diff --git a/.github/scripts/verify-packed-npm-install.sh b/.github/scripts/verify-packed-npm-install.sh index 6faa0a2..d389317 100644 --- a/.github/scripts/verify-packed-npm-install.sh +++ b/.github/scripts/verify-packed-npm-install.sh @@ -34,14 +34,12 @@ # because a plain `npm install` here otherwise resolves those siblings straight from public # npmjs, which 404s for as long as a given flex-fields version is GitHub-Packages-only # (workflow_dispatch-only releases in abp-modules skip the tag-triggered step that mirrors to -# public npmjs - see CHANGELOG.md's 10.0.0-rc.16 entry). release.yml passes -# `secrets.PACKAGES_READ_TOKEN` rather than `secrets.GITHUB_TOKEN`, matching the NuGet side and -# GITHUB_TOKEN's documented "own repository only" package scoping; any token that can read -# abp-modules' packages works here. Note this mode runs `npm`, not `yarn`, so it is unaffected -# by the Yarn-Classic alias/auth trap angular/.npmrc documents - npm resolves the alias target's -# own scope. Omit the token and this mode reverts to installing every `@dignite/*` sibling from -# its plain public-npmjs name, unchanged from before this existed - the right behavior again -# once every flex-fields dependency in play is fully public. +# public npmjs - see CHANGELOG.md's 10.0.0-rc.16 entry for the one time that happened). It is +# dormant today and release.yml passes no token: flex-fields is public again, so the packed +# manifest's plain `@dignite/*` names resolve exactly as they say. Reach for it if a flex-fields +# release is ever consumed here before it reaches npmjs. Any token that can read abp-modules' +# packages works - `secrets.GITHUB_TOKEN` does, given the "Manage Actions access" grant those +# packages carry for this repository. # # published # Installs what was actually published to GitHub Packages, after the publish step. Not diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d6eb953..b52ea4c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -39,20 +39,10 @@ jobs: permissions: contents: read - # angular/.npmrc maps the @dignite and @dignite-projects scopes to GitHub Packages and - # references ${PACKAGES_READ_TOKEN} for it. Yarn Classic substitutes every env-var placeholder - # in its resolved config on every invocation and throws when one is unset - including the - # `yarn cache dir` probe setup-node runs for `cache: yarn`, which happens before any run: step - # of this job. So it has to be job-level, not set on the install step - exactly as release.yml - # already does. - # - # @dignite/ng.flex-fields (and its -ckeditor/-file-explorer adapters, and @dignite/ng.file- - # explorer) started resolving through those scopes as of 10.0.0-rc.16 - release.yml's copy of - # this comment carries the full account (why, the alias mechanism, and what to revert once it's - # no longer needed); angular/.npmrc carries the reason BOTH scopes have to be mapped, which is - # the non-obvious half and the one this job actually died on twice. - env: - PACKAGES_READ_TOKEN: ${{ secrets.PACKAGES_READ_TOKEN }} + # No package credential of any kind here: every @dignite/* dependency resolves from public + # npmjs, so `yarn install` below needs no authentication. This job briefly did need one, while + # flex-fields 10.0.0-rc.16 existed only on GitHub Packages; see CHANGELOG.md for that detour and + # why tagging the release in abp-modules was the better answer than carrying the workaround. steps: - name: Checkout site @@ -123,11 +113,11 @@ jobs: # # release.yml used to install with npm here, because Yarn Classic fetched a dependency whose # lockfile entry carried a GitHub Packages "resolved" URL through a code path that never - # attached registry auth. That was fixed and both workflows ran the same yarn command against - # public-npmjs-only @dignite/* packages for a while - but as of 10.0.0-rc.16, @dignite/* - # aliases back onto GitHub Packages (see the job-level env: block's comment above), so