revert: pin @types/node back to ^25.9.3 (unbreak main CI)#2177
Merged
Conversation
Reverts #2160 (bump @types/node 25.9.3 → 26.0.0). @types/node 26 tightened the crypto key types so `KeyObject` (returned by `createPublicKey`) is no longer assignable to the verify-key union, breaking the build: packages/cli/src/commands/plugin/sign.ts(93,35): error TS2345: 'KeyObject' is not assignable to 'PublicKeyInput | RawPublicKeyInput | JsonWebKeyInput | BinaryLike' main was red across Build Core / Test Core / TypeScript Type Check / Release, blocking every open framework PR. @types/node is a dev-only dependency, so pinning back to ^25.9.3 is a safe, immediate unblock; dependabot will re-propose the bump once the upstream crypto types settle (or we fix-forward `@objectstack/core`'s verifyPayload signature). Verified: `pnpm install --frozen-lockfile` clean; `@objectstack/cli` build green (sign.ts compiles). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 36 package(s): 105 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
xuyushun441-sys
added a commit
that referenced
this pull request
Jun 22, 2026
…er stricter crypto types (#2180) Re-applies the @types/node 25→26 bump (originally #2160; reverted in #2177 to unbreak main). @types/node 26 narrowed `createPublicKey`'s input union to drop `KeyObject`, which broke the publisher self-check in `os plugin sign`: packages/cli/src/commands/plugin/sign.ts: createPublicKey(createPrivateKey(privateKeyPem)) // KeyObject input Derive the public half from the private-key PEM string instead — runtime-identical (verified: same SPKI, signature verifies) and `string` is still an accepted `createPublicKey` input under @types/node 26. Drops the now-unused `createPrivateKey` import. Verified: full workspace build green; @objectstack/cli and @objectstack/core build clean under @types/node 26. Co-authored-by: Jack Zhuang <zhuangjianguo@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
mainis red —@types/node26 (merged via #2160) tightened the crypto key types soKeyObject(returned bycreatePublicKey) is no longer assignable to the verify-key union:This breaks Build Core / Test Core / TypeScript Type Check / Release on
main, blocking every open framework PR.What
Revert #2160 — pin
@types/nodeback to^25.9.3across the workspace (61 files + lockfile). It's a dev-only dependency, so this is a safe, immediate unblock. Dependabot will re-propose the bump later; the proper fix-forward (broaden@objectstack/core'sverifyPayloadsignature to acceptKeyObjectunder @types/node 26) can land separately.Verified
pnpm install --frozen-lockfile→ clean (lockfile consistent).pnpm --filter @objectstack/cli... build→ green;sign.tscompiles.Unblocks #2174 (and all other open framework PRs).
🤖 Generated with Claude Code