fix(packs): allow safe local candidate smoke tests (UPT-51) by lucasbraum · Pull Request #139 · uptide-dev/uptide

lucasbraum · 2026-10-14T20:46:18Z

Candidate-pack smoke tests previously required editing verification.json to pretend the pack was verified. This adds a local-only opt-in without changing any pack record or ground truth.

Add --allow-candidate to check and fix, including worker requests, companion preflight and alternate leads. Only registered packs with an explicit candidate record qualify; missing, blocked and inconsistent records keep the existing behavior, and verified packs remain unchanged.
Reject the flag in scripts/action.ts, the Action runner, the Action subprocess boundary and CLI invocations in GitHub Actions. Reject it with --pr, --yes or publication intent before migration work. Persisted candidate runs also refuse later publication.
Show candidate pack, not verified in terminal output, stored report.json and the generated PR body preview. Internal reports add optional packWarning; the uptide.run/v1 projection uses its existing error field, with no schema or enum changes.
Use the claiming pack rule id for assisted sites when no transform applies, including --no-llm. The regression recreates OpenAI tool-call union sites from the PR feat(packs): add candidate openai 4 to 7 migration pack #130 smoke case synthetically; no third-party repository or pack truth was modified.
Document the smoke workflow in CONTRIBUTING “Write a pack”, README and command/pack docs; include a patch changeset.

Validation: regression tests failed first (candidate eligibility, local execution/banner, Action/publication refusals and tool-call rule labels). pnpm lint and pnpm typecheck pass. pnpm test -- --maxWorkers=4 passes: 2,097 tests passed, 31 network-gated tests skipped. The first shell run hit localhost permission errors; a host run had one existing compiler-test timeout under concurrent load. The final full run used four workers with unchanged timeouts.

Created in an isolated git worktree, installed with --frozen-lockfile --ignore-scripts, signed off with the commit author's identity, and rebased on current main before opening this PR.

Fixes https://linear.app/uptide/issue/UPT-51/fix-allow-candidate-for-local-smoke-tests-of-unverified-packs

