release-prep: don't cut a release for a lockfile-only change - #29
Merged
Conversation
package-lock.json sat in the minor bucket, but npm never publishes it and an installer resolves package.json's ranges itself. An in-range dependency bump changed only what CI builds from, and the train would still have cut a release whose tarball is byte-identical to the last one apart from the version string. The lockfile moves to the skip bucket; package.json stays in minor, since a range change is exactly what does reach consumers.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Same fix as infino-ai/infino-mcp#21, found while reviewing an engine-bump PR there that touched only
package-lock.json— correct dependabot behavior, since^0.5.1already permits 0.5.2 (a caret on a 0.x version means>=0.5.1 <0.6.0), so the manifest range needs no edit.The classifier had
package-lock.jsonin the minor bucket, so an in-range dependency bump would cut a release no consumer can observe: npm never publishes a lockfile, the tarball here isdist/plus README/LICENSE/package.json, and an installer resolves the ranges inpackage.jsonfor itself.package-lock.jsonmoves to the skip bucket.package.jsonstays in minor: a range change is precisely what reaches consumers, and dependabot does edit the manifest when a version lands outside the current range.(Contrast infino-cli, where
Cargo.lockcorrectly stays in minor: cargo-dist compiles the shipped binaries from that lockfile, so there a lock change really does change the artifact.)