Repository navigation
feat(packs): anchor a pure insertion into an unchanged call as a ground-truth site (UPT-53) - #144
Merged
Merged
Conversation
`pack test` counted every missed site as a breaking false negative unless a *rule* with that id was deprecated: `BehaviorNote.severity` was never read, so missed behavior-note sites that only need a look (ioredis `client-defaults`) were reported as missed breaks. An expected site now takes the severity of the rule or note it is expected under: a note's own `severity`, breaking when it reports findings without one (as `check` reports them), and `behavior` for a note `check` never reports. Behavior-note sites get their own precision and recall, in the output and in verification.json (`behavior`); both tallies record the counts behind their rates, so a zero denominator prints `n/a` in `pack test` and the README table instead of 100%. False negatives print their severity. Older records still read as before. Fixes UPT-52. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011t9c3ZLsM9B3KiYGPFDyyK Signed-off-by: Claude <noreply@anthropic.com>
… rate `uptide pack test --write` for every registered pack, against the same ground truth: each verification.json gains `behavior` and the true-positive and false-negative counts under `breaking`. Status, truth digest, repositories, and breaking precision, recall and false positives are unchanged for all ten packs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011t9c3ZLsM9B3KiYGPFDyyK Signed-off-by: Claude <noreply@anthropic.com>
What a full `pnpm uptide pack test` run needs on a contributor's machine: corepack enabled for Yarn only (a blanket `corepack enable` shims the global pnpm too), COREPACK_NPM_REGISTRY where repo.yarnpkg.com is blocked, and per-pack cache directories evicted after each pack to bound disk. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011t9c3ZLsM9B3KiYGPFDyyK Signed-off-by: Claude <noreply@anthropic.com>
…nd-truth site docs/packs.md counted no pure insertion as a site, so an upgrade that only adds an option inside an existing call (open-foundry pinned `protocol: 2` in its Redis constructor) could not be written as ground truth: a pack finding at that call always scored as a false positive. Such an insertion is now a site at the start line of the innermost call (or `new`) whose parentheses hold it, through object and array literals, or of an object literal no call takes. Insertions between statements, into a function body, or into a call the upgrade also changed stay out. The diff reading moves from scripts/packs-truth.ts into packs/tooling/truth-diff.ts, and `pnpm packs:truth` prints the drafted `anchors` for review. Scoring is unchanged: sites are lines. Fixes UPT-53. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011t9c3ZLsM9B3KiYGPFDyyK Signed-off-by: Claude <noreply@anthropic.com>
Merged
7 of 8 tasks
lucasbraum
pushed a commit
that referenced
this pull request
Oct 15, 2026
…everities Rebased on main (#143, #144). The ground truth gains the four ioredis insertion anchors packs:truth now drafts (protocol: 2 and retryStrategy added inside unchanged constructor calls); no earlier site moved. Behavior notes 70% precision, 54% recall; still a candidate with no breaking false positive and no breaking prediction. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017BYqQRCpXk6jz9vcCnx21H Signed-off-by: Claude <noreply@anthropic.com>
lucasbraum
added a commit
that referenced
this pull request
Oct 15, 2026
## Pack `ioredis` `>=5 <6` → `>=6 <7` (queue entry `ioredis`, now `blocked`). **Candidate, not verified.** No breaking false positive on five public merged upgrades. But none of them has a compiler diagnostic or a breaking site in application code; the only breaking expected sites are two lines of test data, which the pack doesn't predict. So the gate (≥1 predicted breaking finding) can't be met honestly. Evidence: `packages/core/src/packs/ioredis/RESEARCH.md`. **Rebased on main `3c8902d` (2026-10-15).