Signed-off-by: Lucas Braum <lucasbraum@gmail.com>

Based on main. #132 (the react-router pack) stacks on this one. ## What and why Signal B (`compile.ts`) subtracts the baseline's errors from the target's, matched on file, code and full message. A pre-existing error whose message *prints a type the upgrade changes* no longer matched. It was then reported as a breaking site the upgrade made. Real case: OpenMetadata's sixteen `Property 'backHandler' does not exist on type 'IntrinsicAttributes & object & …'` in `EntityVersionPage.component.tsx`. All sixteen exist at the parent: a real scripts-off install of `react-router-dom@7.18.1` and the repository's own `tsc` show them. Only their wording changes, because React Router 7's navigate turns `() => void` into `() => void | Promise<void>` in the elaborated type. `check react-router` reported one of them as a breaking false positive. The fix: an error at the **same file, code and position** whose **chain of messages is the same once the type expressions it prints are masked** is pre-existing. Both programs check the same source text, so a position names one construct. - Masking replaces a quoted printed type expression (`'{ backHandler: () => void; … }'`, `'IntrinsicAttributes & object'`) with `'…'`. - A quoted plain name (a property, a parameter, a named type such as `'Opts'`) is kept. So the chain still says *which* member fails. - Moved lines still match on the full message, as before. **Can it hide a real new error?** (review item 3) Not when the chain says something different. Two cases are tested, each at the same file, code and position as a baseline error: 1. **Same last message, another symbol.** `const opts: Opts = value` already fails on property `a`; the target also breaks `b` and checks it first. tsc reports one error per assignment, so the chain differs only in `Types of property 'b' are incompatible`. Its last message (`Type 'string' is not assignable to type 'number'`) is the same. A first version of this fix matched on the last message alone and **hid it**: that is the third test, and it fails on that version. The full masked chain reports it. 2. **A different reason.** `{}` missed `a, b` and now misses `a, b, c`. The reason differs, so it is reported. The remaining blind spot is inherent to tsc and was already there with the full-message key. If the upgrade adds a second incompatibility *after* the first one tsc reports, tsc prints the same error and says nothing about the second. ## How it was verified Failing first, each test against the code without its part of the fix: | Test (`compile.test.ts`) | main (full-message key) | Position + last message (first draft) | This PR | | --- | --- | --- | --- | | does not report a pre-existing error as new because the upgrade rewords it | **fails** (reported as new) | passes | passes | | reports a different reason at the place of a pre-existing error | passes | passes | passes | | reports a new error at the place of a pre-existing one that ends on the same reason | passes | **fails** (hidden) | passes | (The second test fails against a position-only key, which was the version before the reason was added.) Full suite (`pnpm test`) on an idle machine with default timeouts, on #132's branch (which contains this one): 2,120 tests pass (CLI 452; core 1,668, 32 skipped), none fail. ### Every pack, re-scored Every pack registered on main, including `@sentry/react` (#135): `pnpm uptide pack test <pack> --json` on main `578a042` (before) and on this PR (after). Both sides ran on the same freshly fetched repositories (scripts off, the global pnpm, corepack for Yarn Berry only), and each pack's repositories were evicted before the next. Status, then TP/FP/FN for breaking and overall. Main moved by #139 after the re-score (not analysis-related: an opt-in candidate flag and its warning label; `pack test` passes its own packs to `check`, so scoring is unchanged). This branch is rebased on it; CI's Pack test re-checks at merge. | Pack | Before (main) | After (this PR) | Change | | --- | --- | --- | --- | | ai | verified; breaking 9/0/2; overall 54/0/7 | verified; breaking 9/0/2; overall 54/0/7 | none (same predicted findings) | | lucide-react | verified; breaking 11/0/0; overall 11/0/0 | verified; breaking 11/0/0; overall 11/0/0 | none (same predicted findings) | | next | verified; breaking 11/0/2; overall 12/0/3 | verified; breaking 11/0/2; overall 12/0/3 | none (same predicted findings) | | react | verified; breaking 89/0/40; overall 92/6/40 | verified; breaking 89/0/40; overall 92/6/40 | none (same predicted findings) | | sentry-browser | verified; breaking 3/0/0; overall 3/0/0 | verified; breaking 3/0/0; overall 3/0/0 | none (same predicted findings) | | sentry-nextjs | verified; breaking 8/0/0; overall 8/0/0 | verified; breaking 8/0/0; overall 8/0/0 | none (same predicted findings) | | sentry-react | verified; breaking 2/0/0; overall 2/0/0 | verified; breaking 2/0/0; overall 2/0/0 | none (same predicted findings) | | stripe | verified; breaking 18/0/2; overall 18/0/2 | verified; breaking 18/0/2; overall 18/0/2 | none (same predicted findings) | | vitest | verified; breaking 16/0/16; overall 16/18938/16 | verified; breaking 16/0/16; overall 16/18938/16 | none (same predicted findings) | | zod | verified; breaking 59/0/21; overall 120/0/21 | verified; breaking 59/0/21; overall 120/0/21 | none (same predicted findings) | **No pack changes.** The fix only matches an error that is already in the baseline at the same place with the same masked chain. No registered pack's ground truth has such a pair; the case came from OpenMetadata, a react-router candidate repository later excluded (#132's RESEARCH.md). vitest's 18938 and react's 6 overall false positives are non-breaking findings (both have 0 breaking false positives), identical on both sides. On #132's branch, react-router scores the same with and without this fix on its final truth. **Cache size** (review item 4, now in docs/packs.md): measured per pack while re-scoring, the largest are react and @sentry/nextjs at 4.3 GB each. All packs at once is about 24 GB, against the 14 GB of disk a standard hosted runner documents. Evicting per pack keeps it under 5 GB. ## Checklist - [x] Tests for the change (a bug fix starts with a failing test) - [x] `pnpm lint && pnpm typecheck && pnpm test` pass - [x] README and docs updated if behavior changed (docs/packs.md: ground-truth cache size and per-pack eviction) - [x] Changeset added if a user would notice (`pnpm changeset`) - [x] No new dependency, or it was agreed in an issue - [x] No private code, names or paths in fixtures, tests or docs - [x] The rules in CONTRIBUTING.md ("Rules that do not bend") still hold 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01EV6fvvLupC2Hdbwcg7iovY --- _Generated by [Claude Code](https://claude.ai/code/session_01EV6fvvLupC2Hdbwcg7iovY)_ --------- Signed-off-by: Claude <noreply@anthropic.com> Co-authored-by: Claude <noreply@anthropic.com>

