From 4697ac845a4009a6717438e916d63070b1b37313 Mon Sep 17 00:00:00 2001 From: Guillaume Gay Date: Wed, 19 Aug 2026 17:26:42 +0200 Subject: [PATCH 1/2] fix: unpin modelparams in the unpublished MCP package --- package-lock.json | 2 +- packages/modelparams-mcp/README.md | 2 +- packages/modelparams-mcp/package.json | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index acd553c8..dcbe118d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -8013,7 +8013,7 @@ "license": "MIT", "dependencies": { "@modelcontextprotocol/sdk": "^1.30.0", - "modelparams": "0.0.56", + "modelparams": "*", "zod": "^3.25.0" }, "bin": { diff --git a/packages/modelparams-mcp/README.md b/packages/modelparams-mcp/README.md index a07fb784..ec661955 100644 --- a/packages/modelparams-mcp/README.md +++ b/packages/modelparams-mcp/README.md @@ -109,7 +109,7 @@ One entry documents one wire format, so `validate_model_params` answers for the The catalog is compiled in at publish time from the YAML source of truth at [github.com/mnfst/modelparams.dev](https://github.com/mnfst/modelparams.dev/tree/main/models). No runtime fetch, no cache to invalidate — update the package to get new models. -The hosted endpoint is rebuilt with the site on every catalog change, so it always answers from the current catalog. A local build of this package pins an exact [`modelparams`](https://www.npmjs.com/package/modelparams) dependency instead, and answers from whichever catalog version that pin resolves. +The hosted endpoint is rebuilt with the site on every catalog change, so it always answers from the current catalog. A local build of this package takes [`modelparams`](https://www.npmjs.com/package/modelparams) straight from this workspace — the dependency is deliberately unpinned, because the package is not published and an exact pin only froze it at a version the workspace had already moved past. ## License diff --git a/packages/modelparams-mcp/package.json b/packages/modelparams-mcp/package.json index 62b3c925..50344552 100644 --- a/packages/modelparams-mcp/package.json +++ b/packages/modelparams-mcp/package.json @@ -54,6 +54,6 @@ "dependencies": { "@modelcontextprotocol/sdk": "^1.30.0", "zod": "^3.25.0", - "modelparams": "0.0.56" + "modelparams": "*" } } From 72b0eea96ff8e7bd087bd9f65574e433d32434ef Mon Sep 17 00:00:00 2001 From: Guillaume Gay Date: Wed, 19 Aug 2026 17:27:34 +0200 Subject: [PATCH 2/2] test: cover sibling repinning with a fixture, not the unpinned MCP package --- tests/release-lockfiles.test.ts | 30 +++++++++++++++++++++++------- 1 file changed, 23 insertions(+), 7 deletions(-) diff --git a/tests/release-lockfiles.test.ts b/tests/release-lockfiles.test.ts index af22aee5..b12e7907 100644 --- a/tests/release-lockfiles.test.ts +++ b/tests/release-lockfiles.test.ts @@ -20,11 +20,27 @@ describe("bumpPackageLockVersion", () => { expect(split(updated, "modelparams").entry).toContain('"version": "9.9.9"'); }); - it("moves the exact sibling pin the MCP package ships in lockstep", () => { - const updated = bumpPackageLockVersion(lock, "9.9.9", "modelparams-mcp", ["modelparams"]); - const { entry } = split(updated, "modelparams-mcp"); - expect(entry).toContain('"version": "9.9.9"'); - expect(entry).toContain('"modelparams": "9.9.9"'); + // No workspace pins a sibling exactly today — modelparams-mcp did until it + // stopped being published — so this exercises the repinning against a + // fixture. Keep it: the day another package pins a sibling, a release that + // moves one and not the other breaks `npm ci` for every job on the PR. + it("moves an exact sibling pin alongside the version", () => { + const fixture = [ + "{", + ' "packages": {', + ' "packages/pinning-workspace": {', + ' "version": "0.0.1",', + ' "dependencies": {', + ' "modelparams": "0.0.1"', + " }", + " }", + " }", + "}", + ].join("\n"); + + const updated = bumpPackageLockVersion(fixture, "9.9.9", "pinning-workspace", ["modelparams"]); + expect(updated).toContain('"version": "9.9.9"'); + expect(updated).toContain('"modelparams": "9.9.9"'); }); it("leaves every other entry untouched", () => { @@ -36,8 +52,8 @@ describe("bumpPackageLockVersion", () => { }); it("is idempotent, so a re-prepared release branch converges", () => { - const once = bumpPackageLockVersion(lock, "9.9.9", "modelparams-mcp", ["modelparams"]); - expect(bumpPackageLockVersion(once, "9.9.9", "modelparams-mcp", ["modelparams"])).toBe(once); + const once = bumpPackageLockVersion(lock, "9.9.9", "modelparams"); + expect(bumpPackageLockVersion(once, "9.9.9", "modelparams")).toBe(once); }); it("fails loudly rather than silently skipping an unknown workspace", () => {