Repository navigation
chore(deps): bump appium platform drivers to Appium 3 majors - #162
Closed
julianrojas9920 wants to merge 2 commits into
Closed
julianrojas9920 wants to merge 2 commits into
julianrojas9920 wants to merge 2 commits into
Conversation
uiautomator2-driver ^5->^7, xcuitest-driver ^10->^11, mac2-driver ^3->^4. The pinned ^5/^10/^3 lines pull a stale transitive stack (shell-quote 1.8.3, @appium/support 7.0.2 Zip Slip, xmldom, minimatch, glob, lodash) flagged by Dependabot. These majors align with current Appium 3 releases and pick up upstream security patches. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The version-range bump alone broke the TS build because the newer drivers use @appium/types 1.x (adds maxIpcDataSize/maxIpcTopics on InitialOpts) while the driver pinned @appium/types ^0.x. This aligns the toolchain so `npm run build` compiles clean: - @appium/types ^0.x -> ^1.5.1 (match @appium/base-driver@10) - add @appium/tsconfig devDep (extended by tsconfig but resolved only transitively) - tsconfig: skipLibCheck (avoid type-checking mismatched dep .d.ts) - driver.ts: coalesce sessionId null -> undefined for deleteSession - macOS.ts: cast createSession spread (new base-driver arity) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Author
|
Status update, and closing this out. Bumping the platform-driver ranges to the Appium 3 majors (uiautomator2 ^7, xcuitest ^11, mac2 ^4) turned out to need more than a version bump — it's a port to the new driver APIs, not a dependency change. What I pushed on this branch (compiles now):
What's still needed (why I'm not landing it):
Closing since it can't go in as a small change. Leaving the branch ( |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bump the pinned appium platform-driver ranges to their current Appium 3 majors:
appium-uiautomator2-driver^5.0.0→^7.0.0appium-xcuitest-driver^10.0.0→^11.0.0appium-mac2-driver^3.0.0→^4.0.0Why
The
^5/^10/^3lines resolve to old driver builds whose bundlednpm-shrinkwrap.jsonpins a stale transitive stack that Dependabot flags in downstream projects — notably:@appium/supportZip Slip (<= 7.0.5, critical)shell-quote(critical)@xmldom/xmldom,minimatch,glob,lodash,axios,form-data,path-to-regexp(high)Consumers can't override these away (npm overrides don't penetrate a dependency's shrinkwrap). Bumping the pinned majors here lets the driver ride the current Appium 3 driver releases, which carry the upstream security patches.
Compatibility
Verified runtime-compatible: built the instrumented app and ran a full login E2E (email/OTP/PIN → home) green on Android with
appium-uiautomator2-driver@7.6.2+appium-xcuitest-driver@11.13.0forced into the driver — no API breakage observed at the driver boundary.Note: this only bumps the declared ranges; happy to follow up with a lockfile/CI update if the maintainers prefer.