…UPT-52) (#143) Fixes [UPT-52](https://linear.app/uptide/issue/UPT-52/pack-scorer-counts-missed-behavior-note-sites-as-breaking). ## What and why `pack test` counted every missed expected site as a **breaking** false negative unless a *rule* with that id was `deprecated`. `BehaviorNote.severity` was never read, so a missed behavior-note site that only needs a look counted as a missed break. Found by the ioredis pack ([#129](#129)): "Breaking: 0 predicted, 0 FP, 6 FN", where four of the six misses are `client-defaults`, a note declared `severity: 'deprecated'`. This PR: - **Scores each expected site at the severity of the rule or note it belongs to** (`siteSeverity`): a rule's `severity`; a note's `severity`, or `breaking` when the note reports findings without one (what `check` reports for it); `behavior` for a note `check` never reports as a finding (`decision`, `test-follow-up`); `breaking` for `generic`. Breaking recall counts only misses whose severity is `breaking`. - **Reports behavior-note precision/recall on its own**: a `behavior notes (sites)` row in `pack test`, `behavior` in `--json`, and `behavior` in `verification.json`. - **Records the counts behind each rate** (`truePositives`, `falseNegatives`) in `verification.json`, so a zero denominator prints **`n/a` instead of 100%** in `pack test` and in the README packs table (`rateLabel`). Backward compatible: both new fields are optional, a record without them prints as before, and the runtime gate (`recordedStatus`) reads nothing new. - False negatives print their severity, as false positives already did. - Scoring moves into a pure `scoreTruth(pack, repos)`, with no change in behavior, so it can be tested without fetching repositories. - CONTRIBUTING gets **"Run pack test locally"**: corepack for Yarn only, `COREPACK_NPM_REGISTRY` for Yarn 4, per-pack cache dirs and eviction. `check` and `fix` are untouched: no file under `check/`, `fix/` or the adapters changes. ### One decision to review: notes declared `breaking` stay breaking A note's own `severity` decides, not the fact that it is a note. Two reasons: - vitest (verified) has 13 truth sites under `coverage-patterns`, a note declared `severity: 'breaking'` with `detect`. `check` shows those findings as breaking, so their false positives must keep counting against the verified gate. Treating every note site as non-breaking would hide them and change vitest's verified numbers. - So ioredis on #129 goes from **6 breaking FN to 2**, not 0: the two left are `handshake-auth` sites (`log.test.ts:20`, `:28`), and that note declares `severity: 'breaking'`. If the note should only need a look, that is a one-word change in the pack on #129, not a scorer change. ## How it was verified **Failing test first.** `packages/core/src/packs/tooling/behavior-score.test.ts` uses synthetic sites modeled on the ioredis ground truth (voiceai, open-foundry, dokunc, plus the FishingConditionsApp control). On main's scorer it reproduces the bug exactly: ``` FAIL behavior-note sites > count as breaking misses only when their note is declared breaking - "falseNegatives": 2, + "falseNegatives": 6, ``` All six of its tests failed before the change and pass after. `packages/cli/src/pack.test.ts` covers the new row, `n/a`, and the false-negative severity. **End to end on #129 (local only, nothing pushed).** #129's head, scored before and after cherry-picking this commit, on the same five public repositories: | ioredis | Breaking P / R (TP/FP/FN) | Behavior notes P / R (TP/FP/FN) | | --- | --- | --- | | #129 as is | 100%* / 0% (0/0/6) | not reported | | #129 + this PR | n/a / 0% (0/0/2) | 30% / 33% (3/7/6) | \* printed as 100% before this PR, with 0 predicted. <details><summary><code>pack test ioredis</code> with this PR</summary> ``` rule precision recall tp fp fn client-defaults 30% 43% 3 7 4 handshake-auth n/a 0% 0 0 2 overall (sites) 30% 33% 3 7 6 behavior notes (sites) 30% 33% 3 7 6 breaking (sites) n/a 0% 0 0 2 false positives (7) ferni-ai/voiceai@c59ed0982f96 src/memory/storage/redis-cache/redis-cache.ts:101 client-defaults (deprecated) ferni-ai/voiceai@c59ed0982f96 src/services/data/redis-pubsub.ts:140 client-defaults (deprecated) ferni-ai/voiceai@c59ed0982f96 src/services/platform/rate-limiter.ts:57 client-defaults (deprecated) ferni-ai/voiceai@c59ed0982f96 src/services/workflows/jobs/redis-job-queue.ts:92 