** The only conflicts were `registry.ts` (both entries kept, alphabetical) and the generated README table (regenerated). The rebase also picks up #145's re-recorded react-router `verification.json`; the Packs workflow had been red on main since #143 without it. After the rebase, #143 and #144 changed scoring and the ground-truth rule: - I re-ran `pnpm packs:truth` on all five repositories: still no compiler diagnostic. - I added the four ioredis insertion anchors it now drafts, unchanged. - I dropped one anchor from the @sentry/node bump. - No earlier site was moved or removed. - The revision is recorded in the truth's `$comment` and in RESEARCH.md. ## Sources All read 2026-10-14 and pinned: - the official [Upgrading from v5 to v6](https://github.com/redis/ioredis/wiki/Upgrading-from-v5-to-v6) (wiki `e859962`) - the CHANGELOG and README at `v6.0.0` - #2127 (RESP3), #2160 (defaults), #2206 (String.prototype, only in 6.1.0-beta.1) - the BullMQ 6.0.0 changelog - the published `ioredis` 5.11.1/6.0.0 and `@ioredis/commands` 1.10.0/2.0.0 tarballs, diffed - the dependents' registry manifests v6 removes **no** command (373 → 382 methods) and no public export. Reply shapes and types are unchanged for default (`"legacy"`) clients, and so are event names and `exec()` types. Breaking changes: Node ≥20, RESP3 by default, plus new `retryStrategy`/`keepAlive` defaults. ## Rules and behavior notes **Assisted rules** (no rewrite): - `bundled-ioredis`: TS2322/2345/2739-41 naming `Redis<"legacy">` not assignable, i.e. a dependent that installs its own ioredis 5. The guide gives options (a)–(d), so the agent's choice lands in *Decisions for you*. Never a cast. - `duplicate-signature`: TS2416/2430 on `'duplicate'` overrides. **Finding notes** (syntactic, binding-aware): - `client-defaults` (deprecated, also a decision): constructions that leave `protocol`/`retryStrategy`/`keepAlive` at the changed defaults. Tests are skipped. - `subscriber-mode` (breaking): `mode === 'subscriber'`. - `offline-queue-connect` (breaking): a `connect` listener sending a command when `enableOfflineQueue: false`. - `handshake-auth` (breaking): AUTH recognized by command name. v6 sends credentials inside `HELLO 3 AUTH`. **Decision notes** (with `applies()` evidence): - `node-20` - `bundled-copies`: bullmq <6, bull, @hocuspocus/extension-redis, @chat-adapter/state-ioredis, cache-manager-ioredis-yet - `instrumentation`: OTel `instrumentation-ioredis` <0.70 / `auto-instrumentations-node` <0.80 - `stale-types`: `@types/ioredis` - `string-prototype`: target exactly 6.0.0 - `also-review` **Not declared:** - No release group: ioredis ships alone. - No `requiresBuild`: no case of a build failing where tsc passes. - Explicit peers rejecting 6 (typeorm, ioredis-mock, @liaoliaots/nestjs-redis) are left to the engine's peer-conflict report. ## Ground-truth repositories | Repository | Parent | Upgrade | Findings | | --- | --- | --- | --- | | ferni-ai/voiceai | `c59ed09` | `c6838d5` (#703) | 7 `client-defaults` (protocol: 2 pins, 2 of them insertion anchors) | | syzygyhack/open-foundry | `7391001` | `a466e0d` | 2 `client-defaults` (1 anchor) | | simondietschi/dokunc | `83681ed` | `c475390` (#15) | 2 `client-defaults` (v5 retryStrategy, 1 anchor), 2 `handshake-auth` | | safe-global/safe-client-gateway | `14bd05b` | `80135d2` (#3409) | 0 (control, Yarn Berry) | | kazumadev619-dev/FishingConditionsApp | `8ba3f0d` | `cdecc03` (#235) | 0 (control, npm) | Screened out: elie222/inbox-zero#3821. Its TS2322 (two copies via bullmq 5) is a `packs:truth` linking artifact; a real scripts-off install compiles it. Its upgrade also moved bullmq 5 → 6. ## `uptide pack test` output ``` uptide pack test ioredis · candidate fixtures 6 cases, 19 sites · pass ground truth ferni-ai/voiceai@c59ed0982f96 ioredis 5.8.2 → 6.0.0 predicted 6, expected 7, false positives 2, false negatives 3 syzygyhack/open-foundry@73910018b5e8 ioredis 5.10.1 → 6.0.0 predicted 1, expected 2, false positives 0, false negatives 1 simondietschi/dokunc@83681ed0ccc5 ioredis 5.11.1 → 6.0.0 predicted 2, expected 4, false positives 0, false negatives 2 ✗ blocked: @hocuspocus/extension-redis 4.7.0 depends on ioredis ~5.6.1; no release accepts ioredis 6.0.0 safe-global/safe-client-gateway@14bd05b98bf4 ioredis 5.11.1 → 6.0.0 predicted 0, expected 0, false positives 0, false negatives 0 kazumadev619-dev/FishingConditionsApp@8ba3f0d24bc7 ioredis 5.11.1 → 6.0.0 predicted 1, expected 0, false positives 1, false negatives 0 with @types/ioredis 4.28.10 → 5.0.0 rule precision recall tp fp fn client-defaults 70% 64% 7 3 4 handshake-auth n/a 0% 0 0 2 overall (sites) 70% 54% 7 3 6 behavior notes (sites) 70% 54% 7 3 6 breaking (sites) n/a 0% 0 0 2 PASS ioredis: candidate ``` The dokunc "blocked" line is the engine's own report (#142) of the bundled hocuspocus copy that `bundled-copies` describes; the repository upgraded anyway, keeping both copies. **Remaining false positives:** - voiceai `:101`/`:92` against truth `:98`/`:89`: the anchor is at the first line of the rewritten run. - FishingConditionsApp `client.ts:13`: a client deliberately left on RESP3. **Remaining false negatives:** - voiceai `embedding-cache.ts:134`: the module name is hidden from static scans. - voiceai `:98`/`:89` and open-foundry `:136`: anchor offsets. - dokunc `log.test.ts:20/28`: `handshake-auth`, test data. **Engine gaps still open** (RESEARCH.md): 1. A runtime-only major can't reach `verified`. 