chore(deps): bump vite-plus to pkg-pr-new PR #1703#20
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates several dependencies to pre-release versions hosted on pkg.pr.new and introduces configuration changes in pnpm-workspace.yaml. The review feedback highlights critical issues with these changes: first, .npmrc configuration options such as blockExoticSubdeps and minimumReleaseAgeExclude were incorrectly placed in pnpm-workspace.yaml where they will be silently ignored; second, using PR numbers instead of exact commit hashes for pkg.pr.new URLs can cause non-reproducible builds and version mismatches across dependencies.
| blockExoticSubdeps: false | ||
|
|
||
| minimumReleaseAge: 1440 | ||
| minimumReleaseAgeExclude: | ||
| - vite-plus | ||
| - '@voidzero-dev/*' | ||
| - '@oxc-project/*' | ||
| - '@oxlint/*' | ||
| - oxlint | ||
| - oxfmt | ||
| - oxlint-tsgolint |
There was a problem hiding this comment.
The settings blockExoticSubdeps and minimumReleaseAgeExclude (as well as the existing minimumReleaseAge) are .npmrc configuration options (typically written as block-exotic-subdeps and minimum-release-age-exclude in kebab-case). Defining them in pnpm-workspace.yaml is not supported by pnpm and they will be silently ignored.
To make these settings take effect, they should be moved to the .npmrc file at the root of the workspace:
block-exotic-subdeps=false
minimum-release-age=1440
minimum-release-age-exclude=vite-plus,@voidzero-dev/*,@oxc-project/*,@oxlint/*,oxlint,oxfmt,oxlint-tsgolintminimumReleaseAge: 1440| "vitest": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-test@1703", | ||
| "vite-plus": "https://pkg.pr.new/voidzero-dev/vite-plus@1703" |
There was a problem hiding this comment.
Using PR numbers (e.g., @1703) for pkg.pr.new URLs can lead to non-reproducible builds and caching issues because the PR can be updated with new commits.
Additionally, there is an inconsistency where the direct dependencies use the PR number @1703 but the overrides section in pnpm-workspace.yaml uses the exact commit hash d0b407c85b560c2470395176c9f1c838b5ca8af8. This can lead to version mismatches (e.g., vite-plus resolving to a newer commit on the PR while other packages are locked to the older commit).
It is highly recommended to use the exact commit hash for all pkg.pr.new dependency URLs to ensure immutability and consistency.
| "vitest": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-test@1703", | |
| "vite-plus": "https://pkg.pr.new/voidzero-dev/vite-plus@1703" | |
| "vitest": "https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-test@d0b407c85b560c2470395176c9f1c838b5ca8af8", | |
| "vite-plus": "https://pkg.pr.new/voidzero-dev/vite-plus@d0b407c85b560c2470395176c9f1c838b5ca8af8" |
| 'entities': '^7.0.1' | ||
| 'estree-walker': ^2.0.2 | ||
| 'vite': npm:@voidzero-dev/vite-plus-core@latest | ||
| 'vite': https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-core@1703 |
There was a problem hiding this comment.
For consistency and build reproducibility, use the exact commit hash d0b407c85b560c2470395176c9f1c838b5ca8af8 instead of the PR number @1703 here as well.
'vite': https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-core@d0b407c85b560c2470395176c9f1c838b5ca8af8
fengmk2
changed the title
1 participant
Summary
Bump
vite-plusand related packages to the pkg-pr-new prerelease build for upstream PR voidzero-dev/vite-plus#1703 (commit d0b407c).Updated where applicable:
vite-plusvitest(alias to@voidzero-dev/vite-plus-test)vite(alias to@voidzero-dev/vite-plus-core)overrides/resolutions/pnpm.overrides/pnpm-workspace.yamlcatalogsminimumReleaseAgeconfigurationTest plan