chore(deps): update dependency @node-datachannel/win32-x64-msvc to v0.33.4 - autoclosed - #645
renovate[bot] wants to merge 1 commit into
Conversation
Deploying mouseterm with
|
| Latest commit: |
8b7b2c2
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://e1d86b65.mouseterm.pages.dev |
| Branch Preview URL: | https://renovate-node-datachannel-wi-fquj.mouseterm.pages.dev |
dormouse-bot
left a comment
dormouse-bot
left a comment
There was a problem hiding this comment.
Feedback on work in progress — this is a draft, so it's not a merge verdict.
This bump can't go green on its own, and Build & Test is already red on it: the Dependency disclosure is current step fails with "@node-datachannel/win32-x64-msvc" is not installed and neither is any sibling declared beside it at the same version, so it cannot be described. On a Linux runner pnpm installs none of the Windows prebuilds, so website/scripts/generate-deps.js describes them from a sibling in the same optionalDependencies block matched on the exact version string — and moving one member to 0.33.4 while the other five stay at 0.33.2 leaves no sibling to match. That's the "optional, declared by a product root" rule in docs/specs/security-supply-chain.md -> Disclosure.
Even setting the gate aside, the bump wouldn't deliver what it's for. node-datachannel@0.33.2 declares its own optionalDependencies at 0.33.2, so the lockfile now carries both 0.33.4 (the sidecar's direct pin) and 0.33.2 (the core package's) for the same prebuild, and the addon resolves its .node relative to its own directory. Which of the two a Windows build actually loads is decided by resolution order rather than by this pin — and the libdatachannel 0.24.5 DTLS handshake fix cited in the release notes is in the native binary, so a split bump is the one shape that can ship the new prebuild and keep running the old one.
Nothing to fix in this diff — the fix is the group rule in #642, which puts node-datachannel and all six @node-datachannel/* prebuilds in one PR. This PR is one of six open siblings from the same 0.33.2 → 0.33.4 round (#637, #639, #640, #643, #644), each red for this same reason; once #642 lands, Monday's Renovate run replaces all six with a single grouped PR.
Lands the whole 0.33.2 -> 0.33.4 bump in one commit: the core package plus all six prebuilt platform packages the sidecar declares beside it, the lockfile, and the regenerated dependency disclosure. Renovate split this round into seven PRs (#637, #639, #640, #643, #644, #645, #647) and every one of them is red on its own, because website/scripts/generate-deps.js requires the declared siblings to sit at the same version. The renovate.json group in the previous commit prevents the next round from splitting; this commit clears the current one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoyvmFzcmMyFbsTSp8FmL
Lands the whole 0.33.2 -> 0.33.4 bump in one commit: the core package plus all six prebuilt platform packages the sidecar declares beside it, the lockfile, and the regenerated dependency disclosure. Renovate split this round into seven PRs (#637, #639, #640, #643, #644, #645, #647) and every one of them is red on its own, because website/scripts/generate-deps.js requires the declared siblings to sit at the same version. The renovate.json group in the previous commit prevents the next round from splitting; this commit clears the current one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoyvmFzcmMyFbsTSp8FmL
… it to v0.33.4 (#642) * chore(renovate): bump the node-datachannel prebuild family as one group * chore(deps): update the node-datachannel family to v0.33.4 Lands the whole 0.33.2 -> 0.33.4 bump in one commit: the core package plus all six prebuilt platform packages the sidecar declares beside it, the lockfile, and the regenerated dependency disclosure. Renovate split this round into seven PRs (#637, #639, #640, #643, #644, #645, #647) and every one of them is red on its own, because website/scripts/generate-deps.js requires the declared siblings to sit at the same version. The renovate.json group in the previous commit prevents the next round from splitting; this commit clears the current one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoyvmFzcmMyFbsTSp8FmL * chore(renovate): say the grouped node-datachannel PR still needs a disclosure commit Renovate never runs website/scripts/generate-deps.js, so the grouped PR arrives with a stale website/src/data/dependencies-npm.json and a red `Dependency disclosure is current` step — one commit to clear, where a split bump throws before it can produce a snapshot at all. Without the note the next session reads that red as the grouping not working. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoyvmFzcmMyFbsTSp8FmL * chore(renovate): name both node-datachannel failure modes, not just the throw A prebuild-only bump throws, because no declared sibling sits at the new version. A core-only bump does not: it installs cleanly, the prebuild then resolves twice — once from the root pin, once nested under the new core — and the regenerated disclosure lists every prebuild at both versions, as #647's `Build & Test` shows ("version": "0.33.2, 0.33.4" on all six rows). The description covered only the first half. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoyvmFzcmMyFbsTSp8FmL --------- Co-authored-by: dormouse-bot <287024035+dormouse-bot@users.noreply.github.com> Co-authored-by: Ned Twigg <ned.twigg@diffplug.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Superseded by #642, which landed the whole Split this way none of the seven could go green: the six prebuild-only PRs, this one among them, made |
renovate
Bot
changed the title
2 participants
This PR contains the following updates:
0.33.2→0.33.4Release Notes
murat-dogan/node-datachannel (@node-datachannel/win32-x64-msvc)
v0.33.4Compare Source
What's Changed
npm-artifactsfolder to npmignore by @longnguyen2004 in #438New Contributors
Full Changelog: murat-dogan/node-datachannel@v0.33.1...v0.33.4
v0.33.3Compare Source
Configuration
📅 Schedule: (in timezone America/Los_Angeles)
* * * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.