1605dbd3ef
chore(deps): refresh dependencies after seven-day cooldown ( #129941 )
...
* chore(deps): refresh dependencies after cooldown
* chore(deps): refresh sherpa-onnx runtime to v1.13.6
* test(ios): refresh Fastlane pin expectations
2026-08-26 01:37:37 -07:00
c70aee247e
refactor(scripts): migrate JavaScript tools to TypeScript ( #121005 )
...
* refactor(scripts): migrate JavaScript tools to TypeScript
* fix(ci): keep changed-scope preflight zero-install
* fix(ci): preserve zero-install script owners
* fix(ci): complete script migration follow-through
* fix(release): keep stable closeout zero-install
* fix(scripts): preserve standalone execution boundaries
* fix(scripts): repair standalone loader boundaries
* fix(scripts): normalize gateway observation ids
* fix(scripts): keep Docker packager standalone
* test(scripts): preserve rebase cleanup helpers
* test(sessions): use tracked temp directory
2026-08-09 07:21:35 -07:00
f6131a4fbf
build(deps): remove npm shrinkwrap; mirror pnpm lock into transient package locks ( #114006 )
...
* build(deps): remove npm shrinkwrap; mirror pnpm lock into transient package locks
npm 12 removed shrinkwrap (command + tarball/root loading). Delete all 82
committed npm-shrinkwrap.json files and stop publishing lockfiles; keep
pnpm-lock.yaml as the single reviewed dependency boundary. The generator
becomes scripts/generate-npm-package-lock.mjs and feeds plugin bundling via
a transient package-lock.json + npm ci (works on npm 11 and 12). Tarball
validation treats the published 2026.7.2 beta train as a shrinkwrap
transition; self-update npm detection now uses install topology instead of
the shipped shrinkwrap.
* fix(deps): repair lint, deadcode, and test-type lanes for the npm 12 migration
- sort integrity comparisons with an explicit comparator (oxlint)
- keep resolveBunGlobalNodeModules module-local (knip unused-export gate)
- model npm pack --json as npm<=11 array / npm 12 name-keyed object
- default calver destructuring in the tarball test fixture
2026-07-26 01:29:55 -04:00
0e091482a3
fix(qa): reject ambiguous dependency report inputs
2026-06-23 13:43:44 +02:00
4c453c931f
fix(test): reject dependency report flag values
2026-06-21 20:23:23 +02:00
d6075c1694
fix(test): clean dependency report cli errors
2026-06-20 02:02:37 +02:00
53044e8717
fix(report): reject missing dependency report paths
2026-06-06 22:07:31 +02:00
58c663920d
docs: document script tests
2026-06-04 20:49:50 -04:00
bfa5b39648
fix: cover plugin package locks in dependency review
2026-05-22 12:56:10 +01:00
82f69a269b
fix: include plugin shrinkwraps in dependency reports
2026-05-22 12:56:10 +01:00
b6c8807ca0
chore: add shrinkwrap to plugin npm packages
2026-05-22 12:56:10 +01:00
c56067e34f
chore: harden npm shrinkwrap release path
2026-05-22 12:56:10 +01:00
bd4db5ee62
Add dependency release safety evidence and PR awareness ( #81325 )
...
* test: cover dependency pin guard
* build: add dependency vulnerability gate
* build: add dependency risk report
* build: add dependency drift reports
* build: include dependency ownership surface evidence
* build: rename dependency report commands
* build: respect release age exclusions in risk report
* build: clarify transitive risk accounting
* build: remove transitive risk exception registry
* build: clarify transitive risk signal wording
* ci: attach dependency evidence to release preflight
* ci: extract dependency release evidence generator
* build: rename ownership surface dependency report
* ci: clarify release evidence naming
* build: clarify recently published risk report
* build: reorder transitive risk report sections
* build: fix ownership surface pluralization
* ci: surface dependency changes on PRs
* ci: harden dependency change awareness
* ci: use dependency changed PR label
* build: fix dependency report lint
* docs: add dependency safety changelog
2026-05-13 03:05:09 -05:00
Peter Steinberger