2. Detection reaches only files with static usages. 3. There is no "remove a package" outcome (`@types/ioredis`). 4. `with` can't model a required dependent major. 5. `packs:truth` links per workspace, and `--directory` fails with a root lockfile. Gaps 2 and 3 of the original list were resolved by #143 and #144. ## Checklist - [x] Every rule and note comes from a source listed in `meta.sources` - [x] Every rule that rewrites or detects has a fixture case, with a site it must leave alone (`keep`). The two compiler-claim rules are unit-tested instead, because a `message:` marker can't contain `"`. - [x] Ground truth: public repositories at the commit before their upgrade; expected findings read from their own upgrade commit and the compiler, never copied from Uptide's output - [ ] At least two public repositories for `verified`; otherwise the pack ships as a candidate (5 repos, still a candidate: no predicted breaking site) - [x] `pnpm uptide pack test ioredis` passes and its output is pasted above; `verification.json` written with `--write` - [x] `pnpm lint && pnpm typecheck && pnpm test` pass: core 1727 passed / 32 network-skipped, CLI 454 passed; lint at baseline; `docs:packs --check` current. All 10 CI checks pass on `30579da`, Pack test included. - [x] Changeset added - [x] No private code, names or paths anywhere: fixtures are synthetic, ground truth is public No third-party repository was pushed to, commented on or modified. Every install ran with scripts off, and no bare `npx` was used. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_017BYqQRCpXk6jz9vcCnx21H --------- Signed-off-by: Claude <noreply@anthropic.com> Co-authored-by: Claude <noreply@anthropic.com>
lucasbraum
pushed a commit
that referenced
this pull request
Oct 15, 2026
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## uptide@0.13.0 ### Minor Changes - [#134](#134) [`b795705`](b795705) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Packs can name alternate leads: packages a repository declares instead of the pack's own (`react-router-dom` for `react-router`). `check` and `fix` asked for either name use the pack; where only the alternate is declared, the lead is analyzed at the version installed through it, pnpm stores included, and `fix` declares it beside the alternate at the target before upgrading both. - [#149](#149) [`3303118`](3303118) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Add a candidate express 4 to 5 migration pack. Route strings that path-to-regexp 8 rejects or reads differently are found on calls of an Express app or router (including lists registered in a loop); `req.params` values widened to `string | string[]`, `req.param`, `res.sendfile`, `express.static.mime` and `express.query` are claimed from the compiler; `res.redirect(url, status)`, `app.param(fn)`, `res.redirect('back')` and `res.send(<number>)` are found in the source; runtime defaults (async errors, `req.body`, the query parser, `urlencoded`, dotfiles, Node 18) go to decisions. No rule rewrites. With the pack in use, `check` no longer adds its text-matched express 5 runtime findings. - [#148](#148) [`5143c46`](5143c46) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Add a candidate joi 17 to 18 migration pack. `new ValidationError(message, {}, original)`, which stops compiling for code written against joi 17.0–17.6, is rewritten to pass `[]`; the Node.js 20 requirement and the top-level domains joi 18 no longer accepts in `email()`, `domain()` and `uri()` are reported as decisions. Scored against two public repositories, one of them a negative control. - [#131](#131) [`413d3da`](413d3da) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Add a verified lucide-react 0.x to 1.x migration pack. Brand icons removed in 1.x are found at their imports and every use, with a guide whose replacement choice goes to the owner; icon names dropped during 0.x are renamed at the import or member; deep `dist/` imports, untyped icon lookups, the `absoluteStrokeWidth` and `IconNode` deprecations, and the `aria-hidden` default for repositories before 0.489.0 are reported. Lucide's lockstep packages move together and the consumer's build is required. Verified against three public repositories, one of them a negative