this - # repeats the original gotcha's shape if that auth ever regresses. release.yml's step carries - # the longer account. + # attached registry auth. No such entry remains - every @dignite/* package resolves from public + # npmjs - so both workflows run the same yarn command; release.yml's step carries the longer + # account. (10.0.0-rc.16 briefly put a GitHub Packages URL back in the lockfile and reopened + # exactly that wound; CHANGELOG.md has the story and why the fix was to publish the dependency + # publicly rather than to keep authenticating against it here.) # # It matters for the duplicate check below specifically: npm dedupes graphs that Yarn Classic # splits into nested copies, so running that check after an npm install would pass vacuously. @@ -142,12 +132,10 @@ jobs: # # The targets are the libraries whose duplication would silently break DI at runtime, not # "everything installed": - # @dignite-projects - the original case (FLEX_FIELD_TYPES split across two copies), targeted - # under this scope rather than @dignite because angular/package.json aliases - # ng.flex-fields (etc.) to "npm:@dignite-projects/...@" as of rc.16 - # (see the job-level env: block's comment) - the installed manifests' - # "name" field is the real @dignite-projects/* identity regardless of which - # alias imported them, and that identity is what this check matches on. + # @dignite - the original case (FLEX_FIELD_TYPES split across two copies). Note this + # script matches on each installed manifest's own "name" field, so if these + # packages are ever aliased in package.json again, this target has to follow + # the alias TARGET's scope, not the name they are imported under. # @abp - CORE_OPTIONS, ConfigStateService, the environment tokens; every ABP # package in the tree peers on @abp/ng.core and would split with it. # ng-zorro-antd - unscoped, so the old scope-only invocation could not see it at all, and a @@ -173,7 +161,7 @@ jobs: working-directory: site/angular run: | node ../.github/scripts/check-angular-package-duplicates.mjs node_modules \ - @dignite-projects @abp ng-zorro-antd \ + @dignite @abp ng-zorro-antd \ @angular/core @angular/common @angular/forms @angular/router @angular/cdk # No lint step, matching release.yml: `ng lint site` currently fails on ~14 pre-existing diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 85acdd7..8c44952 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -40,35 +40,12 @@ jobs: contents: write # Required by softprops/action-gh-release to create a draft Release packages: write # Required to push pre-release NuGet/npm packages to GitHub Packages - # angular/.npmrc references ${PACKAGES_READ_TOKEN} to authenticate the @dignite-projects scope - # against GitHub Packages. As of 10.0.0-rc.16, angular/package.json aliases @dignite/ng.flex-fields - # (and its -ckeditor/-file-explorer adapters, and @dignite/ng.file-explorer) to - # "npm:@dignite-projects/@" (see the "Install Angular dependencies" step below for - # why), which is what actually routes those four through this scope/token - GitHub Packages' - # npm registry requires the scope to equal the owning org login, so @dignite itself has no - # registry entry there at all. setup-node's `cache: yarn` reads angular/.npmrc (to prime/verify - # the cache) before any later step gets a chance to export the token itself, so it has to be a - # job-level env, not just set on that step. (ci.yml carries the same env: block for the same - # reason; this comment is the one canonical copy of the reasoning - keep them in sync.) - # - # PACKAGES_READ_TOKEN (a PAT scoped to read:packages only), not secrets.GITHUB_TOKEN - the same - # choice "Verify packed NuGet packages restore cleanly" below already made, for the same - # documented reason: GITHUB_TOKEN's package access is scoped to the workflow's own repository, - # and these packages are published by a different one (abp-modules). Whether GITHUB_TOKEN