client-defaults (deprecated) syzygyhack/open-foundry@73910018b5e8 packages/api/src/server.ts:138 client-defaults (deprecated) simondietschi/dokunc@83681ed0ccc5 apps/web/src/lib/redis.ts:54 client-defaults (deprecated) kazumadev619-dev/FishingConditionsApp@8ba3f0d24bc7 src/lib/cache/client.ts:13 client-defaults (deprecated) false negatives (6) ferni-ai/voiceai@c59ed0982f96 src/memory/storage/redis-cache/redis-cache.ts:98 client-defaults (deprecated) ferni-ai/voiceai@c59ed0982f96 src/services/workflows/jobs/redis-job-queue.ts:89 client-defaults (deprecated) ferni-ai/voiceai@c59ed0982f96 src/memory/vectors/embedding-cache.ts:134 client-defaults (deprecated) syzygyhack/open-foundry@73910018b5e8 packages/api/src/server.ts:136 client-defaults (deprecated) simondietschi/dokunc@83681ed0ccc5 apps/web/src/lib/log.test.ts:20 handshake-auth (breaking) simondietschi/dokunc@83681ed0ccc5 apps/web/src/lib/log.test.ts:28 handshake-auth (breaking) PASS ioredis: candidate ``` </details> **Re-score of every registered pack**, against main at `9ba005a` (includes [#139](#139)). Each pack was fetched once (scripts off), scored on main and on this branch, then its caches were evicted: | Pack | Status | Breaking P / R (TP/FP/FN), main @ 9ba005a | Breaking, this PR | Behavior notes, this PR | pack test | | --- | --- | --- | --- | --- | --- | | `ai` | verified → verified | 100% / 82% (9/0/2) | 100% / 82% (9/0/2) same | n/a / n/a (0/0/0) | pass → pass | | `lucide-react` | verified → verified | 100% / 100% (11/0/0) | 100% / 100% (11/0/0) same | n/a / n/a (0/0/0) | pass → pass | | `next` | verified → verified | 100% / 85% (11/0/2) | 100% / 85% (11/0/2) same | n/a / n/a (0/0/0) | pass → pass | | `react` | verified → verified | 100% / 69% (89/0/40) | 100% / 69% (89/0/40) same | n/a / n/a (0/0/0) | pass → pass | | `sentry-browser` | verified → verified | 100% / 100% (3/0/0) | 100% / 100% (3/0/0) same | n/a / n/a (0/0/0) | pass → pass | | `sentry-nextjs` | verified → verified | 100% / 100% (8/0/0) | 100% / 100% (8/0/0) same | n/a / n/a (0/0/0) | pass → pass | | `sentry-react` | verified → verified | 100% / 100% (2/0/0) | 100% / 100% (2/0/0) same | n/a / n/a (0/0/0) | pass → pass | | `stripe` | verified → verified | 100% / 90% (18/0/2) | 100% / 90% (18/0/2) same | n/a / n/a (0/0/0) | pass → pass | | `vitest` | verified → verified | 100% / 50% (16/0/16) | 100% / 50% (16/0/16) same | n/a / 0% (0/0/13) | pass → pass | | `zod` | verified → verified | 100% / 74% (59/0/21) | 100% / 74% (59/0/21) same | n/a / n/a (0/0/0) | pass → pass | Breaking precision, recall and false positives are **identical for every pack**, and so is each status. The only difference in the records is additive: `behavior` plus the `truePositives`/`falseNegatives` counts (commit 2). vitest is the one pack with behavior-note sites in its truth: 13 `coverage-patterns` sites, a note declared `breaking`. They stay breaking misses, as before, and are now also visible as behavior-note recall 0%. How the runs were made: Yarn 4 through `corepack enable yarn` (tldraw) and `COREPACK_NPM_REGISTRY`, as the new CONTRIBUTING section says. A first pass with a blanket `corepack enable` could not install the repositories that pin pnpm (wortkarte, saas-starter, both sentry-react repositories) on main and on this branch alike. I re-scored those three packs on all checkouts with the documented setup; the table is that complete run. `pnpm lint`, `pnpm typecheck` and `pnpm test` pass (core 1650 passed / 32 skipped, CLI 453 passed). `pnpm docs:packs --check` and `pnpm docs:links` pass. ## Checklist - [x] Tests for the change (a bug fix starts with a failing test) - [x] `pnpm lint && pnpm typecheck && pnpm test` pass - [x] README and docs updated if behavior changed (docs/packs.md "Scoring", CONTRIBUTING; the README table is generated and unchanged in content) - [x] Changeset added if a user would notice (patch) - [x] No new dependency, or it was agreed in an issue - [x] No private code, names or paths in fixtures, tests or docs (test sites are synthetic) - [x] The rules in CONTRIBUTING.md ("Rules that do not bend") still hold 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_011t9c3ZLsM9B3KiYGPFDyyK --- _Generated by [Claude Code](https://claude.ai/code/session_011t9c3ZLsM9B3KiYGPFDyyK)_ --------- Signed-off-by: Claude <noreply@anthropic.com> Co-authored-by: Claude <noreply@anthropic.com>

