Repository navigation
chore(deps): add a 7-day npm min-release-age - #51
Conversation
Set min-release-age=7 in a project .npmrc so npm install and npm update skip versions published in the last week. Document the rule, its override, and how it interacts with npm ci, npm audit fix, and Dependabot security updates. Change-Id: I9e4a7cf86a081e5fe732d10e9f910aa64349ed46 Signed-off-by: Thomas Kosiewski <tk@coder.com>
|
@codex review |
|
@codex security review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3d1866f429
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Change-Id: I191b33b796b1ec9d33ab419f2c255ac93ae2a71d Signed-off-by: Thomas Kosiewski <tk@coder.com>
npm before 11.10 ignores min-release-age, so a contributor on Node 22 (npm 10.9) would resolve brand-new releases with no error. devEngines stops npm 10.9 and later in this checkout. Consumers of the package are not checked. Change-Id: I39f8ed21c6aaff0dc8daa3eb2390cc7da0181e56 Signed-off-by: Thomas Kosiewski <tk@coder.com>
|
@codex review |
|
@codex security review |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
--- _Generated with [`xum`](https://github.com/coder/xum) • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_
## Why Ship the fixes merged since `v0.1.0-beta.3` to npm, so downstream projects such as agent-tty can update. The consumer-visible change is #53: `getNativeInfo()` now reports the Ghostty commit the addon was built from (`ghosttyCommit`), and `ghosttyVersion` reads `0.1.0-dev+<commit>`. ## What changed - `package.json` and `package-lock.json` go from `0.1.0-beta.3` to `0.1.0-beta.4`. The branch name matches the version, so `publish.yml` creates `v0.1.0-beta.4` after merge. - The `release-changelog` workflow adds the CHANGELOG entry to this branch. ## Scope - Included since beta.3: #53 (Ghostty commit in `getNativeInfo()`), #51 (7-day `min-release-age` for this repo's own npm installs, `devEngines` npm >= 11.10), #52 (verify skill scripts, not in the npm tarball), #50 (skill sync, not in the tarball). ## Blast Radius The merge publishes `0.1.0-beta.4` to npm under the `beta` dist-tag. `latest` stays on `0.1.0-beta.0`. The tarball's `package.json` now carries `devEngines`. npm checks it only for the project it runs in, and the #51 verifier installed a packed tarball with npm 9.9.4, 10.8.2, 10.9.8 and 11.20.0 (all exit 0). `.npmrc` is not in the tarball. ## Verification - `prepare-release-changelog.mjs` prints `should_generate=true` and `version-changed`. `resolve-npm-publish-tag.mjs` prints `beta`. - Local gate on this branch with Node 26.12.1: results posted as a PR comment. --- _Generated with [`xum`](https://github.com/coder/xum) • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_
Why
The goal is to fix every open issue on this repo. #16 showed that a manual
npm updateadopts releases that are only 1 to 5 days old. This PR makes npm wait 7 days before it picks a new version, so a compromised or broken release has time to be found and pulled first.Closes #18
What changed
.npmrcwithmin-release-age=7. It needs npm 11.10 or later, and the pinned Node 26.12.1 ships npm 11.20.devEnginesinpackage.jsonstops npm 10.9 to 11.9 in this checkout withEBADDEVENGINES, because those versions ignore the setting without an error.--min-release-age=0), and two caveats.npm audit fixcan be blocked, and a barenpm updatemoves lockfile entries younger than 7 days back to older versions.Scope
npm installandnpm updatein this checkout. npm 10.8 and older (Node 20, end of life) ignore both the setting anddevEngines..github/dependabot.yml. Itscooldownapplies only to version updates, and adding the file would turn on version-update PRs. This repo bundles dependency updates by hand (chore(deps): combine dependency updates #16) because Dependabot's lockfile-only PRs conflict with each other. Dependabot also readsmin-release-agefrom.npmrcas the cooldown if version updates are added later (dependabot-core#15132).Blast Radius
Only contributors who run npm in this repo see it.
npm ci(CI, release) installs the lockfile as pinned and ignores release age. Dependabot security updates pass--min-release-age=0and are not delayed (dependabot-core#15139, #15386). npm never packs.npmrcand checksdevEnginesonly for the root project, so consumers are unaffected (a consumer on npm 10.9.8 installs a dependency that has thisdevEngineswith exit 0).Verification
npm update --package-lock-only: without.npmrcrolldown goes to 1.2.16 (0.86 days old). With it rolldown stays at 1.2.15, and the youngest lockfile entry is 8.73 days old.rolldown@^1.2.14resolves to 1.2.15, not 1.2.16.rolldown@1.2.16fails withETARGET. Adding--min-release-age=0installs it. A lockfile that already pins 1.2.16 still passesnpm ciandnpm install..npmrcresolves rolldown 1.2.16 and exits 0. WithdevEngines,npm ci,npm installandnpm runstop withEBADDEVENGINES. npm 11.12.1 and 11.20.0 pass..npmrcanddevEnginesin place:npm ci, build:libghostty, build:native, build, typecheck, test (85 passed), smoke, andnpm pack --dry-runall exit 0. The tarball has no.npmrc.Generated with
xum• Model:anthropic:claude-opus-5-5• Thinking:high