control. - [#132](#132) [`107c107`](107c107) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Add a verified React Router 6 → 7 migration pack, which also runs for applications that declare only `react-router-dom`. It moves `react-router-dom` imports to `react-router`. It reports, with a guide for the agent, the rest of the upgrade: the removed `future` prop and router option, `react-router-dom/server`, lowercase `formMethod` comparisons and `json`/`defer` calls (found by syntax where the compiler is blind), the other removed exports, and `generatePath` calls that pass `null` for a required parameter. The six v6 future flags that become defaults are reported as decisions where the repository's router setup has not enabled them. React Router 7 → 8 is a separate upgrade. - [#142](#142) [`9c57934`](9c57934) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `check` and `fix` plan what the target version requires: a package the target, or anything moving with it, declares as a peer or dependency at a range the installed copy rejects moves to the lowest release of its major that satisfies it (openai 7 moves zod 3.24.2 to 3.25.0), shown apart from release-group companions ("moved because openai 7.4.0 requires zod ^3.25 || ^4.0"). A move only a new major makes is never made: it is reported as a blocker with the exact range in `check`, the PR body and `pack test`. The npm install scope guard no longer lets a declared root dependency change because a moved package peers on it. - [#128](#128) [`06f11ab`](06f11ab) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Add verified Sentry JavaScript SDK 10 to 11 migration packs for `@sentry/nextjs` and `@sentry/browser`, with the SDK's lockstep release group, a required build for Next.js, and inventory-scoped decisions for data collection, span streaming, sampling and platform minimums. Mechanical rules move `withSentryConfig` to `@sentry/nextjs/config` and the removed build options under `webpack`, remove `enableLogs`/`enableMetrics: true`, and rename exports, integration names and `httpIntegration` options; privacy, sampling, profiling and OpenTelemetry choices stay assisted and are reported for the owner. Fix `uptide pack new` dropping registry entries long enough to be wrapped. - [#155](#155) [`922c5ab`](922c5ab) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `uptide pack test` applies a stricter verified gate: at least five expected breaking sites across the public ground-truth repositories, besides two repositories and no breaking false positive. Upgrades the compiler cannot see are gated on their behavior notes instead. Mechanical rules no real site exercises are recorded as unexercised, and `check` and `fix` run their sites as assisted. `@sentry/browser` and `@sentry/react` become candidates (fewer than five real breaking sites). A pack can lower the minimum only with a written reason in its RESEARCH.md. The README packs table shows each pack's breaking-site count. The output shows the gate's class, site counts and every reason a pack is a candidate. - [#147](#147) [`0b88170`](0b88170) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `check` and `fix` remove a deprecated `@types` stub instead of upgrading to it. When the release the upgrade would move `@types/<pkg>` to is deprecated on npm, and `<pkg>`'s target declares its own types (`types`, `typings` or a `types` export), the plan removes it: "Removed: @types/ioredis, ioredis 5 ships its own types", in `check` and in the PR body. `check` now diffs such a package against its own target types instead of failing on a stub with no declarations, and `fix` removes the entry in the same install, with the install scope guard allowing exactly that removal. - [#150](#150) [`4c3212b`](4c3212b) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `check typescript` judges a TypeScript 5 to 6 upgrade with both compilers: every project of the workspace is compiled with the installed TypeScript and with the target's, and what is new at the target is a finding; the bundled compiler never stands in, and a target without a JavaScript API (TypeScript 7) is reported as not compiled. A candidate typescript 5 to 6 pack reports the tsconfig options 6.0 deprecates where they are set, the rootDir default, module-keyword namespaces and import assertions. A peer that rejects the target (typescript-eslint on TypeScript 6) is now reported as a peer conflict even when it is not grouped with the package. - [#137](#137) [`21894d7`](21894d7) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Add `verify.build` to uptide.yml: the package.json script a