@lucasbraum

This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## uptide@0.13.0 ### Minor Changes - [#134](#134) [`b795705`](b795705) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Packs can name alternate leads: packages a repository declares instead of the pack's own (`react-router-dom` for `react-router`). `check` and `fix` asked for either name use the pack; where only the alternate is declared, the lead is analyzed at the version installed through it, pnpm stores included, and `fix` declares it beside the alternate at the target before upgrading both. - [#149](#149) [`3303118`](3303118) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Add a candidate express 4 to 5 migration pack. Route strings that path-to-regexp 8 rejects or reads differently are found on calls of an Express app or router (including lists registered in a loop); `req.params` values widened to `string | string[]`, `req.param`, `res.sendfile`, `express.static.mime` and `express.query` are claimed from the compiler; `res.redirect(url, status)`, `app.param(fn)`, `res.redirect('back')` and `res.send(<number>)` are found in the source; runtime defaults (async errors, `req.body`, the query parser, `urlencoded`, dotfiles, Node 18) go to decisions. No rule rewrites. With the pack in use, `check` no longer adds its text-matched express 5 runtime findings. - [#148](#148) [`5143c46`](5143c46) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Add a candidate joi 17 to 18 migration pack. `new ValidationError(message, {}, original)`, which stops compiling for code written against joi 17.0–17.6, is rewritten to pass `[]`; the Node.js 20 requirement and the top-level domains joi 18 no longer accepts in `email()`, `domain()` and `uri()` are reported as decisions. Scored against two public repositories, one of them a negative control. - [#131](#131) [`413d3da`](413d3da) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Add a verified lucide-react 0.x to 1.x migration pack. Brand icons removed in 1.x are found at their imports and every use, with a guide whose replacement choice goes to the owner; icon names dropped during 0.x are renamed at the import or member; deep `dist/` imports, untyped icon lookups, the `absoluteStrokeWidth` and `IconNode` deprecations, and the `aria-hidden` default for repositories before 0.489.0 are reported. Lucide's lockstep packages move together and the consumer's build is required. Verified against three public repositories, one of them a negative control. - [#132](#132) [`107c107`](107c107) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Add a verified React Router 6 → 7 migration pack, which also runs for applications that declare only `react-router-dom`. It moves `react-router-dom` imports to `react-router`. It reports, with a guide for the agent, the rest of the upgrade: the removed `future` prop and router option, `react-router-dom/server`, lowercase `formMethod` comparisons and `json`/`defer` calls (found by syntax where the compiler is blind), the other removed exports, and `generatePath` calls that pass `null` for a required parameter. The six v6 future flags that become defaults are reported as decisions where the repository's router setup has not enabled them. React Router 7 → 8 is a separate upgrade. - [#142](#142) [`9c57934`](9c57934) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `check` and `fix` plan what the target version requires: a package the target, or anything moving with it, declares as a peer or dependency at a range the installed copy rejects moves to the lowest release of its major that satisfies it (openai 7 moves zod 3.24.2 to 3.25.0), shown apart from release-group companions ("moved because openai 7.4.0 requires zod ^3.25 || ^4.0"). A move only a new major makes is never made: it is reported as a blocker with the exact range in `check`, the PR body and `pack test`. The npm install scope guard no longer lets a declared root dependency change because a moved package peers on it. - [#128](#128) [`06f11ab`](06f11ab) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Add verified Sentry JavaScript SDK 10 to 11 migration packs for `@sentry/nextjs` and `@sentry/browser`, with the SDK's lockstep release group, a required build for Next.js, and inventory-scoped decisions for data collection, span streaming, sampling and platform minimums. Mechanical rules move `withSentryConfig` to `@sentry/nextjs/config` and the removed build options under `webpack`, remove `enableLogs`/`enableMetrics: