Repository navigation
Repair wp/5.7 branch Actions: Stop the puppeteer alias from changing package-lock.json - #84782
Conversation
desrosj
added
[Type] Build Tooling
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message. To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
77a7676 to
ed18e76
Compare
ed18e76 to
beba7f7
Compare
beba7f7 to
8153722
Compare
Part of #82936.
What?
Two commits:
@types/yauzl(2.9.2) exactly in the rootdevDependencies, at the versions already inpackage-lock.json. npm drops"optional": truefrom the@types/yauzlentry, since it is now a direct dependency.puppeteeralias inpackage-lock.jsonto the versions npm resolves today:debug4.4.3,ms2.1.3,pump3.0.4 (also underget-stream),readable-stream3.6.2 andtar-fs2.1.5, plus sha512 integrity forfd-slicerandyauzl.Why?
The "Static Analysis" job runs
npm installand thennpm run check-local-changes, which fails becausenpm installrewritespackage-lock.json.package.jsondeclares Puppeteer through an npm alias ("puppeteer": "npm:puppeteer-core@5.5.0"). npm 6 doesn't keep the locked versions of an aliased package's dependencies: on every install it re-resolves them to the newest versions their ranges allow, so the lockfile changes whenever one of them publishes a release. Trunk has no such alias.Pinning holds the top-level
@typesentries for good. The other entries are nested under the alias because other packages use older major versions at the top level, so they can't be pinned the same way (overridesneeds npm 8.3+), and they will need updating again when they publish new releases in range.How?
Both commits contain exactly what npm 6.14.18 (Node 14, as in CI) writes:
npm install --package-lock-onlyreproduces CI's lockfile diff line for line, and a second run on the result leaves the lockfile unchanged. Placed directly above #84781 so Static Analysis can pass from here up.Use of AI Tools
This PR was created by Claude Code under my supervision. All code should be treated as AI-produced and not yet reviewed by a human until this PR is marked Ready for Review.
🤖 Generated with Claude Code