would - # in fact be refused here has never been isolated - the CI 401s that led to this token were a - # different bug entirely (yarn was sending no token at all; see angular/.npmrc's own comment) - - # so this is the documented-behavior choice plus the NuGet side's precedent, not a measurement. - # If someone wants the ephemeral token back, that experiment is one commit and one CI run. - # - # To revert once abp-modules tags a release that mirrors flex-fields (rc.16 or a successor) to - # public npmjs again: drop the four npm: aliases in angular/package.json's dependencies and - # resolutions blocks back to plain semver ranges; change check-angular-package-duplicates.mjs's - # target list in both this file and ci.yml from @dignite-projects back to @dignite. Leave - # PACKAGES_READ_TOKEN itself and angular/.npmrc's @dignite-projects mapping in place either way - - # they're what "Verify packed NuGet packages restore cleanly" already depends on permanently, and - # cost nothing unused. - env: - PACKAGES_READ_TOKEN: ${{ secrets.PACKAGES_READ_TOKEN }} + # No job-level package credential: every @dignite/* dependency resolves from public npmjs, so + # the install below authenticates against nothing. The steps that genuinely need a token supply + # their own - "Verify packed NuGet packages restore cleanly" (PACKAGES_READ_TOKEN, for + # abp-modules' NuGet feed) and the two publish steps (GITHUB_TOKEN, for this repo's own + # packages). 10.0.0-rc.16 briefly required more than that, while it existed only on GitHub + # Packages; see CHANGELOG.md. steps: - name: Checkout site @@ -240,19 +217,14 @@ jobs: cache: yarn cache-dependency-path: site/angular/yarn.lock - # angular/.npmrc maps the @dignite-projects scope to GitHub Packages; ${GITHUB_TOKEN} in that - # file is a literal env-var placeholder npm/yarn substitute at read time, so it has to be - # present in the environment here (it is, job-level - see the env: block above). - # # Yarn with the committed lockfile, matching ci.yml and every developer machine. This step # used to be `npm install --no-package-lock` because Yarn Classic fetches a dependency whose # lockfile entry carries a GitHub Packages "resolved" URL through a code path that never - # attaches registry auth. That was fixed, and for a while every @dignite/* package resolved - # from public npmjs instead - but as of 10.0.0-rc.16, @dignite/* aliases back onto GitHub - # Packages (see the job-level env: block's comment), so this step is exercising that auth - # path again. --legacy-peer-deps is gone with npm: Yarn Classic does not enforce peer ranges, - # which is what that flag was working around (@swimlane/ngx-datatable@22 wants - # @angular/common 18-20.x, workspace is on 21.2.x). + # attaches registry auth. No such entry remains - every @dignite/* package resolves from public + # npmjs - so the release can be built from the tree the lockfile actually describes rather than + # from a fresh resolution that ignores it. --legacy-peer-deps is gone with npm: Yarn Classic + # does not enforce peer ranges, which is what that flag was working around + # (@swimlane/ngx-datatable@22 wants @angular/common 18-20.x, workspace is on 21.2.x). # # It also matters for the duplicate check below: npm dedupes graphs that Yarn Classic splits # into nested copies, so that check after an npm install would pass vacuously. @@ -271,7 +243,7 @@ jobs: working-directory: site/angular run: | node ../.github/scripts/check-angular-package-duplicates.mjs node_modules \ - @dignite-projects @abp ng-zorro-antd \ + @dignite @abp ng-zorro-antd \ @angular/core @angular/common @angular/forms @angular/router @angular/cdk # No lint step here: `ng lint site` currently fails on ~14 pre-existing violations (component @@ -335,15 +307,13 @@ jobs: # publishing" as well, so the plain npm install it runs is not subject to the # ${NODE_AUTH_TOKEN} placeholder that step writes into $NPM_CONFIG_USERCONFIG. # - # The