Repository navigation
fix(pstack): pin poteto-mode script devDependencies - #1149
Open
surlymochan wants to merge 1 commit into
Open
surlymochan wants to merge 1 commit into
surlymochan wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #990
Why
pstack/skills/poteto-mode/scripts/package.jsonpinscommanderexactly but leaves both devDependencies on thelatesttag, so the manifest alone does not say which toolchaintypecheckandbun testrun against — and static scanners (SkillSpector SC1, per #990) flag it as an unpinned-dependency finding. The committedbun.lockalready resolves both packages, so the versions to pin are not a judgement call.What changed
pstack/skills/poteto-mode/scripts/package.json: pinbun-typesto1.3.14andtypescriptto7.0.2— exactly the versions the committedbun.lockalready resolves to (as @deanrie confirmed on pstack: pin poteto-mode script devDependencies (bun-types and typescript use latest) #990). Nothing is upgraded or downgraded.pstack/skills/poteto-mode/scripts/bun.lock: onebun installto sync the lockfile's recorded specs with the manifest. The diff is only the two spec strings (latest→ the pinned versions); every resolved version and hash is unchanged.harness/pstack/; the generated copies of both files carry the same change.Scope
Manifest and lockfile spec strings only, in the poteto-mode scripts package and its generated harness copy. No code changes, no version movement,
plugin.jsonuntouched.Blast Radius
Installs of this scripts package resolve to the identical versions they did before, now with the specs stated in
package.jsonitself. A--frozen-lockfileinstall passes against the updated lockfile, so the sync check proposed on #990 stays green.Verification
One combined run on this branch:
node scripts/generate-pstack-harness-trees.mjs --check— "harness/pstack is up to date"node scripts/validate-plugins.mjs— all plugins validated successfullypstack/skills/poteto-mode/scripts:bun install --frozen-lockfile— succeeds;bun run typecheck— passes;bun run test— 61 pass, 0 fail across 4 filesnode --disable-warning=ExperimentalWarning --test pstack/skills/*/scripts/test/*.test.ts— 334 tests: 267 pass, 0 fail, 67 skipped (the skipped ones shell out to TLC and self-skip whenTLA2TOOLSis unset)Note:
tscon the statechart scripts still reports the four pre-existing errors from #1141 on this base; that fix is separate (PR #1148) and this PR does not touch those files.