-
-
Notifications
You must be signed in to change notification settings - Fork 2
fix: harden stable package payloads #238
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -40,6 +40,14 @@ Three reach npm for the first time in this release: | |
| devDependencies; only a test uses it. Versions move too: `@apollo/server` to | ||
| 5.5.1, the pinned `graphql` to 16.14.2, and `@flatbread/core`'s `lodash-es` | ||
| to 4.18.1. | ||
| - `@flatbread/codegen` moves its four GraphQL Code Generator packages (`cli`, | ||
| `typescript`, `typescript-operations`, and `typed-document-node`) onto | ||
| supported major lines, and `@flatbread/config` moves its pinned `esbuild` | ||
| from 0.15.1 to 0.25.0. Nothing you get out changes: the same schema still | ||
| generates byte-identical files. | ||
|
Comment on lines
+43
to
+47
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. severity: HIGH — flagged-by: dependency-runtime-surface, docs-and-positioning, release-discipline, dx-and-examples risk: This bullet asserts “Nothing you get out changes” and “byte-identical files” across four minimal fix: Soften to schema-/behaviorally compatible (and note document-path typing may change), split codegen vs esbuild into separate bullets, or add a pinned-schema (+ empty-vars documents) golden/hash test and cite it before keeping any identity claim. |
||
| - `@flatbread/proof` stops shipping `src` and `scripts`, tests and all, in its | ||
| npm tarball. The bins and `dist` still ship, which is all the package needs | ||
| to run. | ||
| - `@flatbread/resolver-svimg` points its `repository`, `homepage`, and `bugs` | ||
| links at `FlatbreadLabs/flatbread`. They still named the old | ||
| `tonyketcham/flatbread` fork. | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -34,10 +34,10 @@ | |
| }, | ||
| "dependencies": { | ||
| "@flatbread/utils": "workspace:*", | ||
| "@graphql-codegen/cli": "^5.0.7", | ||
| "@graphql-codegen/typed-document-node": "^2.3.13", | ||
| "@graphql-codegen/typescript": "^4.1.6", | ||
| "@graphql-codegen/typescript-operations": "^4.6.1", | ||
| "@graphql-codegen/cli": "^6.3.1", | ||
| "@graphql-codegen/typed-document-node": "^6.1.8", | ||
| "@graphql-codegen/typescript": "^5.0.10", | ||
| "@graphql-codegen/typescript-operations": "^5.1.0", | ||
|
Comment on lines
+37
to
+40
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. HIGH — Four Minimal fix: bump
Comment on lines
+37
to
+40
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. severity: MED — flagged-by: dependency-runtime-surface, release-discipline, docs-and-positioning, dx-and-examples risk: Coordinated majors still resolve on import/ minimal fix: Keep the bumps; add a schema-only (+ empty-variables documents) golden/hash assertion in |
||
| "@graphql-typed-document-node/core": "^3.2.0", | ||
| "chokidar": "^3.6.0", | ||
| "fs-extra": "^11.3.1", | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -40,7 +40,7 @@ | |
| }, | ||
| "dependencies": { | ||
| "@flatbread/core": "workspace:*", | ||
| "esbuild": "0.15.1" | ||
| "esbuild": "0.25.0" | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. MED — Exact pin Minimal fix: keep the exact pin; add a load fixture mirroring There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. severity: LOW — flagged-by: release-discipline, dx-and-examples risk: minimal fix: Add a fixture config that imports a sibling/local package, or qualify the CHANGELOG esbuild line as smoke-tested on default configs only. |
||
| }, | ||
| "devDependencies": { | ||
| "@types/node": "16.11.47", | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -36,8 +36,6 @@ | |
| "files": [ | ||
| "bin", | ||
| "dist", | ||
| "src", | ||
| "scripts", | ||
| "*.d.ts" | ||
|
Comment on lines
36
to
39
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. LOW — Dropping Minimal fix: remove the unused
Comment on lines
37
to
39
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. severity: MED — flagged-by: release-discipline, dx-and-examples, docs-and-positioning (Attached to adjacent RIGHT-side context: pure-deletion hunk removed risk: Dropping minimal fix: Snapshot |
||
| ], | ||
| "engines": { | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
HIGH — “Nothing you get out changes: the same schema still generates byte-identical files” is a falsifiable public contract after multi-major
@graphql-codegen/*bumps (and an esbuild 0.15→0.25 pin in the same breath), with no golden checksum, fixture, or example regen in this PR.Minimal fix: split codegen vs esbuild into two bullets; drop “byte-identical” / blanket “nothing changes” unless a committed golden (or example regen) proves it—otherwise say compatible / smoke-tested / semantically equivalent, scoped per surface.