Repository navigation
chore(deps): upgrade to @webiny/di 2.0 and @webiny/stdlib 0.0.21 - #5969
Merged
Merged
Conversation
@webiny/di 2.0 builds a singleton from the view of the container that holds its registration, instead of from whichever child container resolved it first. Two root singletons relied on the old behaviour to pick up something registered per request: - CognitoIdentityProvider took its optional CognitoIdpConfig (e.g. Entra ID) from extensions; on 2.0 it would silently get undefined. - SelfHostedJwtIdentityProvider's TokenIssuer reads the signing secret from BuildParams; on 2.0 every authenticated self-hosted request would throw "No registration found for BuildParams". Both hold no state, so both are now registered with inContainerScope(): still in the root, but built per request from the request container. @webiny/stdlib 0.0.21 is the release that moves stdlib to @webiny/di 2.0; with 1.x, its abstractions don't type-check against 2.0 containers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
🚓 Slop Cop ✅ Nothing worth flagging. The diff looks consistent with the PR's stated intent and the code-style rules. Coherent dependency bump PR: version strings updated across 74 package.json files plus yarn.lock, with two deliberate, well-justified inContainerScope() fixes and matching regression tests; nothing suggests accidental content or style violations. Automated, non-blocking heads-up from an LLM. It can be wrong — use your judgment. Regenerates on every push. |
Member
Author
|
/vitest |
|
Vitest tests have been initiated (for more information, click here). ✨
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
⛔ Files ignored due to path filters (1)
📒 Files selected for processing (77)
Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 3 remain after this review. 📝 WalkthroughWalkthroughPackage manifests update ChangesDependency updates and request-container identity providers
Priority: ➖ Normal Estimated code review effort: 2 (Simple) | ~15 minutes Change: Bug fix Suggested reviewers: Merge Risk: ⚪ Minimal · up to This upgrades the dependency injection library and makes the Cognito and self-hosted identity providers resolve configuration from the request container. No concrete merge-blocking risk is evident from the supplied context. The author's reported validation should be confirmed with CI, including the SQL and OpenSearch suites that were not run locally. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This was referenced Oct 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
@webiny/di^1.1.0→^2.0.0in all 74 places it's declared (dependencies and peer dependencies), released in feat!: add inContainerScope and build singletons from the registering container di#19.@webiny/stdlib^0.0.17→^0.0.21in 15 packages. 0.0.21 is the stdlib release that moves it to@webiny/di2.0 (chore(stdlib): depend on @webiny/di 2.0 stdlib#46).inSingletonScope()toinContainerScope(), each with a regression test.Why the two fixes
@webiny/di2.0 builds a singleton from the view of the container that holds its registration. Before, it was built from whichever child container resolved it first. Two root singletons relied on that to get something registered per request:CognitoIdentityProviderCognitoIdpConfig, from extensions such as Entra IDundefined. CustomgetIdentityandverifyTokenClaimsare skipped, and the identity falls back to the Cognitosub.SelfHostedJwtIdentityProviderTokenIssuer→BuildParams(the signing secret)Neither provider holds any state. They only read env vars and build params. So
inContainerScope()costs nothing: they stay registered in the root but are built per request, from the request container.The new tests reproduce both failures on 2.0 with
inSingletonScope()and pass with the fix:packages/cognito/__tests__/cognitoIdpConfig.test.ts;packages/self-hosted-auth/__tests__/selfHostedIdpRequestContainer.test.ts.How I looked for other breaks
I scanned every singleton registered in the root by the AWS (DDB, DDB+OpenSearch) and standalone (SQL) handlers for dependencies that only exist per request. Only these two break.
Why stdlib had to move too
stdlib's abstractions were typed against its own
@webiny/di1.x. TypeScript treats 1.x and 2.xAbstractions as different types, soapi-sync-to-opensearchfailed to build until stdlib moved to 2.0. The lockfile now has a single@webiny/di2.0.0.This also brings in stdlib 0.0.18 to 0.0.20, which Webiny hadn't picked up. 0.0.18 changed several
voidreturns toResult(DirectoryTool.create,FileTool.writeFile, …). The full build passes, so none of Webiny's call sites were affected.Safety for existing projects
Published Webiny packages declare
@webiny/di ^1.1.0and@webiny/stdlib ^0.0.17:^1.1.0never matches 2.x;^0.0.17matches only 0.0.17.So existing projects can't pick up either new version by accident. They get both, together with these two fixes, when they upgrade Webiny.
Tests (local)
cognito14,self-hosted-auth107, DDB handler tests 5.api-core: 267 on DDB and 267 on SQL.api-headless-cms-ddb43,api-headless-cms-sql4.api-headless-cmson DDB: 320 files, 1,041 tests.api-sync-to-opensearch4,api-sync-pg-to-opensearch6.api-headless-cmson SQL: 320 files, 1,041 tests.api-aco: 124 tests.Follow-ups
inContainerScope(), and removeregisterRequestStorage.CognitoApiFeaturealso registersCognitoIdpFeatureper request, on top of the root registration. That's not new, but it may give the authenticator two Cognito providers. Worth a look separately.Workspace: wby-next11 · STORAGE PER REQ
🤖 Generated with Claude Code
Summary by CodeRabbit