trailing token argument is what lets this resolve @dignite/ng.flex-fields (etc.) while - # flex-fields stays GitHub-Packages-only, per the script's own header comment - without it, - # this step 404s the moment angular/projects/site/package.json names a flex-fields version - # that has no public-npmjs entry, which is exactly the gap 10.0.0-rc.16 exposed. It uses - # PACKAGES_READ_TOKEN rather than secrets.GITHUB_TOKEN for the reason the job-level env: - # block's comment gives (this is npm, not yarn, so the .npmrc scope-mapping trap that comment - # also mentions does not apply here - npm honors the alias target's own scope). + # No token argument: the packed manifest names its @dignite/* siblings by their public npmjs + # names, which is exactly where they resolve from. The script accepts an optional one for the + # case where they do not - see its header - which is what 10.0.0-rc.16 briefly needed while it + # was GitHub-Packages-only. That path is dormant, not dead: it is the thing to reach for if a + # flex-fields release is ever consumed before it reaches npmjs again. - name: Verify packed npm package installs and bundles cleanly - run: bash .github/scripts/verify-packed-npm-install.sh packed artifacts/npm/site '${{ secrets.PACKAGES_READ_TOKEN }}' + run: bash .github/scripts/verify-packed-npm-install.sh packed artifacts/npm/site # registry-url lives here rather than on the earlier Setup Node.js step - see that step's # comment for why no yarn command may run after it. It still has to run *before* the two @@ -435,13 +405,16 @@ jobs: # the gate's job now); what it still catches is a broken rename, and a registry that did not # end up serving what was pushed to it. # - # PACKAGES_READ_TOKEN, not secrets.GITHUB_TOKEN: @dignite-projects/ng.site itself is this - # repo's own package (GITHUB_TOKEN could read that much), but its rewritten dependencies now - # point at @dignite-projects/ng.flex-fields (etc.) from abp-modules - a different repository, - # which GITHUB_TOKEN cannot read regardless. See the job-level env: block's comment. + # Needs a credential for two different repositories' packages at once: @dignite-projects/ng.site + # is this repo's own, while the publish step above rewrote its @dignite/* dependencies into + # @dignite-projects/* aliases, which are abp-modules'. secrets.GITHUB_TOKEN covers both, and + # demonstrably does - 0.1.0-preview.11 passed this step that way, against flex-fields packages + # published by abp-modules - because dignite-projects/site is listed under those packages' + # "Manage Actions access". Worth knowing, because GITHUB_TOKEN's package access is otherwise + # documented as scoped to the workflow's own repository; that grant is what widens it. - name: Verify published npm package installs and bundles cleanly if: steps.channel.outputs.channel == 'preview' - run: bash .github/scripts/verify-packed-npm-install.sh published '${{ steps.channel.outputs.version }}' '${{ secrets.PACKAGES_READ_TOKEN }}' + run: bash .github/scripts/verify-packed-npm-install.sh published '${{ steps.channel.outputs.version }}' '${{ secrets.GITHUB_TOKEN }}' # Stable builds go to the public npmjs, under the real @dignite/ng.site name. Same # skip-when-not-configured pattern as the NuGet.org push above. diff --git a/CHANGELOG.md b/CHANGELOG.md index 3c0edde..7f4967a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,68 +14,49 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 (Host dev app) and `angular/projects/site/package.json` (published library), picking up flex-fields' new built-in `Matrix`/`Table` field types. - Unlike every previous bump, rc.16 was published in abp-modules only via `workflow_dispatch` (no - tag), so it landed on GitHub Packages under the `@dignite-projects` org scope only - the - tag-triggered step that mirrors a release to public npmjs under the real `@dignite/*` scope never - ran. GitHub Packages' npm registry requires the scope to equal the owning org login, so - `@dignite/ng.flex-fields` has no registry entry there at all; the packages exist only as - `@dignite-projects/ng.flex-fields` etc. - - `angular/package.json`'s four entries (both `dependencies` and `resolutions`) now alias to - `npm:@dignite-projects/@` - the same rewrite `release.yml`'s "Publish pre-release - Angular package to GitHub Packages" step already applies to `@dignite/ng.site`'s own dependencies - at publish time - so `angular/.npmrc`'s existing `@dignite-projects:registry=...