Skip to content

fix(build): restore valid chrome-trace-event lock entry - #4

Open
viniciusrodriguesai wants to merge 1 commit into
Daotie:mainfrom
viniciusrodriguesai:fix/ui-lockfile-chrome-trace-event
Open

fix(build): restore valid chrome-trace-event lock entry#4
viniciusrodriguesai wants to merge 1 commit into
Daotie:mainfrom
viniciusrodriguesai:fix/ui-lockfile-chrome-trace-event

Conversation

@viniciusrodriguesai

Copy link
Copy Markdown

Summary

This pull request fixes a broken transitive dependency entry in UI/package-lock.json that prevents a clean installation of RouteFilter's UI development dependencies.

The current upstream lockfile references chrome-trace-event@1.0.5, but version 1.0.5 is not published on the npm registry. As a result, npm ci attempts to download chrome-trace-event-1.0.5.tgz and receives an HTTP 404 response.

This change restores the lock entry to the published 1.0.4 version and its corresponding npm registry tarball URL.

No dependency ranges, application source files, runtime behavior, or package declarations are changed.

Problem

A clean UI dependency installation currently fails while resolving the transitive chrome-trace-event package.

The failing locked package is:

chrome-trace-event@1.0.5

The lockfile directs npm to:

https://registry.npmjs.org/chrome-trace-event/-/chrome-trace-event-1.0.5.tgz

That package version and tarball are not published, so npm returns HTTP 404 and npm ci cannot complete.

Technical cause

RouteFilter declares webpack 5.97.1 as a UI development dependency. The locked webpack package declares the following transitive range:

chrome-trace-event: ^1.0.2

chrome-trace-event@1.0.4 is published and satisfies that existing range. chrome-trace-event@1.0.5 is not published.

The integrity hash already present in the broken lockfile matches the official npm metadata for the published 1.0.4 package. This indicates that the package content represented by the integrity value is already the 1.0.4 artifact, while the version and resolved URL incorrectly point to 1.0.5.

Changes

Only the node_modules/chrome-trace-event entry in UI/package-lock.json is updated:

- version: 1.0.5
- resolved: https://registry.npmjs.org/chrome-trace-event/-/chrome-trace-event-1.0.5.tgz
+ version: 1.0.4
+ resolved: https://registry.npmjs.org/chrome-trace-event/-/chrome-trace-event-1.0.4.tgz

The existing integrity hash is intentionally unchanged because it was verified against the npm registry metadata for chrome-trace-event@1.0.4.

The lockfile was not regenerated, and no unrelated dependency entries were modified.

Dependency and compatibility impact

  • webpack remains pinned to 5.97.1
  • webpack's existing chrome-trace-event range remains ^1.0.2
  • UI/package.json is unchanged
  • no dependencies or dependency ranges are added, removed, or upgraded
  • no C# or UI application source code is changed
  • no save format, persistence, pathfinding, ECS, or vehicle behavior is changed
  • no version, release, publishing, deployment, or GitHub Actions files are changed

The effective dependency graph is unchanged; this correction restores a valid published resolution already accepted by webpack's declared semver range.

Validation

Check Result
npm view chrome-trace-event@1.0.4 version Passed; returned 1.0.4
npm view chrome-trace-event@1.0.4 dist --json Passed; registry integrity matched the hash already present in the lockfile
npm view chrome-trace-event@1.0.5 version Returned the expected HTTP 404; the version is not published
npm ci --cache build/.npm-cache --no-audit Passed; 184 packages installed successfully
ROUTEFILTER_OUTPUT_DIR Explicitly constrained to the repository-local UI/build directory
npm run build Passed; webpack 5.97.1 compiled successfully
npm audit --omit=dev --cache build/.npm-cache Passed; 0 vulnerabilities
git diff --check Passed

Runtime testing

Cities: Skylines II runtime validation was not performed.

This pull request changes only npm lockfile resolution metadata and does not alter mod runtime code. The dependency-resolution issue itself was validated through a clean npm ci and a successful production UI build.

Review scope

The complete pull request consists of one commit and one changed file. Review can be limited to confirming:

  1. the locked version changes from 1.0.5 to published version 1.0.4;
  2. the tarball URL changes from 1.0.5.tgz to 1.0.4.tgz;
  3. the integrity hash remains unchanged;
  4. no other lockfile entries or project files are modified.

Context:
The RouteFilter 1.0.5 release commit accidentally changed the locked chrome-trace-event package from 1.0.4 to the nonexistent 1.0.5 version. Webpack 5.97.1 depends on chrome-trace-event ^1.0.2, but npm cannot install the invalid locked tarball and returns HTTP 404.

Changes:
- restore the chrome-trace-event lock entry to published version 1.0.4
- restore the corresponding 1.0.4 npm registry tarball URL
- preserve the existing integrity hash after verifying it against the npm metadata for version 1.0.4

Behavior:
The UI dependency graph and declared dependency ranges are unchanged. The lockfile now resolves webpack's existing semver range to the valid package tarball it referenced before the release-version replacement.

Compatibility:
- no runtime mod behavior changes
- no Cities: Skylines II save changes
- no C# changes
- no UI feature changes
- no dependency range changes
- no package.json changes

Security:
- no executable code added
- no new dependencies added
- no credential handling changes
- no publishing changes
- no filesystem behavior changes in the mod
- validation used only the official npm registry and a cache under UI/build

Validation:
- npm view chrome-trace-event@1.0.4 version: returned 1.0.4
- npm view chrome-trace-event@1.0.4 dist --json: integrity matched the existing lockfile hash
- npm view chrome-trace-event@1.0.5 version: returned the expected HTTP 404
- npm ci --cache build/.npm-cache --no-audit: passed, 184 packages added
- ROUTEFILTER_OUTPUT_DIR: confirmed as C:\Users\vinic\CS2-RouteFilter\UI\build
- npm run build: passed, webpack 5.97.1 compiled successfully
- npm audit --omit=dev --cache build/.npm-cache: passed, 0 vulnerabilities found
- git diff --check: passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant