From 2b5d7258da1538efbcbbd92e2d6faa0a87d90daf Mon Sep 17 00:00:00 2001 From: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com> Date: Mon, 20 Jul 2026 20:44:30 +0800 Subject: [PATCH 1/2] chore(create-objectstack): drop deprecated @types/tar devDependency MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit tar v7 ships its own TypeScript declarations, so the standalone @types/tar stub is deprecated and redundant — it only emitted a `WARN deprecated @types/tar@7.0.87` line on every `pnpm install`. `import * as tar from 'tar'` now resolves against tar's bundled types; the package still builds and type-checks clean, and dist/ is byte-identical. devDependency-only, ships nothing (empty changeset — create-objectstack is in the lockstep fixed group and must not drag the stack up a patch for a no-op). Co-Authored-By: Claude Opus 4.8 --- .changeset/drop-deprecated-types-tar.md | 16 ++++++++++++++++ packages/create-objectstack/package.json | 1 - pnpm-lock.yaml | 11 ----------- 3 files changed, 16 insertions(+), 12 deletions(-) create mode 100644 .changeset/drop-deprecated-types-tar.md diff --git a/.changeset/drop-deprecated-types-tar.md b/.changeset/drop-deprecated-types-tar.md new file mode 100644 index 0000000000..28c417bb53 --- /dev/null +++ b/.changeset/drop-deprecated-types-tar.md @@ -0,0 +1,16 @@ +--- +--- + +chore(create-objectstack): drop the deprecated `@types/tar` devDependency + +`tar` v7 ships its own TypeScript declarations (its `types` field points at +`dist/commonjs/index.d.ts`), so the standalone `@types/tar` package is +deprecated and redundant — it only emitted a `WARN deprecated @types/tar` line +on every `pnpm install`. `import * as tar from 'tar'` in `src/index.ts` now +resolves against tar's bundled types, and the package still builds and +type-checks clean. + +devDependency-only change: it is not shipped to consumers and `dist/` is +byte-identical, so this releases nothing (empty changeset, no version bump — +`create-objectstack` is in the lockstep `fixed` group and must not drag the +whole stack up a patch for a no-op). diff --git a/packages/create-objectstack/package.json b/packages/create-objectstack/package.json index f74151d593..2859fcc267 100644 --- a/packages/create-objectstack/package.json +++ b/packages/create-objectstack/package.json @@ -26,7 +26,6 @@ }, "devDependencies": { "@types/node": "^26.1.1", - "@types/tar": "^7.0.87", "tsup": "^8.5.1", "typescript": "^6.0.3", "vitest": "^4.1.10" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index d460ad3aae..f01e1d6f33 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -760,9 +760,6 @@ importers: '@types/node': specifier: ^26.1.1 version: 26.1.1 - '@types/tar': - specifier: ^7.0.87 - version: 7.0.87 tsup: specifier: ^8.5.1 version: 8.5.1(jiti@2.7.0)(postcss@8.5.20)(tsx@4.23.1)(typescript@6.0.3)(yaml@2.9.0) @@ -4465,10 +4462,6 @@ packages: '@types/statuses@2.0.6': resolution: {integrity: sha512-xMAgYwceFhRA2zY+XbEA7mxYbA093wdiW8Vu6gZPGWy9cmOyU9XesH1tNcEWsKFd5Vzrqx5T3D38PWx1FIIXkA==} - '@types/tar@7.0.87': - resolution: {integrity: sha512-3IxNBV8LeY5oi2ZFpvAhOtW1+mHswkzM7BuisVrwJgPv67GBO2rkLPQlEKtzfHuLdhDDczhkCZeT+RuizMay4A==} - deprecated: This is a stub types definition. tar provides its own type definitions, so you do not need this installed. - '@types/trusted-types@2.0.7': resolution: {integrity: sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==} @@ -11173,10 +11166,6 @@ snapshots: '@types/statuses@2.0.6': optional: true - '@types/tar@7.0.87': - dependencies: - tar: 7.5.20 - '@types/trusted-types@2.0.7': {} '@types/unist@2.0.11': {} From 4b3e872bfd82e054528bef385b24b35f2e4e4f43 Mon Sep 17 00:00:00 2001 From: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com> Date: Mon, 20 Jul 2026 22:07:50 +0800 Subject: [PATCH 2/2] fix(ci): pin scaffold-e2e runtime image to the project's resolved cli version MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The "Scaffold with repo dist" job built the runtime base image with a hardcoded `--build-arg OS_CLI_VERSION=latest`. During an RC window this skews protocols and fails the docker boot (pre-existing failure on `main`): ✗ package 'e2e-app' targets protocol ^16 (engines.protocol) but this runtime is protocol 15.0.0. The scaffolder pins `@objectstack/*` to `^` (16.0.0-rc.1), so the generated project's `os build` emits an artifact targeting protocol 16. But the `latest` dist-tag still points at the last STABLE cli (15.1.1, protocol 15), so a base image built from `latest` runs `os start` at protocol 15 and rejects the protocol-16 artifact → container never becomes healthy. Derive OS_CLI_VERSION from the version the generated project actually resolved (`e2e-app/node_modules/@objectstack/cli`) instead of hardcoding `latest`. This keeps the runtime image in lockstep with the artifact's protocol in every case: the repo RC, the `latest` fallback the install step already handles, or a published stable. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/scaffold-e2e.yml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/.github/workflows/scaffold-e2e.yml b/.github/workflows/scaffold-e2e.yml index 257cf81c7f..b83d3e7485 100644 --- a/.github/workflows/scaffold-e2e.yml +++ b/.github/workflows/scaffold-e2e.yml @@ -162,9 +162,23 @@ jobs: # (a) PRs exercise the official runtime Dockerfile itself, and # (b) the e2e stays hermetic — no dependency on a prior release # having published the tag (chicken-and-egg on the very first one). + # + # Pin the runtime's CLI to the SAME version the generated project + # actually resolved to — NOT a hardcoded `latest`. The scaffolded + # artifact is built by that project's `@objectstack/cli` and carries + # its `engines.protocol` major; `os start` in the runtime image rejects + # any artifact from a different protocol major. During an RC window the + # project pins `^` (e.g. 16.0.0-rc.1, protocol 16) while the + # `latest` dist-tag still points at the last STABLE cli (protocol 15), + # so a hardcoded `latest` skews the two and boot fails. Reading the + # resolved version keeps the image in lockstep whether the project got + # the repo RC, the `latest` fallback (see the install step), or a + # published stable. run: | + CLI_VERSION=$(node -p "require('$RUNNER_TEMP/e2e-app/node_modules/@objectstack/cli/package.json').version") + echo "Runtime image will bundle @objectstack/cli@$CLI_VERSION (matches the scaffolded artifact's protocol)" docker build -t ghcr.io/objectstack-ai/objectstack:latest \ - --build-arg OS_CLI_VERSION=latest \ + --build-arg OS_CLI_VERSION="$CLI_VERSION" \ "$GITHUB_WORKSPACE/docker" - name: Docker build and run (scaffolded Dockerfile)