true`, and rename exports, integration names and `httpIntegration` options; privacy, sampling, profiling and OpenTelemetry choices stay assisted and are reported for the owner. Fix `uptide pack new` dropping registry entries long enough to be wrapped. - [#155](#155) [`922c5ab`](922c5ab) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `uptide pack test` applies a stricter verified gate: at least five expected breaking sites across the public ground-truth repositories, besides two repositories and no breaking false positive. Upgrades the compiler cannot see are gated on their behavior notes instead. Mechanical rules no real site exercises are recorded as unexercised, and `check` and `fix` run their sites as assisted. `@sentry/browser` and `@sentry/react` become candidates (fewer than five real breaking sites). A pack can lower the minimum only with a written reason in its RESEARCH.md. The README packs table shows each pack's breaking-site count. The output shows the gate's class, site counts and every reason a pack is a candidate. - [#147](#147) [`0b88170`](0b88170) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `check` and `fix` remove a deprecated `@types` stub instead of upgrading to it. When the release the upgrade would move `@types/<pkg>` to is deprecated on npm, and `<pkg>`'s target declares its own types (`types`, `typings` or a `types` export), the plan removes it: "Removed: @types/ioredis, ioredis 5 ships its own types", in `check` and in the PR body. `check` now diffs such a package against its own target types instead of failing on a stub with no declarations, and `fix` removes the entry in the same install, with the install scope guard allowing exactly that removal. - [#150](#150) [`4c3212b`](4c3212b) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `check typescript` judges a TypeScript 5 to 6 upgrade with both compilers: every project of the workspace is compiled with the installed TypeScript and with the target's, and what is new at the target is a finding; the bundled compiler never stands in, and a target without a JavaScript API (TypeScript 7) is reported as not compiled. A candidate typescript 5 to 6 pack reports the tsconfig options 6.0 deprecates where they are set, the rootDir default, module-keyword namespaces and import assertions. A peer that rejects the target (typescript-eslint on TypeScript 6) is now reported as a peer conflict even when it is not grouped with the package. - [#137](#137) [`21894d7`](21894d7) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Add `verify.build` to uptide.yml: the package.json script a migration pack's required build runs. Unset, Uptide runs `build:ci`, then `build-ci`, then `build`. When a build fails before the framework's build starts because it needs an environment variable or a database (`prisma db push` without `DATABASE_URL`), the pull request and the report say so ("build needs DATABASE_URL; set verify.build") instead of a bare "build failed". `uptide init` writes the setting as a comment. ### Patch Changes - [#141](#141) [`9debb6d`](9debb6d) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `check` no longer reports a pre-existing type error as a breaking site when the upgrade only changes its wording, such as a type the message prints in full. An error at the same place with a different reason is still reported. - [#129](#129) [`e796e4c`](e796e4c) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Add a candidate ioredis 5 to 6 migration pack: client constructions that inherit the RESP3, reconnect and keep-alive defaults ioredis 6 changed, compiler-blind sites (`mode === 'subscriber'`, commands in a `connect` listener with the offline queue off, AUTH recognized by command name), dependents that bundle ioredis 5, instrumentation that stops patching ioredis 6, and Node 20. It is scored against five public upgrades and stays a candidate: none of them has a breaking site to verify it with. - [#139](#139) [`9ba005a`](9ba005a) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Allow local check and fix smoke tests of registered candidate packs with --allow-candidate, with an explicit unverified banner. Reject candidate opt-in in the Action and with publication flags, and prevent stored candidate runs from being published. Label pack-claimed assisted sites by rule id even with --no-llm. - [#157](#157) [`f3af6a1`](f3af6a1) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `check` no longer reports a blocker for a direct dependency whose plain