From 2e2cdc405ae9a5b47300e12e6b3124ca47e849aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?P=C3=A9ter=20Ferenc=20Gyarmati?= Date: Fri, 9 Oct 2026 13:17:59 +0200 Subject: [PATCH] chore: reconcile dependency updates with workspace constraints --- development_docs/development.md | 27 +++++++++++++++++++++++++++ pnpm-lock.yaml | 12 ++++++------ pnpm-workspace.yaml | 3 ++- renovate.json | 12 ++++++++++++ 4 files changed, 47 insertions(+), 7 deletions(-) diff --git a/development_docs/development.md b/development_docs/development.md index 38851d95..80c32325 100644 --- a/development_docs/development.md +++ b/development_docs/development.md @@ -78,6 +78,33 @@ package's optional `lz4js` runtime peer is declared as an exception because its import belongs to the Arrow loader workspace. Stale configuration exceptions fail the audit. +## Review dependency updates + +Renovate and pnpm both enforce a 14-day release cooldown. Review the actual +manifest and lockfile changes against the current branch; a bot PR's summary +may include versions that were superseded or could not be installed. Keep +updates whose releases and required dependencies satisfy the cooldown, and +leave newer versions for a later update. Keep compatibility constraints in +`renovate.json` aligned with the workspace overrides. The Babel parser override +stays on version 7 while the Vue 3.5 compiler packages require that major. + +The hosted Renovate bot skips the workspace's `.pnpmfile.mjs` hook. Its generated +lockfile can therefore lose `pnpmfileChecksum`, even when dependency resolution +succeeds. That hook also defines the browser package's published dependency set. +Regenerate the lockfile locally with the declared pnpm version before merging +an update that drops the checksum or changes manifests without a lockfile: + +```bash +pnpm install --no-frozen-lockfile +pnpm install --frozen-lockfile +make check +``` + +Commit `pnpm-lock.yaml` with the accepted manifest changes. When updating pnpm +itself, both `package.json` and the lockfile's package-manager dependency records +must name the new version. An install rejected by `minimumReleaseAge` should +wait for maturity; keep the cooldown and its existing exclusions intact. + ## Change Python producer behavior Stable public records live in `spec.py`, `planning.py`, `prepared.py`, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 3fa06d84..f7894a2b 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -211,8 +211,8 @@ catalogs: specifier: ^1.31.1 version: 1.31.1 knip: - specifier: 6.37.0 - version: 6.37.0 + specifier: 6.38.0 + version: 6.38.0 lz4js: specifier: ^0.2.0 version: 0.2.0 @@ -278,7 +278,7 @@ importers: version: 24.13.6 knip: specifier: 'catalog:' - version: 6.37.0 + version: 6.38.0 node: specifier: runtime:24.21.0 version: runtime:24.21.0 @@ -2435,8 +2435,8 @@ packages: resolution: {integrity: sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw==} engines: {node: '>=0.10.0'} - knip@6.37.0: - resolution: {integrity: sha512-NKCYuoGKJ+o2AuoCuV1mDvfMYnSSWfDXqxwmzxeHyd8fftjNRl8TBUg3fbSrtJjhm7Vj6sc1PX3WZnZhECs9EQ==} + knip@6.38.0: + resolution: {integrity: sha512-umytiMCaZf02MV9SOO1FEDgbDf6h20VZk3ruJE0kh52kkGjYZFRUAXHJWYoLhvhoHGINO/7GXVJmQ2vxTBvl6A==} engines: {node: ^20.19.0 || >=22.12.0} hasBin: true @@ -4910,7 +4910,7 @@ snapshots: kind-of@6.0.3: {} - knip@6.37.0: + knip@6.38.0: dependencies: fdir: 6.5.0(picomatch@4.0.7) formatly: 0.7.1 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 3aa78c11..d1e107c6 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -32,7 +32,7 @@ catalog: vue: ^3.5.43 vitepress-mermaid-renderer: 1.2.2 mermaid: 12.0.0 - knip: 6.37.0 + knip: 6.38.0 picomatch: 4.0.7 yaml: 2.9.1 @@ -51,6 +51,7 @@ minimumReleaseAgeExclude: - vite-plus overrides: + # Vue 3.5 compiler packages require parser 7; revisit with their Babel 8 support. "@babel/parser": 7.29.9 lodash-es: 4.18.1 nanoid: 3.3.19 diff --git a/renovate.json b/renovate.json index 9080e7c8..855edbbe 100644 --- a/renovate.json +++ b/renovate.json @@ -4,6 +4,18 @@ "minimumReleaseAge": "14 days", "internalChecksFilter": "strict", "packageRules": [ + { + "description": "Verify pnpm artifacts with the workspace packing hook before merging npm updates.", + "matchManagers": ["npm"], + "prBodyNotes": [ + "This workspace uses a pnpm packing hook that hosted Renovate skips. If the lockfile drops `pnpmfileChecksum` or artifact generation fails, follow [the dependency update workflow](https://github.com/marimo-team/marimo-export/blob/main/development_docs/development.md#review-dependency-updates): regenerate with `pnpm install --no-frozen-lockfile`, verify `pnpm install --frozen-lockfile`, and run `make check`. Keep the 14-day release cooldown intact." + ] + }, + { + "description": "Keep the parser override within the Babel 7 range required by Vue 3.5 compilers.", + "matchPackageNames": ["@babel/parser"], + "allowedVersions": "<8" + }, { "description": "Match the browser provider to Vitest bundled by Vite+ 1.0.", "matchPackageNames": ["@vitest/browser-playwright"],