fix: pin internal dependencies to exact versions

Update release synchronization and dependency checks to enforce exact versions. Refresh both lockfiles and add regression coverage.

closes #10865
This commit is contained in:
Armin Ronacher 2026-10-13 14:27:38 +02:00
parent a3a2ee8ec2
commit f13c00fb3a
14 changed files with 129 additions and 50 deletions

View file

@ -2,7 +2,7 @@
/**
* Validates lockstep versions for published packages, then synchronizes
* internal dependency versions in all workspace packages, including private ones.
* exact internal dependency versions in all workspace packages, including private ones.
*/
import { readFileSync, writeFileSync } from "node:fs";
@ -41,7 +41,7 @@ console.log("\nAll non-private packages are at the same version (lockstep).");
let totalUpdates = 0;
const updatedPackages = new Set();
for (const pkg of workspacePackages) {
for (const dependencyType of ["dependencies", "devDependencies"]) {
for (const dependencyType of ["dependencies", "devDependencies", "optionalDependencies"]) {
const dependencies = pkg.data[dependencyType];
if (!dependencies) {
continue;
@ -50,15 +50,14 @@ for (const pkg of workspacePackages) {
for (const [dependencyName, currentSpecifier] of Object.entries(dependencies)) {
// Registry aliases such as `npm:@earendil-works/pi-ai@0.1.2` are never workspace-linked,
// so lockstep bumping them would point at a version that is not published yet.
const version = versionMap.get(dependencyName);
const newSpecifier = version ? `^${version}` : null;
const newSpecifier = versionMap.get(dependencyName);
if (!newSpecifier || currentSpecifier === newSpecifier) {
continue;
}
console.log(`\n${pkg.data.name}:`);
console.log(
` ${dependencyName}: ${currentSpecifier} → ${newSpecifier}${dependencyType === "devDependencies" ? " (devDependencies)" : ""}`,
` ${dependencyName}: ${currentSpecifier} → ${newSpecifier}${dependencyType === "dependencies" ? "" : ` (${dependencyType})`}`,
);
dependencies[dependencyName] = newSpecifier;
updatedPackages.add(pkg);