` mapping resolves - it. `angular/projects/site/package.json` keeps the plain, unaliased `@dignite/ng.flex-fields` - names: that manifest describes what a real downstream consumer needs, and either the publish-time - rewrite or (once flex-fields is public again) nothing at all is what bridges the gap - aliasing it - there would be wrong the moment the dependency is public again. - - `check-angular-package-duplicates.mjs`'s target list in both `ci.yml` and `release.yml` changed - from `@dignite` to `@dignite-projects`: the script matches each installed package's own manifest - `"name"` field, and every alias now on disk carries the real `@dignite-projects/*` identity - regardless of which name imported it - `@dignite` currently matches nothing installed, which the - script correctly treats as a hard failure rather than a vacuous pass. - - **`angular/.npmrc` maps the `@dignite` scope to GitHub Packages as well as `@dignite-projects`, - and that second line is what makes CI work at all.** Yarn Classic decides whether to attach a - registry's auth token to a *tarball* download by looking up the registry for the scope of the name - it knows the package by - and for an aliased package that is the **alias's** scope (`@dignite`), - not the target's (`@dignite-projects`). With only the target scope mapped, yarn fell back to the - default registry, saw that the tarball's host didn't match it, sent no credential at all, and - GitHub answered `401 Unauthorized`. It reproduces only on a cold yarn cache - a warm cache never - downloads the tarball and so never takes that code path - which is exactly why every local - `yarn install` passed while two consecutive CI runs failed. This is the same class of Yarn Classic - bug `release.yml`'s "Install Angular dependencies" comment has described since the last time a - GitHub Packages URL sat in `yarn.lock`; the alias is a new way into it. - - Along the way the same npm auth now uses `PACKAGES_READ_TOKEN` (the PAT-scoped-to-`read:packages` - secret `release.yml`'s "Verify packed NuGet packages restore cleanly" already used) instead of - `secrets.GITHUB_TOKEN`, matching the NuGet side and `GITHUB_TOKEN`'s documented "the workflow - repository only" package scoping. Note this was **not** what the 401s were about, and whether - `GITHUB_TOKEN` alone would have sufficed once the scope mapping was fixed was never isolated - - the token swap rides on documented behaviour and the NuGet precedent, not on a measurement. - `ci.yml`'s briefly-added `packages: read` permission is gone again, and no "Manage Actions access" - grant turned out to be required either. - - **`release.yml`'s "Verify packed npm package installs and bundles cleanly" (`packed` mode) step - would otherwise have failed on the next actual release attempt** - a real, verified break, not a - hypothetical one: it installs the *raw* packed `dist/site/package.json`, which still names its - siblings by their plain `@dignite/*` names and range (the alias rewrite only happens later, at the - GitHub Packages publish step), and the release's NuGet packages are already pushed live by the time - this step runs (`release.yml`'s "Push to GitHub Packages (pre-release)"/"Push to NuGet.org (stable)" - precede it), so the failure would have left a release half-published rather than merely failing - cleanly. Fixed by teaching `verify-packed-npm-install.sh`'s `packed` mode an optional third - `` argument: when given, it reads every `@dignite/*` range the packed tarball - itself declares (plus `@dignite/ng.file-explorer`'s, inferred from `@dignite/ng.flex-fields`'s own - range, since it never appears as a direct dependency of `@dignite/ng.site`) and points them at their - `npm:@dignite-projects/@` aliases via npm's `overrides` field - reading the range fresh - from the tarball rather than hardcoding it, so this keeps working across future flex-fields bumps - without a matching edit here. Its pre-existing `published` mode needed the identical fix, for the - identical reason, and had simply never been exercised against a GitHub-Packages-only flex-fields - version before now: `@dignite-projects/ng.site` is this repo's own package, but its rewritten - dependencies point at abp-modules'. `release.yml`'s two invocations now both pass - `secrets.PACKAGES_READ_TOKEN`. Verified against a real packed tarball with a personal PAT: fails - with the original `ETARGET` error without a token, installs and bundles cleanly with one. + Nothing else was needed for this: the packages resolve from public npmjs exactly as every prior + bump did. Getting there took a detour worth recording, though, because the conclusion was to change + the *dependency's* release rather than this repository. + + rc.16 was first published in abp-modules via `workflow_dispatch` only. That workflow mirrors a + release to public npmjs only on a tag push, so rc.16 existed solely on GitHub Packages - and there + under `@dignite-projects/*`, since GitHub Packages' npm registry requires the scope to equal the + owning org login. Consuming it from here meant aliasing all four packages to + `npm:@dignite-projects/@`, mapping that scope in `angular/.npmrc`, authenticating both + workflows against it, and repointing `check-angular-package-duplicates.mjs` at the alias target's + scope. All of that landed, and all of it is now reverted: pushing a `v10.0.0-rc.16` tag in + abp-modules put the packages on npmjs, which removed the reason for any of it. The deciding + argument was not effort but blast radius - a private-only dependency means every contributor needs + a `read:packages` credential just to `yarn install`, and CI on a fork PR cannot have one at all, + since GitHub does not pass secrets to fork-triggered runs. + + Two findings from the detour are worth keeping. + + **Yarn Classic will silently send no credential for an aliased package.** It picks the registry - + and hence the auth token - for a *tarball* download by the scope of the name it knows the package + by, which for an `npm:` alias is the **alias's** scope, not the target's. With only the target + scope mapped, yarn fell back to the default registry, found the tarball's host didn't match, sent + nothing, and GitHub answered `401 Unauthorized`. It reproduces only on a **cold** yarn cache - a + warm one never downloads the tarball and never reaches that code path - so every local + `yarn install` passed while two consecutive CI runs failed. The tell is in yarn's own output: + `Resolving packages` succeeding and `Fetching packages` 401ing means auth works for metadata and + the problem is the tarball path, i.e. not the credential. + + **A `${VAR}` placeholder in a committed `.npmrc` is a trap.** While a credential was needed it was + briefly written that way, which made *every* yarn invocation in `angular/` fail with + `Failed to replace env in config` whenever the variable was unset - including `yarn start`, + `yarn build` and `yarn test`, none of which touch a registry. Credentials belong in the user-level + `~/.npmrc`; the committed file names none. + + Along the way `release.yml`'s "Verify packed npm package installs and bundles cleanly" (`packed` + mode) turned out to be genuinely fragile: it installs the *raw* packed `dist/site/package.json`, so + it 404s on any flex-fields version not yet on npmjs - and it runs *after* the NuGet packages are + pushed live, so that failure would leave a release half-published rather than merely failing. + `verify-packed-npm-install.sh`'s `packed` mode now takes an optional token and, given one, + redirects every `@dignite/*` dependency the tarball declares through its `@dignite-projects` alias + via npm `overrides`, reading each range fresh from the tarball rather than hardcoding it. Nothing + passes that token today; it is there for the next time a dependency is consumed before it reaches + npmjs. Verified against a real packed tarball, with and without. ### Removed diff --git a/angular/.npmrc b/angular/.npmrc index e0916ae..c68e0bc 100644 --- a/angular/.npmrc +++ b/angular/.npmrc @@ -1,17 +1,10 @@ -# @dignite-projects is where the packages actually live on GitHub Packages (its npm registry -# requires the scope to equal the owning org login). +# Only needed by release.yml, which publishes this workspace's own library to GitHub Packages under +# @dignite-projects/ng.site for the pre-release channel (GitHub Packages' npm registry requires the +# scope to equal the owning org login, so the public @dignite/ng.site name cannot be used there). +# That step supplies its own credential; nothing here needs one, and no token belongs in a committed +# .npmrc anyway - a ${VAR} placeholder makes every yarn command in this directory fail outright when +# the variable is unset, including ones that never touch a registry. +# +# Ordinary `yarn install` needs no authentication at all: every @dignite/* dependency resolves from +# public npmjs. @dignite-projects:registry=https://npm.pkg.github.com - -# @dignite is mapped too, and it is not redundant: angular/package.json aliases these packages as -# "@dignite/ng.flex-fields": "npm:@dignite-projects/ng.flex-fields@", and Yarn Classic picks -# the registry - and therefore the auth token - for a tarball download by the scope of the name it -# knows the package by, which for an aliased package is the ALIAS's scope (@dignite), not the -# target's. Without this line yarn falls back to the default registry, sees that the tarball's host -# doesn't match it, sends no token at all, and GitHub answers 401 - on a cold cache only, which is -# what makes it a CI-only failure that a warm local yarn cache hides completely. (Metadata requests -# still go to @dignite-projects via the alias, so this line never makes yarn ask GitHub Packages for -# a package under the @dignite scope, which would 404.) -@dignite:registry=https://npm.pkg.github.com - -//npm.pkg.github.com/:_authToken=${PACKAGES_READ_TOKEN} -//npm.pkg.github.com/:always-auth=true diff --git a/angular/package.json b/angular/package.json index d83f2d4..f5e1377 100644 --- a/angular/package.json +++ b/angular/package.json @@ -28,10 +28,10 @@ "@abp/ng.feature-management": "~10.5.0", "@abp/ng.theme.lepton-x": "~5.5.0", "@volo/abp.commercial.ng.ui": "~10.5.0", - "@dignite/ng.flex-fields": "npm:@dignite-projects/ng.flex-fields@^10.0.0-rc.16", - "@dignite/ng.flex-fields-ckeditor": "npm:@dignite-projects/ng.flex-fields-ckeditor@^10.0.0-rc.16", - "@dignite/ng.flex-fields-file-explorer": "npm:@dignite-projects/ng.flex-fields-file-explorer@^10.0.0-rc.16", - "@dignite/ng.file-explorer": "npm:@dignite-projects/ng.file-explorer@^10.0.0-rc.16", + "@dignite/ng.flex-fields": "^10.0.0-rc.16", + "@dignite/ng.flex-fields-ckeditor": "^10.0.0-rc.16", + "@dignite/ng.flex-fields-file-explorer": "^10.0.0-rc.16", + "@dignite/ng.file-explorer": "^10.0.0-rc.16", "@ckeditor/ckeditor5-angular": "^11.2.0", "ckeditor5": "^48.0.0", "marked": "^18.0.0", @@ -54,8 +54,8 @@ "zone.js": "~0.15.0" }, "resolutions": { - "@dignite/ng.flex-fields": "npm:@dignite-projects/ng.flex-fields@10.0.0-rc.16", - "@dignite/ng.file-explorer": "npm:@dignite-projects/ng.file-explorer@10.0.0-rc.16" + "@dignite/ng.flex-fields": "10.0.0-rc.16", + "@dignite/ng.file-explorer": "10.0.0-rc.16" }, "devDependencies": { "@abp/ng.schematics": "~10.5.0", diff --git