, so `.changeset/protect-ffi-jsonwebtoken-cve.md.deferred` is on main now — a protect-ffi patch for CVE-2026-25537 that `@changesets/read` cannot see. Committed version and npm newest are both 0.32.0, so it is genuinely unreleased and the fix there is `git mv` back to `.md`. Recorded, not fixed: this branch predates #905 and does not carry the file. Other resolutions: pnpm-workspace.yaml keeps this branch's four re-selected security overrides AND main's `sharp@<0.35.0` (disjoint sets); the lockfile was regenerated rather than hand-merged and `--frozen-lockfile` passes; the `release:gate` step in tests.yml and the corrected `.md.deferred` paragraph in AGENTS.md are this branch's; the 1.1.0 mention in the 3.0.5 changeset is main's. Root package.json's `lint:package-paths` line lost the stray two-space indent 2e98298 gave it — a `code:check` error on this branch as it stood. Suites: 688 script tests, 364 stack-prisma (16 in the ported suite), 1344 CLI, 94 protect-ffi JS. `biome check` error-free, `release-gate` exits 0, `lint:eql-pins` clean, `changeset status` resolves with the seven FFI packages at patch and no bump for the frozen `@cipherstash/eql`.
2 participants
Summary
cipherstash-client,cts-common,stack-auth, andstack-profilefrom 0.42.0 to 0.42.2 inpackages/protect-ffi/crates/protect-ffi/Cargo.toml— these four crates release in lockstep from the same monorepo, so their exact pins move together.stack-auth0.42.2 moves itsjsonwebtokendependency from 9.3.1 to 10.4.0.Test plan
cargo build— cleancargo test --lib— 310 passed, 0 failedcargo tree -i jsonwebtokenconfirms resolution to 10.4.0