Skip to content

Commit cbee74d

Browse files
committed
chore(cutover): the happy-dom floor's comment names the objectui lines it moves (objectstack#25803)
scripts/ui-import/README.md step 6: after the splice, every objectui row still moved must be an override pnpm-workspace.yaml keeps on purpose, named in its comment block. Measured with `splice-lockfile.mjs --measure` against objectui main 3b7b040 (subtree-pulled onto 9e37acd): 48 rows moved; 46 are the `pnpm dedupe` moves the cutover recipe accepts (item 16), and the other two are happy-dom 20.11.2 -> 21.0.4 in ui/ and ui/apps/console, which this floor (GHSA-834v-8h66-3h79, no 20.x fix) makes. The react-router floor was already scoped to 8.x (objectui's 7.x line moves 0 rows) and better-auth no longer moves, since objectui declares 1.7.12 itself. The happy-dom comment still said no manifest declares it and the lockfile carries none, which is true of objectstack alone and false of the merged tree. Comment only: the override and the lock are unchanged (`pnpm install --lockfile-only` leaves pnpm-lock.yaml byte-identical), and check:override-consistency, check-osv-exemptions and check-watch-hint-literal exit 0. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CUXv64KLMfYv3ia2sWi6te
1 parent 9c8694b commit cbee74d

1 file changed

Lines changed: 9 additions & 0 deletions

File tree

‎pnpm-workspace.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -687,6 +687,15 @@ overrides:
687687
# the 20.10.2 that resolved; with the peer rewritten to ^21.0.4 pnpm no
688688
# longer installs it at all, so the lockfile carries no happy-dom. The
689689
# entry stays as the floor a future declaration lands on.
690+
# The imported objectui tree (ui/, objectstack#25677) is that declaration:
691+
# ui/package.json and ui/apps/console declare ^20.11.2 and objectui's
692+
# vitest runs on the happy-dom environment, so this floor moves both onto
693+
# 21.0.4, one major above what objectui locked. Kept on purpose: 20.x has
694+
# no fix, and no red class of the verification runs (objectstack#25718)
695+
# traces to happy-dom. It is the one override that still moves an
696+
# objectui dependency (scripts/ui-import/README.md step 6, measured on
697+
# objectui main 3b7b04007f); the react-router floor above is scoped to
698+
# 8.x so objectui's 7.x line stays its own.
690699
# NOT cleared: @azure/msal-node GHSA-xcx6-jx8p-x3h5 (high) — 5.4.1 from
691700
# @azure/identity 4.13.1 (^5.1.0) under tedious 18.6.2, driver-sql's
692701
# optional mssql peer. The fix is only in msal-node 7.1.0 and no

0 commit comments

Comments
 (0)