Repository navigation
chore(hardcode): sync hardcoded assets and mappings - #766
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Droid finished @0xPabloLI's task —— View job The PR is a lockfile-only bot sync bumping @aave-dao/aave-address-book to 4.73.0; the one candidate finding was independently verified against the gate script (scripts/check-dep-release-age.mjs), the ci.yml job, the package.json manifest, and the live npm registry (4.73.0 published 2026-10-09T10:23:20Z, ~1 hour before this PR), so it is approved: the sync will fail the repo's 7-day dependency release-age gate in CI and needs a re-run after the window closes or a deliberate override. No other issues found in the single-hunk diff, and no existing comments to dedupe against. 1 inline comment posted |
![factory-droid[bot]](https://avatars.githubusercontent.com/in/358017?s=60&v=4){kind=small}
| "version": "4.73.0", | ||
| "resolved": "https://registry.npmjs.org/@aave-dao/aave-address-book/-/aave-address-book-4.73.0.tgz", | ||
| "integrity": "sha512-gam7rxa6HcV6/LsHausIHCkfV8YK3/HQA04kbmNF01wIS3dN/o/6XJlB0K+FCDobiRNOyc8bKh/09Gm2QLLqvA==", |
There was a problem hiding this comment.
[P1] Adopted dependency version violates the 7-day release-age gate and will fail CI
This PR adopts @aave-dao/aave-address-book@4.73.0, which the npm registry shows was published at 2026-10-09T10:23:20Z — under a day before this PR was opened. @aave-dao/aave-address-book is a direct dependency (^4.68.0 in package.json), and the repo's supply-chain policy requires adopted direct dependency versions to be at least MIN_RELEASE_AGE_DAYS = 7 days old (scripts/check-dep-release-age.mjs). Because this PR changes package-lock.json, the CI job "Dependency release-age gate (lockfile PRs only)" (.github/workflows/ci.yml) will diff the lockfile against the base, find the freshly published 4.73.0, and process.exit(1) — blocking this PR. The script's own remediation options are to wait out the age window and re-run the sync, or to pin the previous known-good version (4.72.2, which is the base state and therefore trivially satisfies the gate since the diff becomes empty). If day-zero adoption is genuinely required, the documented override is MIN_RELEASE_AGE_DAYS=0 in the workflow dispatch with the root cause recorded in the PR description.
| "version": "4.73.0", | |
| "resolved": "https://registry.npmjs.org/@aave-dao/aave-address-book/-/aave-address-book-4.73.0.tgz", | |
| "integrity": "sha512-gam7rxa6HcV6/LsHausIHCkfV8YK3/HQA04kbmNF01wIS3dN/o/6XJlB0K+FCDobiRNOyc8bKh/09Gm2QLLqvA==", | |
| "version": "4.72.2", | |
| "resolved": "https://registry.npmjs.org/@aave-dao/aave-address-book/-/aave-address-book-4.72.2.tgz", | |
| "integrity": "sha512-onpRwCBnzGsh5Bcy46pIRgapF5WG+puNu0ZmOE+D4EQ0IV0Ah2TOWLb/Jye/bF6jmvus4XnIPV4lMDK8j1PzRA==", |
This branch was successfully deployed
1 participant
Automated update from
npm run hardcode:sync.Verification:
npm run hardcode:verify