fix(renovate): pin storefront-template to the beta channel - #1297
Merged
Conversation
2.0.0-next.0..3 are leftovers from Feb-Apr/2020, deprecated on npm, but semver ranks them above every beta because prerelease ids compare alphanumerically (next > beta). npm normally hides this by preferring the `latest` dist-tag, so it only surfaces when a tagged version has not reached the public registry yet -- exactly what happened while 2.0.0-beta.299 was stuck in GitHub Packages. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Contexto
O
@ecomplus/storefront-template@2.0.0-beta.299foi tagueado em 24/07 e publicado no GitHub Packages, mas o workflowPublish(que espelha GH Packages → npm) vinha falhando desde junho com403 ... requires two-factor authentication or granular access token with bypass 2fa. O secretNPM_TOKENjá foi rotacionado e o run 30130972741 rodou verde — abeta.299está no npm e olatestvoltou ao lugar.O que este PR resolve
Enquanto a versão existia em tag mas não no registry público, o range
^2.0.0-beta.299passou a resolver para2.0.0-next.3— uma versão de abril/2020, já deprecada no npm:O motivo é semver puro: identificadores de pre-release são comparados alfanumericamente, então
next>beta. Normalmente o npm esconde isso porque prefere a versão do dist-taglatestquando ela satisfaz o range — mas quando olatestnão satisfaz, ele cai para a maior versão existente. Foi assim que o #1294 chegou a propor^2.0.0-beta.299→^2.0.0-next.3.A publicação da
beta.299já fechou o buraco atual. Este PR é o cinto de segurança: qualquer nova janela entre "tagueado" e "publicado no npm" reabriria exatamente o mesmo cenário.Nota
O
renovate-config-validatoraprova a config (Config validated successfully), mas emite umWARN: Config migration necessarypré-existente — osexcludePackagePatternse oconfig:baseestão deprecados em favor dematchPackageNamescom negação!econfig:recommended. O Renovate migra em runtime, então não quebra nada; fica a nota para uma limpeza à parte.🤖 Generated with Claude Code