skatespots/SkateSpots
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions 1

chore(deps): run npm dedupe in the automated job

Browse source 
A minor bump can nest a duplicate transitive copy and break tsc type identity
(@tanstack/query-core, @nostrify/*). Dedupe after npm update before the test gate.
This commit is contained in:
SkateSpots 2026-10-26 11:27:51 +07:00
parent f8ec7e35c0
commit 77b3c23633
2 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
AGENTS.md
View file

@ -2304,6 +2304,8 @@ Rules:
replacing). Lesson: do NOT rely on a blanket `npm update`; update in curated
batches (pin `typescript`, add `overrides`/`npm dedupe` for the duplicated
packages, keep majors as their own migrations) and let the timer gate each.
The job now also runs **`npm dedupe`** after `npm update` (to stop the duplicate
transitive copies that broke type identity).
✅ **Curated batch landed (2026-10-26):** pinned `typescript` **5.8.3 exact**,
updated `vite` **6.4.5**, `vitest` **3.2.7**, `@unhead/react`/`unhead`
**2.1.17**, `yaml` **2.9.1**, then `npm dedupe` — `npm test` green and OSV

5
scripts/update-deps.sh
View file

@ -91,8 +91,11 @@ cp package.json "$STATE_DIR/package.json.bak" 2>/dev/null || true
cp package-lock.json "$STATE_DIR/package-lock.json.bak" 2>/dev/null || true
# ── apply non-breaking updates ──────────────────────────────────────────────
log "applying non-breaking updates (npm update + npm audit fix)…"
log "applying non-breaking updates (npm update + npm dedupe + npm audit fix)…"
npm update 2>&1 | tail -3
# Collapse duplicate transitive copies (e.g. @tanstack/query-core, @nostrify/*).
# Without this a minor bump can nest a second copy and break type identity in tsc.
npm dedupe 2>&1 | tail -2
npm audit fix 2>&1 | tail -3
{
echo; echo "=== post-update npm audit ==="; npm audit 2>&1 || true