fix(ci): wrap pre/post release commands in bash -c for proper variable expansion - #35
Merged
Conversation
Contributor
Semver Impact of This PR🟢 Patch (bug fixes) 📋 Changelog PreviewThis is how your changes will appear in the changelog. Bug Fixes 🐛
🤖 This preview updates automatically when you update the PR. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
BYK
force-pushed
the
fix/craft-pre-release-command
branch
from
January 22, 2026 01:35
8f22fb9 to
050eb49
Compare
Matches Craft's own .craft.yml approach for proper variable expansion. Fixed operator precedence in postReleaseCommand to ensure git pull/push only runs when there are actual changes to commit.
BYK
force-pushed
the
fix/craft-pre-release-command
branch
from
January 22, 2026 01:38
050eb49 to
e831d00
Compare
BYK
added a commit
that referenced
this pull request
Aug 1, 2026
…s lockfile (#1332) ## Summary Fixes all 13 open Dependabot alerts. No GitHub security advisories are open. Bumps the published package minimum to **Node.js 20+** (from 18+) so the declared `engines.node` matches what the new transitive overrides (`@hono/node-server@2.0.12`, `brace-expansion@5.0.9`) actually install. ## Background Post-merge of PR #1254 ("chore: pre-shape repo into pnpm-workspace monorepo layout"), the docs workspace moved from `docs/` to `apps/cli-docs/`. The old `docs/package.json` was deleted, but `docs/pnpm-lock.yaml` was left tracked — referencing the obsolete Astro 6.x / Starlight 0.39 layout. This stale lockfile is the source of 9 of the 13 open alerts. The remaining 4 alerts are transitive vulnerabilities in the active root `pnpm-lock.yaml`: - `shell-quote@1.8.4` via `react-devtools-core` - `@hono/node-server@1.19.17` via `@modelcontextprotocol/sdk@1.29.0` → `@hono/mcp` → `@mastra/client-js` - `fast-uri@3.1.3` via `ajv` → MCP SDK chain - `brace-expansion@5.0.7` via `minimatch` → `glob` (via ultracite and @sentry/bundler-plugins) ## Changes 1. **Delete `docs/pnpm-lock.yaml`** — orphaned lockfile from pre-monorepo layout; closes alerts #25, #27, #29, #31, #33, #34, #35, #41, #54. 2. **`pnpm.overrides` in root `package.json`** for the 4 transitive alerts: ```diff -"shell-quote@<1.8.4": "1.8.4", +"shell-quote@<1.9.0": "1.9.0", `qs@>=6.11.1 <=6.15.1`: "6.15.2", `form-data@<4.0.6`: "4.0.6", `vite@>=8.0.0 <8.0.16`: "8.0.16`, +"@hono/node-server@<2.0.5": "2.0.12", +"fast-uri@<=3.1.3": "3.1.5", +"brace-expansion@<5.0.8": "5.0.9" ``` The previous `shell-quote@<1.8.4 → 1.8.4` override was itself vulnerable (alert #36: `shell-quote <= 1.8.4` is the vulnerable range, patched in 1.9.0), so it is bumped to `<1.9.0 → 1.9.0`. 3. **`engines.node` bump 18 → 20** in root `package.json` and `packages/cli/package.json`, plus doc updates in: - `apps/cli-docs/src/content/docs/library-usage.md` - `apps/cli-docs/src/content/docs/migrating-from-v3.md` - `packages/cli/README.md` (the auto-generated `library-prereq` block reads from `engines.node` via `generateLibraryPrereq()` in `generate-docs-sections.ts`, so it picked up the new floor automatically). The dev floor (`devEngines.runtime >=22.15`) is unchanged — Node 22.15+ remains the development minimum. The standalone binary continues to bundle its own Node 22.15+ runtime. ## Verification - `pnpm audit --prod` → no known vulnerabilities - `pnpm run check:deps` ✓ - `pnpm run lint` ✓ (951 files) - `pnpm run typecheck` ✓ - `pnpm test:unit` → 416 files, 8760 tests passing, 13 skipped - Resolved versions match or exceed each patched minimum: - shell-quote 1.9.0 (patched 1.9.0) - @hono/node-server 2.0.12 (patched 2.0.5) - fast-uri 3.1.5 (patched 3.1.4) - brace-expansion 5.0.9 (patched 5.0.8) ## Reviewer notes **Pin rationale for `@hono/node-server@2.0.12`** — the patched minimum is 2.0.5, but `packages/cli/package.json` already declares `"@hono/node-server": "^2.0.6"` as a direct devDependency. Pinning to 2.0.12 (the latest 2.x available at PR time) keeps the override and the direct declaration in the same major line and avoids a near-term minor bump. `2.0.5–2.0.11` had no further advisories at the time of writing. **Lockfile dedupe side effect** — `shell-quote@1.10.0` (already non-vulnerable, used by `launch-editor`) is consolidated to `1.9.0` because the override forces single-version resolution. No security regression; `launch-editor` does not pin a shell-quote range narrower than what 1.9.0 satisfies. **Node 18 deprecation** — addresses the F1 SHOULD-FIX from the initial review. The `>=18.0` floor had become inconsistent with the lockfile once the overrides pulled in `@hono/node-server@2.0.12` (engines `>=20`) and `brace-expansion@5.0.9` (engines `20 || >=22`). Both packages are dev-only transitive deps, so the only users impacted are source-install users who run the CLI via `node` instead of the standalone binary. `devEngines.runtime` already required `>=22.15`, so development environments are unaffected. ## Note `pnpm audit` (non-prod-only) flags one additional low-severity advisory — `@ai-sdk/provider-utils@2.2.8` (GHSA-866g-f22w-33x8, CVE-2026-8769, via @mastra/client-js) — that is not yet in Dependabot. Addressing it requires bumping @mastra/client-js to a newer major; left out of this PR to keep scope focused on the explicit GitHub security report. <sub>Comment `@sentry <feedback>` on this PR to have Autofix iterate on the changes.</sub>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
preReleaseCommandwas failing because the${CRAFT_NEW_VERSION}variable wasn't being expanded correctly. Wrapping inbash -censures proper shell variable expansion.