dependency range rejects the target (`@azure/ai-projects` on `openai ^6`, verdaccio pinning express 4): the package manager gives it its own nested copy, so it is listed as staying, with the new major that would accept the target when there is one. `pack test` counts a `with` move that `check` leaves and explains (a blocker, a new-major stay or a peer conflict) as explained, and one of a package that does not depend on the lead as the repository's choice; neither fails the run. - [#130](#130) [`5ced450`](5ced450) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Add a candidate openai 4 to 7 migration pack: named path parameters, `del` → `delete`, promoted beta chat helpers, renamed runner events, removed entry points and request-option overloads are rewritten where unambiguous; tool-call unions, `httpAgent`, `fileFromPath` and the other removals get agent guides; `APIError.headers`, Web `Response` bodies and double-encoded path ids are detected even in code typed `any`; Node 22, zod, fetch and client-subclass decisions carry repository evidence. It stays a candidate (the dependency is still checked and fixed as generic) until two engine gaps its ground truth exposed are closed. - [#136](#136) [`578a042`](578a042) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Fold implicit-any errors (TS7006, TS7031, TS7019) inside an option the target removed into the pack finding on that option, as downstream evidence: the callbacks lost the types the option gave them, and the same edit resolves them. They no longer stand as separate breaking sites. - [#143](#143) [`883e587`](883e587) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `uptide pack test` scores each expected site at the severity of the rule or behavior note it belongs to, so a missed note that only needs a look, or a decision, no longer counts as a missed break. Behavior-note sites get their own precision and recall in the output and in `verification.json` (`behavior`, with the counts behind each rate), false negatives show their severity, and a rate with nothing to measure prints `n/a` instead of 100%, in `pack test` and in the README's packs table. - [#154](#154) [`7aa3d58`](7aa3d58) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `uptide pack test` fails a pack's `verification.json` only when it claims more than the run measures (recorded verified, measured candidate). A pack recorded as candidate on purpose passes, with `recorded candidate by choice; measures verified`, and a record whose numbers differ gets a note instead of a failure. A `generic` ground-truth site now counts as a true positive for the rule that claims it. - [#152](#152) [`ca31aee`](ca31aee) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `uptide pack test` takes several packs: `uptide pack test zod ai`. - [#159](#159) [`1e157fd`](1e157fd) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `uptide pack test --json` times each ground-truth repository: `timing` gives the fetch, install and check wall time and the process's peak memory. - [#144](#144) [`0881185`](0881185) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Ground truth can name a site for an upgrade that only adds lines inside an existing call, such as an option added to a constructor: the site is the call's start line, so a pack finding there scores as a true positive instead of a false positive. `pnpm packs:truth` drafts these anchors from insert-only hunks for review, and docs/packs.md and CONTRIBUTING describe the rule. - [#156](#156) [`9039e3c`](9039e3c) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Public ground truth now exercises three rules that ran as assisted: zod `error-params`, stripe `api-version-unpinned` and next `stable-cache-exports`. Their rewrites run mechanically again. All three packs stay verified. - [#138](#138) [`0db5640`](0db5640) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Respect repository tsconfig file selection, recursive project references, and workspace project options when checking dependency upgrades. Compiler diagnostics outside every TypeScript project no longer produce breaking findings; pack rules and build-configuration findings retain their own scope. Repositories without a tsconfig retain importer-based compilation, with that fallback stated in the report. Anchor missing members supplied by dependency augmentations at their setup import, retaining affected calls as evidence instead of counting each call as a separate breaking