migration pack's required build runs. Unset, Uptide runs `build:ci`, then `build-ci`, then `build`. When a build fails before the framework's build starts because it needs an environment variable or a database (`prisma db push` without `DATABASE_URL`), the pull request and the report say so ("build needs DATABASE_URL; set verify.build") instead of a bare "build failed". `uptide init` writes the setting as a comment. ### Patch Changes - [#141](#141) [`9debb6d`](9debb6d) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `check` no longer reports a pre-existing type error as a breaking site when the upgrade only changes its wording, such as a type the message prints in full. An error at the same place with a different reason is still reported. - [#129](#129) [`e796e4c`](e796e4c) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Add a candidate ioredis 5 to 6 migration pack: client constructions that inherit the RESP3, reconnect and keep-alive defaults ioredis 6 changed, compiler-blind sites (`mode === 'subscriber'`, commands in a `connect` listener with the offline queue off, AUTH recognized by command name), dependents that bundle ioredis 5, instrumentation that stops patching ioredis 6, and Node 20. It is scored against five public upgrades and stays a candidate: none of them has a breaking site to verify it with. - [#139](#139) [`9ba005a`](9ba005a) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Allow local check and fix smoke tests of registered candidate packs with --allow-candidate, with an explicit unverified banner. Reject candidate opt-in in the Action and with publication flags, and prevent stored candidate runs from being published. Label pack-claimed assisted sites by rule id even with --no-llm. - [#157](#157) [`f3af6a1`](f3af6a1) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `check` no longer reports a blocker for a direct dependency whose plain dependency range rejects the target (`@azure/ai-projects` on `openai ^6`, verdaccio pinning express 4): the package manager gives it its own nested copy, so it is listed as staying, with the new major that would accept the target when there is one. `pack test` counts a `with` move that `check` leaves and explains (a blocker, a new-major stay or a peer conflict) as explained, and one of a package that does not depend on the lead as the repository's choice; neither fails the run. - [#130](#130) [`5ced450`](5ced450) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Add a candidate openai 4 to 7 migration pack: named path parameters, `del` → `delete`, promoted beta chat helpers, renamed runner events, removed entry points and request-option overloads are rewritten where unambiguous; tool-call unions, `httpAgent`, `fileFromPath` and the other removals get agent guides; `APIError.headers`, Web `Response` bodies and double-encoded path ids are detected even in code typed `any`; Node 22, zod, fetch and client-subclass decisions carry repository evidence. It stays a candidate (the dependency is still checked and fixed as generic) until two engine gaps its ground truth exposed are closed. - [#136](#136) [`578a042`](578a042) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Fold implicit-any errors (TS7006, TS7031, TS7019) inside an option the target removed into the pack finding on that option, as downstream evidence: the callbacks lost the types the option gave them, and the same edit resolves them. They no longer stand as separate breaking sites. - [#143](#143) [`883e587`](883e587) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `uptide pack test` scores each expected site at the severity of the rule or behavior note it belongs to, so a missed note that only needs a look, or a decision, no longer counts as a missed break. Behavior-note sites get their own precision and recall in the output and in `verification.json` (`behavior`, with the counts behind each rate), false negatives show their severity, and a rate with nothing to measure prints `n/a` instead of 100%, in `pack test` and in the README's packs table. - [#154](#154) [`7aa3d58`](7aa3d58) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `uptide pack test` fails a pack's `verification.json` only when it claims more than the run measures (recorded verified, measured candidate). A pack recorded as candidate on purpose passes, with `recorded candidate by choice; measures verified`, and a record whose numbers differ gets a note instead of a failure. A `generic` ground-truth site now counts as a true positive for the rule that claims