fix(deps): single-source the @orpc family version via pnpm catalog - #375
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (14)
🚧 Files skipped from review as they are similar to previous changes (6)
📝 WalkthroughWalkthroughThe pull request adds a workspace catalog with exact Changes
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
ESLint install failed. For unrecoverable errors, disable the tool in CodeRabbit configuration. Comment |
@orpc/tanstack-query@1.15.0 peer-requires @orpc/client@1.15.0 exactly: the whole @orpc family peer-pins every sibling to the identical version. Our manifests carried caret ranges (^1.14.7), which is unsafe on any fresh install — a fresh resolve can pick tanstack-query@1.15.0 while the rest of the family resolves to 1.14.7, splitting the peer pair. That is exactly what broke the packed nextjs e2e: a tmp-app install pulled @orpc/tanstack-query@1.15.0 against @orpc/client@1.14.7. Single-source the version with a pnpm catalog (pnpm-workspace.yaml) instead of duplicating the exact string across 13 manifests: every "@orpc/*" dependency now reads "catalog:", resolving through the one `catalog.default` entry pinned to 1.14.7. Publish/pack replaces "catalog:" with the concrete version before the tarball is built, so published packages still ship a plain "1.14.7" — verified by packing @conciv/client and inspecting the extracted package.json. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
omridevk
force-pushed
the
fix/pin-orpc-family-exact
branch
from
August 9, 2026 17:11
bd9ba9b to
2cb1dcf
Compare
omridevk
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
Centralizes all @orpc dependencies on exact version 1.14.7 to prevent incompatible peer-version resolution during fresh installs.
Changes:
- Adds a pnpm catalog for the
@orpcfamily. - Migrates 13 consumers to
catalog:. - Updates the lockfile, including unrelated TanStack dependency drift.
Reviewed changes
Copilot reviewed 14 out of 15 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
pnpm-workspace.yaml |
Defines exact @orpc catalog versions. |
pnpm-lock.yaml |
Records catalog resolutions and unrelated upgrades. |
apps/conciv/package.json |
Catalogs @orpc/server. |
packages/cli/package.json |
Catalogs @orpc/client. |
packages/client/package.json |
Catalogs client/query packages. |
packages/contract/package.json |
Catalogs client/contract packages. |
packages/core/package.json |
Catalogs server/client packages. |
packages/embed/package.json |
Catalogs embed’s @orpc dependencies. |
packages/extension-testkit/package.json |
Catalogs testkit’s @orpc family. |
packages/extension/package.json |
Catalogs client/server packages. |
packages/extensions/recorder/package.json |
Catalogs server/query packages. |
packages/extensions/terminal/package.json |
Catalogs client/server packages. |
packages/extensions/test-runner/package.json |
Catalogs @orpc/server. |
packages/extensions/whiteboard/package.json |
Catalogs client/server packages. |
packages/harness-testkit/package.json |
Catalogs client/server packages. |
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| '@tanstack/react-router': | ||
| specifier: latest | ||
| version: 1.170.21(react-dom@19.2.7(react@19.2.7))(react@19.2.7) | ||
| version: 1.170.22(react-dom@19.2.7(react@19.2.7))(react@19.2.7) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mechanism
The
e2e consumer appsjob broke on every fresh run since ~15:00 UTC today, onmainand every PR, inconciv-e2e-nextjspacked-install tests: the packed tmp app'snext devservedGET / 500and the harness timed out.Root cause:
@orpc/tanstack-query@1.15.0(published 2026-08-08 13:52 UTC) peer-requires@orpc/client@1.15.0exactly — the orpc family peer-pins same-version across all its packages. Our manifests declared^1.14.7ranges, so any fresh install (the packed-e2e tmp app, and equally any external consumer of the published@conciv/*packages) resolved a split1.15.0/1.14.7pair and the Next client-component compile failed. The repo lockfile shields only workspace installs.Attribution was verified by controlled experiment: with locally verified-clean dists (d.ts present in every closure package pre-pack), a fresh resolve of 1.15.0 reproduces the CI failure byte-for-byte; pinning makes the identical harness pass. Unrelated to the tsbuildinfo issue fixed by #374, which is local-only (fresh CI checkouts cannot hold stale buildinfo).
Fix
A pnpm
catalog:block inpnpm-workspace.yamlsingle-sources the family version (exact1.14.7); all 13 consuming manifests reference"catalog:".pnpm pack/publish replaces the reference with the concrete version — verified by packing@conciv/clientand inspecting the tgz manifest ("@orpc/client": "1.14.7"). A future orpc upgrade is one line; half-bumping the family is now impossible.Verification
pnpm typecheck:affected92/92,pnpm build:affected59/59, fallow audit pass.e2e consumer appsjob fresh-installs the packed set — green = fix proven (the prior exact-pin revision of this branch already ran it green).Unblocks #374 (its e2e failure is this drift, not the turbo.json change).
🤖 Generated with Claude Code
Summary by CodeRabbit
1.14.7release.