chore(deps): update dependency @node-datachannel/win32-arm64-msvc to v0.33.4 - #644
renovate[bot] wants to merge 1 commit into
Conversation
Deploying mouseterm with
|
| Latest commit: |
f7d3b1a
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://80eb07b2.mouseterm.pages.dev |
| Branch Preview URL: | https://renovate-node-datachannel-wi.mouseterm.pages.dev |
dormouse-bot
left a comment
dormouse-bot
left a comment
There was a problem hiding this comment.
Feedback on work in progress — this is a draft, so it's not a merge verdict.
This bump can't go green on its own, and Build & Test is already red on it for exactly that reason: the Dependency disclosure is current step failed (job log).
generate-deps.js describes the five platform prebuilds pnpm didn't install on the Linux runner from whichever sibling it did install, matching on the exact version string — optionalSiblingsAtSameVersion filters standalone/sidecar/package.json's optionalDependencies for optionalDependencies[name] === version. Moving @node-datachannel/win32-arm64-msvc to 0.33.4 while the other five stay at 0.33.2 leaves that filter returning nothing, and the describe loop throws "…win32-arm64-msvc" is not installed and neither is any sibling declared beside it at the same version, so it cannot be described. That's the rule in docs/specs/security-supply-chain.md → "Disclosure": "described from a sibling in the same optionalDependencies block at the same exact version string".
Even setting CI aside, the bump wouldn't take effect: node-datachannel@0.33.2 declares its own @node-datachannel/win32-arm64-msvc: 0.33.2, and per the comment in standalone/scripts/build-sidecar-proxy.mjs the addon "resolves its platform package and detect-libc relative to its own __dirname" — so the Windows ARM64 loader reaches the 0.33.2 copy, and 0.33.4 rides along unloaded.
The family has to move as one unit — the core node-datachannel package and all six prebuilds together. That's what #642 sets up, and the same failure is sitting on #637, #639, #640, and #643. Landing #642 first and letting Renovate re-open one grouped PR retires all five; closing this one on its own just brings it back next Monday.
Lands the whole 0.33.2 -> 0.33.4 bump in one commit: the core package plus all six prebuilt platform packages the sidecar declares beside it, the lockfile, and the regenerated dependency disclosure. Renovate split this round into seven PRs (#637, #639, #640, #643, #644, #645, #647) and every one of them is red on its own, because website/scripts/generate-deps.js requires the declared siblings to sit at the same version. The renovate.json group in the previous commit prevents the next round from splitting; this commit clears the current one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoyvmFzcmMyFbsTSp8FmL
Lands the whole 0.33.2 -> 0.33.4 bump in one commit: the core package plus all six prebuilt platform packages the sidecar declares beside it, the lockfile, and the regenerated dependency disclosure. Renovate split this round into seven PRs (#637, #639, #640, #643, #644, #645, #647) and every one of them is red on its own, because website/scripts/generate-deps.js requires the declared siblings to sit at the same version. The renovate.json group in the previous commit prevents the next round from splitting; this commit clears the current one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoyvmFzcmMyFbsTSp8FmL
… it to v0.33.4 (#642) * chore(renovate): bump the node-datachannel prebuild family as one group * chore(deps): update the node-datachannel family to v0.33.4 Lands the whole 0.33.2 -> 0.33.4 bump in one commit: the core package plus all six prebuilt platform packages the sidecar declares beside it, the lockfile, and the regenerated dependency disclosure. Renovate split this round into seven PRs (#637, #639, #640, #643, #644, #645, #647) and every one of them is red on its own, because website/scripts/generate-deps.js requires the declared siblings to sit at the same version. The renovate.json group in the previous commit prevents the next round from splitting; this commit clears the current one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoyvmFzcmMyFbsTSp8FmL * chore(renovate): say the grouped node-datachannel PR still needs a disclosure commit Renovate never runs website/scripts/generate-deps.js, so the grouped PR arrives with a stale website/src/data/dependencies-npm.json and a red `Dependency disclosure is current` step — one commit to clear, where a split bump throws before it can produce a snapshot at all. Without the note the next session reads that red as the grouping not working. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoyvmFzcmMyFbsTSp8FmL * chore(renovate): name both node-datachannel failure modes, not just the throw A prebuild-only bump throws, because no declared sibling sits at the new version. A core-only bump does not: it installs cleanly, the prebuild then resolves twice — once from the root pin, once nested under the new core — and the regenerated disclosure lists every prebuild at both versions, as #647's `Build & Test` shows ("version": "0.33.2, 0.33.4" on all six rows). The description covered only the first half. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoyvmFzcmMyFbsTSp8FmL --------- Co-authored-by: dormouse-bot <287024035+dormouse-bot@users.noreply.github.com> Co-authored-by: Ned Twigg <ned.twigg@diffplug.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Superseded by #642, which landed the whole Split this way none of the seven could go green: the six prebuild-only PRs, this one among them, made |
2 participants
This PR contains the following updates:
0.33.2→0.33.4Release Notes
murat-dogan/node-datachannel (@node-datachannel/win32-arm64-msvc)
v0.33.4Compare Source
What's Changed
npm-artifactsfolder to npmignore by @longnguyen2004 in #438New Contributors
Full Changelog: murat-dogan/node-datachannel@v0.33.1...v0.33.4
v0.33.3Compare Source
Configuration
📅 Schedule: (in timezone America/Los_Angeles)
* * * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.