it. - [#152](#152) [`ca31aee`](ca31aee) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `uptide pack test` takes several packs: `uptide pack test zod ai`. - [#159](#159) [`1e157fd`](1e157fd) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `uptide pack test --json` times each ground-truth repository: `timing` gives the fetch, install and check wall time and the process's peak memory. - [#144](#144) [`0881185`](0881185) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Ground truth can name a site for an upgrade that only adds lines inside an existing call, such as an option added to a constructor: the site is the call's start line, so a pack finding there scores as a true positive instead of a false positive. `pnpm packs:truth` drafts these anchors from insert-only hunks for review, and docs/packs.md and CONTRIBUTING describe the rule. - [#156](#156) [`9039e3c`](9039e3c) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Public ground truth now exercises three rules that ran as assisted: zod `error-params`, stripe `api-version-unpinned` and next `stable-cache-exports`. Their rewrites run mechanically again. All three packs stay verified. - [#138](#138) [`0db5640`](0db5640) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Respect repository tsconfig file selection, recursive project references, and workspace project options when checking dependency upgrades. Compiler diagnostics outside every TypeScript project no longer produce breaking findings; pack rules and build-configuration findings retain their own scope. Repositories without a tsconfig retain importer-based compilation, with that fallback stated in the report. Anchor missing members supplied by dependency augmentations at their setup import, retaining affected calls as evidence instead of counting each call as a separate breaking edit. - [#151](#151) [`9ddaaff`](9ddaaff) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Add a candidate redis (node-redis) 4 to 5 and 5 to 6 migration pack, one rule set per major: an upgrade gets the rules of the majors it crosses, so 4 to 6 gets both. 4 to 5 covers `legacyMode`, `commandOptions` and isolation, scan iterators that yield batches, string SCAN cursors, boolean replies that became numbers, enums that became constants, `keepAlive`, `@redis/graph` and internal `dist` imports; 5 to 6 covers the RESP3 client type, `unstableResp3`, and the client defaults 6 changes (RESP3, command timeout, keep-alive delay, maintenance notifications) with a decision per client. Scored against five public upgrades; it stays a candidate until the stricter verified gate lands, since the core 4 to 5 API changes have no real site yet. - [#135](#135) [`42a3b54`](42a3b54) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Move only packages released with the upgraded one. A pack's declared release group now bounds the lead's npm scope, and without one a same-scope package moves only when a pin, a peer or a release at the target relates it to the group. Packages of the scope that are versioned on their own (`@sentry/vite-plugin` 5.x, `@sentry/cli`, the old `@sentry/utils` 8.x) are reported as "stays at X" in `check`, the pull request and `pack test` instead of making `fix` refuse the whole upgrade. Registers the verified `@sentry/react` 10 to 11 pack. - [#146](#146) [`09b8682`](09b8682) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Report Stripe clients pinned to different API versions at the top of `check` and of the PR body, as a decision for the owner: every `new Stripe(...)` in TypeScript and JavaScript sources, scripts included, with the version it speaks after the upgrade (an unpinned client speaks the SDK default). The PR's decisions list, for each client behind the target, the changelog entries it would cross for the resources it calls. No pin is rewritten. - [#140](#140) [`bc428d1`](bc428d1) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Keep migration PR bodies within their size budget while preserving summaries, representative diffs, decisions, review warnings and verification ahead of changelog and transitive detail. Keep every evidenced Stripe change visible and uncapped; group and cap only other changes to used resources, link the full changelog, and identify omitted text in the retained report. - [#145](#145) [`3c8902d`](3c8902d) Thanks [@lucasbraum](https://github.com/lucasbraum)! - The zod pack migrates `ZodError#errors` to `.issues` by rule: reads (`error.errors[0].message`, `error?.errors`) and destructuring (`const { errors } = error` becomes `const { issues: errors } = error`) where the type checker resolves