edit. - [#151](#151) [`9ddaaff`](9ddaaff) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Add a candidate redis (node-redis) 4 to 5 and 5 to 6 migration pack, one rule set per major: an upgrade gets the rules of the majors it crosses, so 4 to 6 gets both. 4 to 5 covers `legacyMode`, `commandOptions` and isolation, scan iterators that yield batches, string SCAN cursors, boolean replies that became numbers, enums that became constants, `keepAlive`, `@redis/graph` and internal `dist` imports; 5 to 6 covers the RESP3 client type, `unstableResp3`, and the client defaults 6 changes (RESP3, command timeout, keep-alive delay, maintenance notifications) with a decision per client. Scored against five public upgrades; it stays a candidate until the stricter verified gate lands, since the core 4 to 5 API changes have no real site yet. - [#135](#135) [`42a3b54`](42a3b54) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Move only packages released with the upgraded one. A pack's declared release group now bounds the lead's npm scope, and without one a same-scope package moves only when a pin, a peer or a release at the target relates it to the group. Packages of the scope that are versioned on their own (`@sentry/vite-plugin` 5.x, `@sentry/cli`, the old `@sentry/utils` 8.x) are reported as "stays at X" in `check`, the pull request and `pack test` instead of making `fix` refuse the whole upgrade. Registers the verified `@sentry/react` 10 to 11 pack. - [#146](#146) [`09b8682`](09b8682) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Report Stripe clients pinned to different API versions at the top of `check` and of the PR body, as a decision for the owner: every `new Stripe(...)` in TypeScript and JavaScript sources, scripts included, with the version it speaks after the upgrade (an unpinned client speaks the SDK default). The PR's decisions list, for each client behind the target, the changelog entries it would cross for the resources it calls. No pin is rewritten. - [#140](#140) [`bc428d1`](bc428d1) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Keep migration PR bodies within their size budget while preserving summaries, representative diffs, decisions, review warnings and verification ahead of changelog and transitive detail. Keep every evidenced Stripe change visible and uncapped; group and cap only other changes to used resources, link the full changelog, and identify omitted text in the retained report. - [#145](#145) [`3c8902d`](3c8902d) Thanks [@lucasbraum](https://github.com/lucasbraum)! - The zod pack migrates `ZodError#errors` to `.issues` by rule: reads (`error.errors[0].message`, `error?.errors`) and destructuring (`const { errors } = error` becomes `const { issues: errors } = error`) where the type checker resolves the receiver to `ZodError`, and reads off an untyped catch binding of a zod parse. Writes are left to the agent. - [#127](#127) [`c4ead4f`](c4ead4f) Thanks [@lucasbraum](https://github.com/lucasbraum)! - zod: `check` now reports `ZodError#formErrors` and `#errors` read off an untyped catch binding of a zod `parse`/`parseAsync` (`catch (error: any) { return error.formErrors.fieldErrors }`), which zod 4 removed and the compiler cannot see. Files that only import a schema from the repository's own module (`@/lib/zod`) are covered too. `fix` rewrites `<err>.formErrors.fieldErrors` and `<err>.formErrors.formErrors` to `z.flattenError(<err>)`, importing `z` where it is missing; every other read goes to the agent. Co-authored-by: uptide-release[bot] <338861287+uptide-release[bot]@users.noreply.github.com>

fix(packs): allow safe local candidate smoke tests

fba1706

Signed-off-by: Lucas Braum <lucasbraum@gmail.com>

lucasbraum merged commit 9ba005a into main Oct 14, 2026
10 checks passed

lucasbraum deleted the fix/upt-51-allow-candidate branch October 14, 2026 20:57

uptide-release Bot mentioned this pull request Oct 14, 2026

Version Packages #133

Merged

This was referenced Oct 14, 2026

fix(check): an error the upgrade only rewords is not new #141

Merged

fix(packs): score expected sites at their rule's or note's severity (UPT-52) #143

Merged

Navigation Menu

Repository navigation

fix(packs): allow safe local candidate smoke tests (UPT-51) - #139

fix(packs): allow safe local candidate smoke tests (UPT-51)#139
lucasbraum merged 1 commit into
mainfrom
fix/upt-51-allow-candidate

lucasbraum commented Oct 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

lucasbraum commented Oct 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant