Repository navigation
Fix webpack duplication and react-aria catalog minimums, add minimumReleaseAge - #8464
Conversation
- @plone/razzle-dev-utils: resolve webpack from the catalog via a devDependency, so the monorepo installs a single webpack (5.105.4) again instead of also pulling 5.112.0 through the ~5 peer range - catalog.json: raise the react-aria family minimums to the versions that are locked and tested - pnpm-workspace.yaml: add minimumReleaseAge (3 days)
|
@davisagli @wesleybl can we be more careful when dealing with this kind of PRs? Updating blindly to next versions all the deps could be a mess. eg RAC. If you do not update RAC properly, you might endup with two RAC versions in the same build. And this is bad. The present tests do not test that (maybe it might). When I update VLT to this, it will break. In 19 it could break too, because we already use them in several places. You also forget that we are using the catalog.json to pin versions across the build... You need to update them. Otherwise other projects that have their own lock won't pick this. (eg. VLT) Anyways, I only wanted to point that out. |
|
@sneridagh Sorry about that. But I really don't know how to review these PRs that re-lock everything. It's an enormous diff and I won't notice what's significant if I try to read through. So I rely on the tests. How did you notice there was a problem in this case? I don't think we can simply not update our dependencies -- this resolved a lot of open security alerts. So probably we need to improve our tests. How about a check to make sure we don't have package versions in pnpm-lock.yaml that are incompatible with the catalog? Or a check that we don't have multiple versions of packages listed in peerDependencies? |
|
@davisagli no worries, the problem is with the integration in project mode. Maybe we can come up with a CI test (cookieplone) that makes sure that it works well with a project with RAC dependencies (which is the one that we detected that is conflictive...) I will take a look. |
|
@sneridagh Sorry about that. Next time, I’ll check the catalog. I think we should update the versions to remove those with vulnerabilities. Having an automated check in place would be great. |
|
@sneridagh And what about Volto 18, where we don’t have a catalog? Would the maintainer themselves have to resolve these issues? I think we should update the versions in Volto 18 as well. |
|
@davisagli @sneridagh I created an automated script in: #8469 |
…sschemaendpoint * origin/blocksschemaendpoint: (32 commits) Fix webpack duplication and react-aria catalog minimums, add minimumReleaseAge (#8464) Restore pnpm store cache fallback and fix volto-razzle CI job (#8463) Update packages in pnpm-lock.yaml (#8461) Fix invisible keyboard focus on single react-select widgets (#8457) Use pnpm/action-setup and setup-node pnpm cache in CI (#8459) Don't show the parent's tags and related items below the add form. (#8453) Fix adding a field with the default type in the schema editor (#8454) Pick the SSR locale only from supportedLanguages (#8448) (#8449) Fixed link redirects from `thevalleyofcode.com` to `flaviocopes.com` (#8451) Fix release-it from babel-preset-razzle Release 19.5.0 Release @plone/volto-slate 19.1.0 Release @plone/razzle 1.0.2 Release @plone/razzle-dev-utils 1.0.1 Release @plone/scripts 4.0.2 Release @plone/babel-preset-razzle 1.0.2 Release @plone/registry 3.0.3 Release @plone/components 4.2.2 Release @plone/types 2.1.0 Fix diff of text block word by word (#8429) ...
3 participants
Follow-up to #8461, which regenerated
pnpm-lock.yamlwithout changing anypackage.json. All updated versions stay within their declared ranges, but the refresh exposed some drift.catalog.jsonpinswebpackto5.105.4, but@plone/razzle-dev-utilsonly declares it as a~5peer. After the refresh, pnpm resolved that peer to5.112.0, so the monorepo installed two webpack versions, and thewebpack-dev-serverandreact-dev-utilsused by razzle-dev-utils were linked against the newer one. This adds awebpack: catalog:devDependency, so the workspace resolves the peer to the pinned version. The published peer range stays~5, so consumers aren't affected.catalog.jsonstill hadreact-aria-components ^1.17.0,react-aria ^3.48.0,react-stately ^3.46.0, and so on, while the lock and CI use1.22.1,3.53.1and3.51.0.react-aria-componentspinsreact-ariaandreact-statelyto exact versions, so loose minimums in the published@plone/componentsand@plone/voltocan leave consumers with two copies ofreact-aria. The minimums forreact-aria-components,react-aria,react-stately,@react-aria/utils,@react-spectrum/utilsand@internationalized/dateare now the locked versions. The resolved versions don't change.minimumReleaseAge: 4320inpnpm-workspace.yaml. pnpm will only resolve versions that have been published for at least 3 days. Update packages in pnpm-lock.yaml #8461 locked 39 versions that were less than 3.5 days old (webpack 5.112.0, rollup 4.64.7 and its native bindings, undici, joi, …).The lockfile diff only changes the catalog specifiers and removes
webpack@5.112.0(andminimizer-webpack-plugin, which only that version needed). No other resolved versions change. The@plone/razzleand@plone/componentsunit tests pass locally.