chore(release): @theokit/dep-check 0.11.0 - #59
Merged
Merged
Conversation
Cuts the contract-substitution fix (usetheokit/theokit#659) and moves the reusable workflow's default pin onto it. The pin is the deliberate half. `@theokit/dep-check` is pinned to an exact version inside the workflow precisely so a change in what the detector detects is a version bump somebody reviewed, never something that arrives overnight — so publishing alone would change no repository's gate. Bumping the default is what makes the fix reach the twelve callers, and it is a separate decision from making the fix exist. What changes for a caller: a sibling whose version the registry already serves, but with different dependency ranges, is now packed from the workspace instead of resolved from npm. A sibling whose contract is identical is still resolved from npm, which is what keeps check D testing what a consumer resolves.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cuts the contract-substitution fix (usetheokit/theokit#659, merged in #58) and moves the reusable workflow's default pin onto it.
The pin is the deliberate half
@theokit/dep-checkis pinned to an exact version inside the workflow precisely so a change in what the detector detects is a version bump somebody reviewed, never something that arrives overnight. Publishing alone changes no repository's gate; bumping the default is what makes the fix reach the twelve callers, and it is a separate decision from making the fix exist.Both halves are here because the fix is worth nothing to a consumer without the second.
What changes for a caller
A sibling whose version the registry already serves, but with different
dependencies/peerDependencies/optionalDependencies, is now packed from the workspace instead of resolved from npm.A sibling whose contract is identical is still resolved from npm. That is what keeps check D testing what a consumer actually resolves, and it is covered by the pre-existing test that asserts it.
Risk
The change only ADDS substitutions, in a narrow case. The failure mode if the comparison is wrong is a check that tests a local tarball where it could have tested the registry copy — a weaker check, not a false blocker. It cannot newly block a release.
Proved in both directions against the real
usetheokit/theokitcheckout before merge; 109 unit tests pass.