fix(build): restore valid chrome-trace-event lock entry - #4
Open
viniciusrodriguesai wants to merge 1 commit into
Open
fix(build): restore valid chrome-trace-event lock entry#4viniciusrodriguesai wants to merge 1 commit into
viniciusrodriguesai wants to merge 1 commit into
Conversation
Context: The RouteFilter 1.0.5 release commit accidentally changed the locked chrome-trace-event package from 1.0.4 to the nonexistent 1.0.5 version. Webpack 5.97.1 depends on chrome-trace-event ^1.0.2, but npm cannot install the invalid locked tarball and returns HTTP 404. Changes: - restore the chrome-trace-event lock entry to published version 1.0.4 - restore the corresponding 1.0.4 npm registry tarball URL - preserve the existing integrity hash after verifying it against the npm metadata for version 1.0.4 Behavior: The UI dependency graph and declared dependency ranges are unchanged. The lockfile now resolves webpack's existing semver range to the valid package tarball it referenced before the release-version replacement. Compatibility: - no runtime mod behavior changes - no Cities: Skylines II save changes - no C# changes - no UI feature changes - no dependency range changes - no package.json changes Security: - no executable code added - no new dependencies added - no credential handling changes - no publishing changes - no filesystem behavior changes in the mod - validation used only the official npm registry and a cache under UI/build Validation: - npm view chrome-trace-event@1.0.4 version: returned 1.0.4 - npm view chrome-trace-event@1.0.4 dist --json: integrity matched the existing lockfile hash - npm view chrome-trace-event@1.0.5 version: returned the expected HTTP 404 - npm ci --cache build/.npm-cache --no-audit: passed, 184 packages added - ROUTEFILTER_OUTPUT_DIR: confirmed as C:\Users\vinic\CS2-RouteFilter\UI\build - npm run build: passed, webpack 5.97.1 compiled successfully - npm audit --omit=dev --cache build/.npm-cache: passed, 0 vulnerabilities found - git diff --check: passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This pull request fixes a broken transitive dependency entry in
UI/package-lock.jsonthat prevents a clean installation of RouteFilter's UI development dependencies.The current upstream lockfile references
chrome-trace-event@1.0.5, but version1.0.5is not published on the npm registry. As a result,npm ciattempts to downloadchrome-trace-event-1.0.5.tgzand receives an HTTP 404 response.This change restores the lock entry to the published
1.0.4version and its corresponding npm registry tarball URL.No dependency ranges, application source files, runtime behavior, or package declarations are changed.
Problem
A clean UI dependency installation currently fails while resolving the transitive
chrome-trace-eventpackage.The failing locked package is:
The lockfile directs npm to:
That package version and tarball are not published, so npm returns HTTP 404 and
npm cicannot complete.Technical cause
RouteFilter declares webpack
5.97.1as a UI development dependency. The locked webpack package declares the following transitive range:chrome-trace-event: ^1.0.2chrome-trace-event@1.0.4is published and satisfies that existing range.chrome-trace-event@1.0.5is not published.The integrity hash already present in the broken lockfile matches the official npm metadata for the published
1.0.4package. This indicates that the package content represented by the integrity value is already the1.0.4artifact, while the version and resolved URL incorrectly point to1.0.5.Changes
Only the
node_modules/chrome-trace-evententry inUI/package-lock.jsonis updated:The existing integrity hash is intentionally unchanged because it was verified against the npm registry metadata for
chrome-trace-event@1.0.4.The lockfile was not regenerated, and no unrelated dependency entries were modified.
Dependency and compatibility impact
5.97.1chrome-trace-eventrange remains^1.0.2UI/package.jsonis unchangedThe effective dependency graph is unchanged; this correction restores a valid published resolution already accepted by webpack's declared semver range.
Validation
npm view chrome-trace-event@1.0.4 version1.0.4npm view chrome-trace-event@1.0.4 dist --jsonnpm view chrome-trace-event@1.0.5 versionnpm ci --cache build/.npm-cache --no-auditROUTEFILTER_OUTPUT_DIRUI/builddirectorynpm run build5.97.1compiled successfullynpm audit --omit=dev --cache build/.npm-cachegit diff --checkRuntime testing
Cities: Skylines II runtime validation was not performed.
This pull request changes only npm lockfile resolution metadata and does not alter mod runtime code. The dependency-resolution issue itself was validated through a clean
npm ciand a successful production UI build.Review scope
The complete pull request consists of one commit and one changed file. Review can be limited to confirming:
1.0.5to published version1.0.4;1.0.5.tgzto1.0.4.tgz;