fix(deps): restore the empty dependencies contract and guard it - #46
Merged
Conversation
Two review findings from the dependency sweep, both correct.
`package.json` lost its `"dependencies": {}` key. Nobody removed it — `pnpm add`
rewrites the manifest and drops an empty object without a word, so an ordinary
dependency bump deleted the one line that states this package ships nothing at
runtime. README, CLAUDE.md, AGENTS.md and the Dependabot config all assert that
contract; the manifest had stopped saying it.
Restore it, and assert it in the dogfood smoke test so it cannot vanish quietly
again. The check distinguishes a missing key from an empty one, because they are
different claims and only one is the contract. Red-checked both ways: removing
the key fails with "the zero-dependency contract is unstated", and adding a real
dependency fails naming it.
Also drop the pull-request numbers from the Dependabot grouping comment. Comments
under `.github/**` are timeless by project rule, and a PR reference is exactly the
kind that reads as noise once the pull request is closed. The failure mode is
described instead, which is what a future reader needs, plus a pointer to the
workspace overrides that enforce the other half of the invariant.
There was a problem hiding this comment.
Pull request overview
Restores the repository’s “zero runtime dependencies” supply-chain contract by reintroducing an explicit empty "dependencies": {} in package.json, and adds a smoke-test assertion to prevent silent regressions (e.g., pnpm add dropping the empty object). It also updates a Dependabot grouping comment under .github/** to be timeless per project rules.
Changes:
- Re-add
"dependencies": {}topackage.jsonto explicitly assert the zero-runtime-dependency contract. - Extend the dogfood smoke test to fail if the
dependencieskey is missing or non-empty. - Remove PR-number references from
.github/dependabot.ymlcomment and replace them with invariant-focused explanation.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| scripts/dogfood-smoke-test.mjs | Adds a “zero runtime dependencies” assertion to the dogfood smoke test. |
| package.json | Restores explicit empty dependencies object to re-assert the contract. |
| .github/dependabot.yml | Makes the BullMQ/ioredis grouping rationale timeless (no PR-number references). |
… on it `Object.hasOwn` is true for `"dependencies": null`, and `Object.keys(null)` then throws. The check meant to explain which contract broke would instead kill the run with an opaque TypeError — a guard that crashes is worse than one that reports, because the operator loses the one message that was the point. Validate the shape before reading it, so `null`, a string and an array each fail with the value they carried. Red-checked all four rejections plus the passing case; the `null` case has to be exercised with `node` directly, since pnpm refuses to run scripts at all when the manifest is malformed and never reaches the script.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses both Copilot findings on #43. Both were correct, and both were mine.
1.
package.jsonlost"dependencies": {}Nobody deleted it —
pnpm addrewrites the manifest and drops an empty object without a word, so an ordinary dependency bump removed the one line that states this package ships nothing at runtime. The README,CLAUDE.md,AGENTS.mdand the Dependabot config all assert that contract; the manifest had quietly stopped asserting it.Restored, and now asserted in the dogfood smoke test so it cannot vanish silently again. The check distinguishes a missing key from an empty one, because they are different claims and only one of them is the contract.
Red-checked both failure modes:
FAIL: package.json has no \dependencies` key — the zero-dependency contract is unstated`FAIL: package.json declares runtime dependencies: lodashThis is the third gate added for the same reason as
LICENSEin #27: the publish pipeline had no way to notice a removal, only a bad addition.2. PR numbers in a
.github/**commentThe
bullmq-stackgrouping rationale cited#33and#39. Comments under.github/**are timeless by project rule, and a PR reference is exactly the kind that reads as noise once the PR is closed. The comment now describes the failure mode — which is what a future reader actually needs — and points at the workspaceoverridesthat enforce the other half of the invariant (one resolved copy across the root and every example).Verification
typecheck · test:types · lint · 260 tests at 100% statements/branches/functions/lines · build · size (12 032 / 18 432 B brotli) · check:exports (four quadrants green on both subpaths) · dogfood smoke.
Ready for your review — I am not merging it.