Revert Dependabot major bumps; lock published wellmarked@1.1.1#14
Merged
Conversation
Dependabot merged TypeScript 6 / zod 4 / @types/node 25 / rimraf 6 into main (#2) while the remote-server branch was verified against TS 5 and zod 3 — TS 6's strict-by-default (plus @types/node 25 resolution changes) is what turned every CI run red from July 22 onward, including PR #13's own checks: pull-request CI builds the merge preview against main, so the branch inherited breakage it never contained. Back to the verified ranges (typescript ^5.4.0, zod ^3.23.8, @types/node ^20, rimraf ^5), with the lockfile regenerated from the registry so wellmarked resolves to the published 1.1.1 tarball (real integrity hash) instead of whatever a local checkout linked. typecheck, build, and the stdio/HTTP parity tests all pass. The TS 6 + zod 4 migration is real work (strict-mode cleanup, zod 4 API changes) and should be its own deliberate PR, not a rider on the release. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
`node --test "test/**/*.test.mjs"` only works on Node >= 21 (glob expansion landed there) — Node 18/20 treat the quoted glob as a literal path and find nothing, which is why the fix PR's matrix passed on 22 but failed on 18/20. The directory form (`node --test test/`) breaks the other direction: current Node executes the directory as a file. An explicit file path is the one invocation every matrix version agrees on, and there is exactly one test file. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why CI is red on main
Dependabot's #2 merged TypeScript 6, zod 4, @types/node 25, rimraf 6 into main. TS 6 enables
strictby default and @types/node 25 changes type resolution — that's every error in the failing runs ('err' is of type 'unknown',Cannot find name 'process',Cannot find module 'wellmarked'). PR #13's own checks went red the moment those bumps landed, because PR CI builds the merge preview against main; the failures were never about the retry/search work.What this does
typescript ^5.4.0,zod ^3.23.8,@types/node ^20.11.0,rimraf ^5.0.5.package-lock.jsonfrom the registry, pinning the publishedwellmarked@1.1.1tarball with its real integrity hash (this was also the pending Phase-4 rollout step).npm run typecheck,npm run build, andnpm test(stdio/HTTP tool parity) all pass.Follow-up (not this PR)
The TS 6 + zod 4 migration is real work — strict-mode cleanup across src/, zod 4 API changes — and should be a deliberate PR. Consider a
dependabot.ymlignore rule for major versions of these four packages until then, or Dependabot will re-open the same bumps.🤖 Generated with Claude Code