chore(deps): update dependency @node-datachannel/darwin-x64 to v0.33.4 - #639
renovate[bot] wants to merge 1 commit into
Conversation
Deploying mouseterm with
|
| Latest commit: |
3fb0d5d
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://37d7b6d8.mouseterm.pages.dev |
| Branch Preview URL: | https://renovate-node-datachannel-da-0ano.mouseterm.pages.dev |
dormouse-bot
left a comment
dormouse-bot
left a comment
There was a problem hiding this comment.
Feedback on a draft — not a merge verdict. Build & Test is red on this branch and the fix isn't on it, so flagging where it does belong.
Bumping one @node-datachannel/* platform package alone breaks the dependency disclosure gate. docs/specs/security-supply-chain.md -> "An unresolvable dependency throws unless an optional-edge rule covers it" requires a platform package a product root declares to be describable "from a sibling in the same optionalDependencies block at the same exact version string". On Linux CI @node-datachannel/darwin-x64 isn't installed, and after this bump it has no sibling at 0.33.4 — every other entry is still 0.33.2 — so website/scripts/generate-deps.js throws rather than emitting a stale file. That's the Dependency disclosure is current step failing in Build & Test. The sibling PR #637 shows the same error verbatim: "@node-datachannel/darwin-arm64" is not installed and neither is any sibling declared beside it at the same version, so it cannot be described.
This is systemic rather than specific to this PR: #637, #639, and #640 each move one member of the family and each is red for the same reason, so none can go green on its own and merging them one at a time keeps the tree broken in between. renovate.json already groups every other lockstep family here — react, react-router, tailwindcss, storybook, vite, xterm — and @node-datachannel/** needs the same treatment.
The group has to include node-datachannel itself, not just the scope. The core package is a plain dependencies entry still pinned to 0.33.2, and its own manifest re-pins every platform package to 0.33.2 — visible in the lockfile, where node-datachannel@0.33.2's snapshot lists '@node-datachannel/darwin-x64': 0.33.2 and this PR adds a second @node-datachannel/darwin-x64@0.33.4 entry beside it rather than replacing it. Since the addon resolves from its own package directory (docs/specs/standalone.md -> "The direct path": "the addon resolves its .node relative to its own __dirname"), a darwin-x64 machine would likely go on loading 0.33.2 while the 0.33.4 prebuild is copied into the shipped standalone/sidecar/node_modules unused. I haven't run the resolution on a darwin-x64 host to confirm which copy wins, but either way the intended effect of this bump — picking up libdatachannel 0.24.5 and its DTLS handshake fix — doesn't arrive until the core package moves too.
A rule matching node-datachannel and @node-datachannel/** under one groupName, with separateMajorMinor: false, would keep the seven packages in one PR and one version string. Worth noting in its description why: the disclosure generator's same-exact-version sibling rule, not just build convenience.
Lands the whole 0.33.2 -> 0.33.4 bump in one commit: the core package plus all six prebuilt platform packages the sidecar declares beside it, the lockfile, and the regenerated dependency disclosure. Renovate split this round into seven PRs (#637, #639, #640, #643, #644, #645, #647) and every one of them is red on its own, because website/scripts/generate-deps.js requires the declared siblings to sit at the same version. The renovate.json group in the previous commit prevents the next round from splitting; this commit clears the current one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoyvmFzcmMyFbsTSp8FmL
Lands the whole 0.33.2 -> 0.33.4 bump in one commit: the core package plus all six prebuilt platform packages the sidecar declares beside it, the lockfile, and the regenerated dependency disclosure. Renovate split this round into seven PRs (#637, #639, #640, #643, #644, #645, #647) and every one of them is red on its own, because website/scripts/generate-deps.js requires the declared siblings to sit at the same version. The renovate.json group in the previous commit prevents the next round from splitting; this commit clears the current one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoyvmFzcmMyFbsTSp8FmL
… it to v0.33.4 (#642) * chore(renovate): bump the node-datachannel prebuild family as one group * chore(deps): update the node-datachannel family to v0.33.4 Lands the whole 0.33.2 -> 0.33.4 bump in one commit: the core package plus all six prebuilt platform packages the sidecar declares beside it, the lockfile, and the regenerated dependency disclosure. Renovate split this round into seven PRs (#637, #639, #640, #643, #644, #645, #647) and every one of them is red on its own, because website/scripts/generate-deps.js requires the declared siblings to sit at the same version. The renovate.json group in the previous commit prevents the next round from splitting; this commit clears the current one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoyvmFzcmMyFbsTSp8FmL * chore(renovate): say the grouped node-datachannel PR still needs a disclosure commit Renovate never runs website/scripts/generate-deps.js, so the grouped PR arrives with a stale website/src/data/dependencies-npm.json and a red `Dependency disclosure is current` step — one commit to clear, where a split bump throws before it can produce a snapshot at all. Without the note the next session reads that red as the grouping not working. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoyvmFzcmMyFbsTSp8FmL * chore(renovate): name both node-datachannel failure modes, not just the throw A prebuild-only bump throws, because no declared sibling sits at the new version. A core-only bump does not: it installs cleanly, the prebuild then resolves twice — once from the root pin, once nested under the new core — and the regenerated disclosure lists every prebuild at both versions, as #647's `Build & Test` shows ("version": "0.33.2, 0.33.4" on all six rows). The description covered only the first half. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoyvmFzcmMyFbsTSp8FmL --------- Co-authored-by: dormouse-bot <287024035+dormouse-bot@users.noreply.github.com> Co-authored-by: Ned Twigg <ned.twigg@diffplug.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Superseded by #642, which landed the whole Split this way none of the seven could go green: the six prebuild-only PRs, this one among them, made |
2 participants
This PR contains the following updates:
0.33.2→0.33.4Release Notes
murat-dogan/node-datachannel (@node-datachannel/darwin-x64)
v0.33.4Compare Source
What's Changed
npm-artifactsfolder to npmignore by @longnguyen2004 in #438New Contributors
Full Changelog: murat-dogan/node-datachannel@v0.33.1...v0.33.4
v0.33.3Compare Source
Configuration
📅 Schedule: (in timezone America/Los_Angeles)
* * * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.