a/angular/yarn.lock b/angular/yarn.lock index 6091009..e13aad1 100644 --- a/angular/yarn.lock +++ b/angular/yarn.lock @@ -2277,18 +2277,18 @@ resolved "https://registry.yarnpkg.com/@ctrl/tinycolor/-/tinycolor-4.2.0.tgz#ba5d0b917303c0b3d3c14c4865cdc6ded25ac05f" integrity sha512-kzyuwOAQnXJNLS9PSyrk0CWk35nWJW/zl/6KvnTBMFK65gm7U1/Z5BqjxeapjZCIhQcM/DsrEmcbRwDyXyXK4A== -"@dignite/ng.file-explorer@^10.0.0-rc.16", "@dignite/ng.file-explorer@npm:@dignite-projects/ng.file-explorer@10.0.0-rc.16", "@dignite/ng.file-explorer@npm:@dignite-projects/ng.file-explorer@^10.0.0-rc.16": +"@dignite/ng.file-explorer@10.0.0-rc.16", "@dignite/ng.file-explorer@^10.0.0-rc.16": version "10.0.0-rc.16" - resolved "https://npm.pkg.github.com/download/@dignite-projects/ng.file-explorer/10.0.0-rc.16/a35232dea2c6faed5aad17e0fcb1c8b1de3e6eef#a35232dea2c6faed5aad17e0fcb1c8b1de3e6eef" - integrity sha512-RcWuPROHc6qIMXhX1mbatTI5d11zBWm79NujO8Hi5nnzqkHRRAD/C/hNtdOfb754xt3LYT0Gv0s1Il9mbV984g== + resolved "https://registry.yarnpkg.com/@dignite/ng.file-explorer/-/ng.file-explorer-10.0.0-rc.16.tgz#839bb3fa231fb5e625b8997f6ea78a2aa37d7cac" + integrity sha512-S8o1mNb3tNa+RLejSsMxAmXHCd+fUHJsajbSeMnCuhBn2J/lRo9rjVwk+0kwzAbmaK+Y0JysO4ywyESr2Nv3xw== dependencies: "@abp/ng.components" "~10.5.0" tslib "^2.0.0" -"@dignite/ng.flex-fields-ckeditor@npm:@dignite-projects/ng.flex-fields-ckeditor@^10.0.0-rc.16": +"@dignite/ng.flex-fields-ckeditor@^10.0.0-rc.16": version "10.0.0-rc.16" - resolved "https://npm.pkg.github.com/download/@dignite-projects/ng.flex-fields-ckeditor/10.0.0-rc.16/8265aaa1fbde7b6cadc941cb215ed02371a2dd4b#8265aaa1fbde7b6cadc941cb215ed02371a2dd4b" - integrity sha512-T2L+dhsyptJolVwhsUVu1KeB44JtFbonN/wwp8qifF+dzb7/cXlPC4RnhDRUeE72tIgAyAfoTg9MjRePhXH8fw== + resolved "https://registry.yarnpkg.com/@dignite/ng.flex-fields-ckeditor/-/ng.flex-fields-ckeditor-10.0.0-rc.16.tgz#4b737342f164e6143639763bf10706a7ba365b3d" + integrity sha512-MBtVBXpLWNFj/lDCFVNhvVryyowKI7mas6ghhLAL4/d0fDPzvoBTLaqDjh7qWNjpqevL1HCGsB1gm3hDYE7T6g== dependencies: "@ckeditor/ckeditor5-angular" "^11.2.0" "@ckeditor/ckeditor5-integrations-common" "^2.4.0" @@ -2297,19 +2297,19 @@ marked "^18.0.0" tslib "^2.0.0" -"@dignite/ng.flex-fields-file-explorer@npm:@dignite-projects/ng.flex-fields-file-explorer@^10.0.0-rc.16": +"@dignite/ng.flex-fields-file-explorer@^10.0.0-rc.16": version "10.0.0-rc.16" - resolved "https://npm.pkg.github.com/download/@dignite-projects/ng.flex-fields-file-explorer/10.0.0-rc.16/0420525b7560eec22238a030ffc0b69f69c360f0#0420525b7560eec22238a030ffc0b69f69c360f0" - integrity sha512-id14OEIRjAUCqq4IzDUtLW0xQRrjmRiWHdNFV14m4+jmwmFMs+lwDjqMwofmz85EhQO9Uv6u+XXIdVSEuzz5Cw== + resolved "https://registry.yarnpkg.com/@dignite/ng.flex-fields-file-explorer/-/ng.flex-fields-file-explorer-10.0.0-rc.16.tgz#f77de240690c27930bfe4e500e40a01438f0a7dd" + integrity sha512-kzXNK0EhEmKjjHjpdJPrv7K3f8f/XviukgPaeGYx0kvRW/wWyCwRZ8o5hvbyxjZtARYDQQLGX+IHRYfTpUyFww== dependencies: "@dignite/ng.file-explorer" "^10.0.0-rc.16" "@dignite/ng.flex-fields" "^10.0.0-rc.16" tslib "^2.0.0" -"@dignite/ng.flex-fields@^10.0.0-rc.16", "@dignite/ng.flex-fields@npm:@dignite-projects/ng.flex-fields@10.0.0-rc.16", "@dignite/ng.flex-fields@npm:@dignite-projects/ng.flex-fields@^10.0.0-rc.16": +"@dignite/ng.flex-fields@10.0.0-rc.16", "@dignite/ng.flex-fields@^10.0.0-rc.16": version "10.0.0-rc.16" - resolved "https://npm.pkg.github.com/download/@dignite-projects/ng.flex-fields/10.0.0-rc.16/c4796de06fcd3ed585897afcdb04d69b838fb87b#c4796de06fcd3ed585897afcdb04d69b838fb87b" - integrity sha512-komP6TWK0+xegNB3RkiK+pBwGnJwarRt9IhpEhah5vRDLQRhrwyZ+uKj/5Jl2wpZCwOMoWJtU8VoLTJ69j7MCw== + resolved "https://registry.yarnpkg.com/@dignite/ng.flex-fields/-/ng.flex-fields-10.0.0-rc.16.tgz#f5d2df96597ab9d2fdd45a5f479be3a48a18ff88" + integrity sha512-uF7QhVJ9K87rNdhgQpCW3CtosOUnG64y8MHwiXi+us4z/6Isuyltlh7mvxn4FtBYwTErVYNhNAj3vjQbzfl0Lw== dependencies: "@abp/ng.components" "~10.5.0" tslib "^2.0.0"