chore(deps): update dependency @node-datachannel/darwin-arm64 to v0.33.4 - #637
renovate[bot] wants to merge 1 commit into
Conversation
Deploying mouseterm with
|
| Latest commit: |
57c61d8
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://656fa2ac.mouseterm.pages.dev |
| Branch Preview URL: | https://renovate-node-datachannel-da.mouseterm.pages.dev |
dormouse-bot
left a comment
dormouse-bot
left a comment
There was a problem hiding this comment.
Feedback on a draft — not a merge verdict.
This bump lands @node-datachannel/darwin-arm64 at 0.33.4 while node-datachannel itself and the other five platform packages in the same optionalDependencies block stay at 0.33.2. Two consequences:
The disclosure gate fails, and CI is already red on it. docs/specs/security-supply-chain.md → "Disclosure" states the rule this breaks: an optional dependency a product root declares is "described from a sibling in the same optionalDependencies block at the same exact version string — published in lockstep… No such sibling installed throws." On Linux CI nothing is installed at 0.33.4, so optionalSiblingsAtSameVersion in website/scripts/generate-deps.js returns an empty list and the generator throws "@node-datachannel/darwin-arm64" is not installed and neither is any sibling declared beside it at the same version, so it cannot be described. That is the failing Dependency disclosure is current step in Build & Test. Any single-platform bump of this set hits it — the split version string is the failure, not this particular version.
The new prebuild would not be the one loaded. lib/src/host/remote/native-direct-peer.ts reaches the addon through require('node-datachannel'), and the lockfile still pins that package's own edge — node-datachannel@0.33.2 → '@node-datachannel/darwin-arm64': 0.33.2. Under pnpm's layout the addon resolves its platform package through that edge, so the libdatachannel v0.24.5 DTLS fix this PR cites doesn't reach the runtime; 0.33.4 is installed beside it and unused. Getting the fix means bumping node-datachannel and all six declared platform packages together.
The durable fix is a Renovate group. renovate.json has lockstep groups for react, react-router, tailwind, storybook, vite and xterm, but none for this set, so every node-datachannel release splits into up to seven PRs, each red on the disclosure gate for as long as the set is uneven. A rule alongside the others would keep them in one PR:
{
"description": "node-datachannel ships one prebuilt package per platform, all pinned to the core version, and standalone/sidecar/package.json declares the six shipped platforms itself; the disclosure generator requires every sibling in that optionalDependencies block to carry the same exact version string, so a split bump fails CI and the odd-one-out prebuild is never the one the addon loads",
"matchManagers": ["npm"],
"matchPackageNames": ["node-datachannel", "@node-datachannel/**"],
"groupName": "node-datachannel",
"groupSlug": "node-datachannel",
"separateMajorMinor": false
}Happy to open that as its own PR if you want it.
d54233d to
57c61d8
Compare
Lands the whole 0.33.2 -> 0.33.4 bump in one commit: the core package plus all six prebuilt platform packages the sidecar declares beside it, the lockfile, and the regenerated dependency disclosure. Renovate split this round into seven PRs (#637, #639, #640, #643, #644, #645, #647) and every one of them is red on its own, because website/scripts/generate-deps.js requires the declared siblings to sit at the same version. The renovate.json group in the previous commit prevents the next round from splitting; this commit clears the current one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoyvmFzcmMyFbsTSp8FmL
Lands the whole 0.33.2 -> 0.33.4 bump in one commit: the core package plus all six prebuilt platform packages the sidecar declares beside it, the lockfile, and the regenerated dependency disclosure. Renovate split this round into seven PRs (#637, #639, #640, #643, #644, #645, #647) and every one of them is red on its own, because website/scripts/generate-deps.js requires the declared siblings to sit at the same version. The renovate.json group in the previous commit prevents the next round from splitting; this commit clears the current one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoyvmFzcmMyFbsTSp8FmL
… it to v0.33.4 (#642) * chore(renovate): bump the node-datachannel prebuild family as one group * chore(deps): update the node-datachannel family to v0.33.4 Lands the whole 0.33.2 -> 0.33.4 bump in one commit: the core package plus all six prebuilt platform packages the sidecar declares beside it, the lockfile, and the regenerated dependency disclosure. Renovate split this round into seven PRs (#637, #639, #640, #643, #644, #645, #647) and every one of them is red on its own, because website/scripts/generate-deps.js requires the declared siblings to sit at the same version. The renovate.json group in the previous commit prevents the next round from splitting; this commit clears the current one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoyvmFzcmMyFbsTSp8FmL * chore(renovate): say the grouped node-datachannel PR still needs a disclosure commit Renovate never runs website/scripts/generate-deps.js, so the grouped PR arrives with a stale website/src/data/dependencies-npm.json and a red `Dependency disclosure is current` step — one commit to clear, where a split bump throws before it can produce a snapshot at all. Without the note the next session reads that red as the grouping not working. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoyvmFzcmMyFbsTSp8FmL * chore(renovate): name both node-datachannel failure modes, not just the throw A prebuild-only bump throws, because no declared sibling sits at the new version. A core-only bump does not: it installs cleanly, the prebuild then resolves twice — once from the root pin, once nested under the new core — and the regenerated disclosure lists every prebuild at both versions, as #647's `Build & Test` shows ("version": "0.33.2, 0.33.4" on all six rows). The description covered only the first half. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoyvmFzcmMyFbsTSp8FmL --------- Co-authored-by: dormouse-bot <287024035+dormouse-bot@users.noreply.github.com> Co-authored-by: Ned Twigg <ned.twigg@diffplug.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Superseded by #642, which landed the whole Split this way none of the seven could go green: the six prebuild-only PRs, this one among them, made |
2 participants
This PR contains the following updates:
0.33.2→0.33.4Release Notes
murat-dogan/node-datachannel (@node-datachannel/darwin-arm64)
v0.33.4Compare Source
What's Changed
npm-artifactsfolder to npmignore by @longnguyen2004 in #438New Contributors
Full Changelog: murat-dogan/node-datachannel@v0.33.1...v0.33.4
v0.33.3Compare Source
Configuration
📅 Schedule: (in timezone America/Los_Angeles)
* * * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.