chore(deps): update from pgsql-parser + dev-utils, trust benjie so graphile can resolve - #1668
Merged
Merged
Conversation
…k skips the wait Every re-resolution failed with ERR_PNPM_NO_MATURE_MATCHING_VERSION: the graphile v5 stack is pinned to exact versions published inside the two-week window, and no older release satisfies an exact pin. Exempting the account that publishes the whole family survives the next upgrade, unlike a version-by-version waiver. The inventory moves in-repo because the shared @constructive-io/pnpm-policy export is built from pyramation alone. Waivers remain for toolchain floors (@typescript-eslint, @types/*, @playwright/test, minimatch, @0no-co/graphql.web) whose floor is the newest release, each expiring the day that version turns 14d.
makage update-deps --from <pgsql-parser|dev-utils>. pnpm rewrote pnpm-lock.yaml in its canonical format; the committed file had been run through prettier, which is most of the diff.
Contributor
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This comment has been minimized.
This comment has been minimized.
0.7.2 read every -is/-us word as already singular, so an "apis" table became "apises" in getGraphQLQueryName and in the generated schema. constructive-io/dev-utils#112.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
makage update-depsfrompgsql-parseranddev-utils(13 first-party bumps:schema-typescript,inflekt,confstash,komoji,git-changed,nested-obj,yanse,pnpm-policy,@pgsql/*,@inquirerer/utils,@constructive-io/fetch), plus the fix for theERR_PNPM_NO_MATURE_MATCHING_VERSIONwall that made any re-resolution impossible:Nothing was wrong with the update — the graphile v5 stack is pinned to exact versions published inside the 14-day quarantine, and an exact pin has nothing older to fall back to, so the lockfile could be installed but never regenerated.
The fix is
maintainers: [pyramation, benjie]inpnpm-policy.yaml. Trusting the account that publishes the whole family exemptsgrafast,graphile-build*,postgraphile,grafserv,graphile-config,@dataplan/*,pg-sql2in one line, and keeps working through the next upgrade — agrafast@1.1.1waiver would have to be rewritten for1.1.3. Two consequences worth knowing:graphqlitself,graphiql,graphql-language-service,monaco-graphql,ruru,tamedevil,pg-introspection— those skip the wait now too.inventorymoves in-repo (./pnpm-policy.inventory.json, rebuild withpnpm run policy:refresh). The shared@constructive-io/pnpm-policyexport is generated frompyramationalone, so it cannot express this; the dependency on it is dropped. Moving it back is a data-only republish of that package with benjie in its ownmaintainers.intersect: truekeeps the emitted list honest — of 1024 inventory names, 49 are in this lockfile and get emitted; 975 are omitted.The remaining
exceptionsare unchanged from what landed with the policy: toolchain floors (@typescript-eslint/*,@types/*,@playwright/test,minimatch,@0no-co/graphql.web) whose^flooris the newest release, each expiring the day that version turns 14d.One thing to know about
pnpm depspnpm up -r -i -Lstill fights the policy, and no config fixes it: an exemption does not extend to the exempted package's own exact-pinned dependencies (pnpm#11068). Excluding@typescript-eslint/*just moves the error down to@typescript-eslint/type-utils@8.66.0, and waivingminimatch@10.2.6moves it tobrace-expansion@5.0.9underneath.-Lasks for the newest of everything, which is precisely what a quarantine refuses — drop-L, or wait out the window, rather than waiving deeper each time.Lockfile diff size
pnpm-lock.yamlshows −7.2k/+2.6k lines with the same package set: the committed file had been run through prettier (resolution:expanded to a wrapped{ integrity: ... }block), and pnpm rewrote it in its canonical one-line form. 1532resolution:entries out, 1528 in.Verified:
pnpm install,pnpm install --frozen-lockfile,pnpm build,pnpm lint,pnpm policy:checkall clean.inflekt 0.8.0
The
inflektbump surfaced a real regression: 0.7.2 read every-is/-usword as already singular, so anapistable round-tripped toapises— failinggetGraphQLQueryName('apis')and theapisquery in the server integration test (400, the schema had named the fieldapises). Fixed upstream in constructive-io/dev-utils#112 and consumed here as^0.8.0; no code in this repo needed to change.Link to Devin session: https://app.devin.ai/sessions/c2c27132839a45219a440fd10cbf13a6
Requested by: @pyramation