the receiver to `ZodError`, and reads off an untyped catch binding of a zod parse. Writes are left to the agent. - [#127](#127) [`c4ead4f`](c4ead4f) Thanks [@lucasbraum](https://github.com/lucasbraum)! - zod: `check` now reports `ZodError#formErrors` and `#errors` read off an untyped catch binding of a zod `parse`/`parseAsync` (`catch (error: any) { return error.formErrors.fieldErrors }`), which zod 4 removed and the compiler cannot see. Files that only import a schema from the repository's own module (`@/lib/zod`) are covered too. `fix` rewrites `<err>.formErrors.fieldErrors` and `<err>.formErrors.formErrors` to `z.flattenError(<err>)`, importing `z` where it is missing; every other read goes to the agent. Co-authored-by: uptide-release[bot] <338861287+uptide-release[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes UPT-53. Stacked on #143 (UPT-52): review only the last commit; this PR retargets to
mainonce that one merges.What and why
docs/packs.md counted no pure insertion as a site. So an upgrade that only adds lines inside an existing call could not be written as ground truth. The typical example is an option added to a constructor: open-foundry pinned
protocol: 2insidenew RedisClient(redisUrl, {atpackages/api/src/server.ts:138. A pack that reports the same constructor can never score a true positive there; its finding shows as a false positive. Found by the ioredis pack (#129).This PR:
new) whose parentheses hold the inserted lines, through object and array literals, or of the object literal when no call takes it. It is not a site when it falls between statements, inside a function body (even one passed to a call), or inside a call the upgrade also changed (those changed lines are already its site).pnpm packs:truthdrafts these anchors, for review like every other drafted site. The JSON draft getsanchors: [{ file, line, text, within, inserted }];changedandinsertedare as before. The diff reading moves fromscripts/packs-truth.tsintopackages/core/src/packs/tooling/truth-diff.ts(diffLines,enclosingLiteral,insertionAnchors), where it is unit-tested; the script's output forchangedandinsertedis unchanged.packs:truthprints) and CONTRIBUTING "Write a pack" step 5.Scoring needs no change: sites are file and line, so an anchored site scores like any other. No pack's ground truth changes here. Adding the anchors to ioredis's truth is #129's call.
How it was verified
Failing test first.
packages/core/src/packs/tooling/truth-diff.test.tsis modeled on open-foundryserver.ts:135–145, with synthetic code and the same diff shape: lines 135–137 rewritten (the truth's site at:136) plus a pure insertion after:138, inside the constructor call. Before this change there was no anchor (the module did not exist), and the prediction at:138scores as a false positive. After: the insertion is drafted at:138, and with that site in the truth the prediction is a true positive. Negative cases cover insertions between statements, into a callback body, after the closing), and into a call whose lines also changed. Writing the tests also caught a real bug before it shipped: an argument added after a trailing comma was missed.On the real repositories (read only, scripts off),
pnpm packs:truth ioredis …on this branch drafts:packages/api/src/server.ts:138redisClient = new RedisClient(redisUrl, {protocol: 2,:138src/services/data/redis-pubsub.ts:140this.publisher = new Redis(redisUrl, {protocol: 2,:140src/services/platform/rate-limiter.ts:57redisClient = new Redis(redisUrl, {protocol: 2,:57apps/web/src/lib/redis.ts:54const client = new Redis(url, {retryStrategy: reconnectDelay,:54These are exactly the four "real constructions the upgrade changed, but by pure insertion" that #129's RESEARCH.md lists as unscorable. voiceai also drafts one object anchor (
src/utils/__tests__/error-scrub.test.ts:44,return {gainingstatus: 'ok') from the @sentry/node bump in the same commit. The reviewer drops it, as the drafting flow intends.Re-score of every registered pack. Base: this branch's parent (#143), itself on main at
9ba005a. Same fetch, scripts off, caches evicted per pack:ailucide-reactnextreactsentry-browsersentry-nextjssentry-reactstripevitestzodIdentical for every pack: this PR changes drafting and docs, not scoring.
pack test --writechanged no record.pnpm lint,pnpm typecheckandpnpm testpass (core 1656 passed / 32 skipped, CLI 453 passed).pnpm docs:linkspasses.Checklist
pnpm lint && pnpm typecheck && pnpm testpassts-morph)🤖 Generated with Claude Code
https://claude.ai/code/session_011t9c3ZLsM9B3KiYGPFDyyK
Generated by Claude Code