From 77b3c23633ed8ed9a2aa2f1c285f67e0376584f8 Mon Sep 17 00:00:00 2001 From: SkateSpots Date: Mon, 26 Oct 2026 11:27:51 +0700 Subject: [PATCH] chore(deps): run npm dedupe in the automated job A minor bump can nest a duplicate transitive copy and break tsc type identity (@tanstack/query-core, @nostrify/*). Dedupe after npm update before the test gate. --- AGENTS.md | 2 ++ scripts/update-deps.sh | 5 ++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index 4c13577..256e0c2 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -2304,6 +2304,8 @@ Rules: replacing). Lesson: do NOT rely on a blanket `npm update`; update in curated batches (pin `typescript`, add `overrides`/`npm dedupe` for the duplicated packages, keep majors as their own migrations) and let the timer gate each. + The job now also runs **`npm dedupe`** after `npm update` (to stop the duplicate + transitive copies that broke type identity). ✅ **Curated batch landed (2026-10-26):** pinned `typescript` **5.8.3 exact**, updated `vite` **6.4.5**, `vitest` **3.2.7**, `@unhead/react`/`unhead` **2.1.17**, `yaml` **2.9.1**, then `npm dedupe` — `npm test` green and OSV diff --git a/scripts/update-deps.sh b/scripts/update-deps.sh index 7ecd10f..c44e76d 100755 --- a/scripts/update-deps.sh +++ b/scripts/update-deps.sh @@ -91,8 +91,11 @@ cp package.json "$STATE_DIR/package.json.bak" 2>/dev/null || true cp package-lock.json "$STATE_DIR/package-lock.json.bak" 2>/dev/null || true # ── apply non-breaking updates ────────────────────────────────────────────── -log "applying non-breaking updates (npm update + npm audit fix)…" +log "applying non-breaking updates (npm update + npm dedupe + npm audit fix)…" npm update 2>&1 | tail -3 +# Collapse duplicate transitive copies (e.g. @tanstack/query-core, @nostrify/*). +# Without this a minor bump can nest a second copy and break type identity in tsc. +npm dedupe 2>&1 | tail -2 npm audit fix 2>&1 | tail -3 { echo; echo "=== post-update npm audit ==="; npm audit 2>&1 || true