chore(deps): bump semantic-release to v25 (clears sigstore advisory, 16→15) - #3408
Merged
Conversation
…o v12 Clears the sigstore dev/CI-only advisory (16→15). Both are dev-only release-tooling deps; release.yml already runs Node 22 (satisfies semantic-release@25 engines). syncpack intentionally left at ^13.0.4 — v15 silently ignores .syncpackrc.json's lintRules.forbiddenDependencies (supply-chain guard) and dependencyTypes, so it is not a safe drop-in. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
The semantic-release bump perturbed the dependency graph enough to shift bun's hoisting so that packages/ui's tsup build loaded an ESM brace-expansion@5 against a CJS balanced-match@1.0.2 (no named 'balanced' export), crashing @trycompai/ui#build on Vercel (framework-editor). Root cause is a latent fragility: packages/ui pulled 'glob' into its build in two places — tsup.config.ts (ESM import evaluated by bundle-require) and scripts/generate-exports.cjs. glob→minimatch→brace-expansion's balanced-match resolution is hoisting-dependent, so any dep-graph change can trip it. Remove glob from the ui build entirely: - tsup.config.ts: pass entry globs directly; tsup expands them via tinyglobby (picomatch/fdir), no brace-expansion. - generate-exports.cjs: manual recursive fs.readdirSync walk (withFileTypes, Node>=10; sorted for deterministic output). Verified: turbo build 20/20; dist file list + generated exports content unchanged (exports now alphabetical, deterministic across rebuilds). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 3 files (changes from recent commits).
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
The manual readdirSync walk enumerated every entry, whereas the previous
glob.sync('**/*.js') excluded dotfiles/dot-directories by default (dot:false).
Skip dot-prefixed entries so a stray .something.js or .hidden/ in dist/ can't
leak into package.exports. No change to current output (dist has no dotfiles).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
|
🎉 This PR is included in version 3.102.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Safe, in-range dependency bumps to release tooling. Clears the remaining sigstore advisory that survived #3406, taking
bun auditfrom 16 → 15. Single clean commit offmain.semantic-release^24.2.9 → ^25.0.7sigstore/@sigstore/*(clears the dev/CI advisory)@semantic-release/github^11.0.6 → ^12.0.9Both are dev-only, CI-only deps (they run in
release.yml, never ship in any app).release.ymlalready runs Node 22, which satisfies semantic-release@25'sengines(^22.14 || >=24.10).Deliberately NOT bumped: syncpack
syncpack@15was evaluated and reverted to^13.0.4. v15 silently ignores two things in our.syncpackrc.json:lintRules.forbiddenDependencies— the guard that blocks adding npm packages which shadow Node builtins (crypto,fs,path, …). Losing this in a security PR is the wrong trade.dependencyTypes— deprecated in v15 (needs the--dependency-typesCLI flag).It would clear a
minimatch(dev-only ReDoS) advisory, but not without a config migration that weakens a supply-chain lint rule — so it's not a "safe" drop-in. Left for a separate, deliberate migration if we want it.Verification
bun audit16 → 15 (sigstore cleared)syncpack lintclean on v13 (no deprecation warnings)Test plan
🤖 Generated with Claude Code
Summary by cubic
Bumps
semantic-releaseto v25 and@semantic-release/githubto v12 to clear the dev/CIsigstoreadvisory (bun audit 16→15). Removesglobfrom the UI build and matches glob semantics in export generation to fix the framework-editor build crash.Dependencies
semantic-releaseto^25.0.7and@semantic-release/githubto^12.0.9; dev-only tooling, Node 22 inrelease.ymlmeets engines.syncpackat^13.0.4since v15 ignoreslintRules.forbiddenDependenciesand deprecatesdependencyTypes.Bug Fixes
globfromtsup.config.tsandscripts/generate-exports.cjs(tsup expands globs; exports via a recursive FS walk) and now skip dotfiles to match glob semantics, eliminating hoisting-sensitiveglob→minimatch→brace-expansionissues and restoring Vercel builds.Written for commit e07be46. Summary will update on new commits.