fix(deps): restore apps/web dependency floors regressed by #1111 - #1164
Closed
groupthinking wants to merge 2 commits into
Closed
fix(deps): restore apps/web dependency floors regressed by #1111#1164groupthinking wants to merge 2 commits into
groupthinking wants to merge 2 commits into
Conversation
The npm-minor-patch group merge (#1111, commit 6ea7b6a) was squash-merged from a stale base (abd9332) that predated main's floor-hardening in e1181c2. As a result it rolled three apps/web floors back below what main had deliberately pinned, and widened an exact pin: - tailwindcss ^4.3.3 -> ^4.3.2 (restored to ^4.3.3) - @tailwindcss/postcss ^4.3.3 -> ^4.3.2 (restored to ^4.3.3) - autoprefixer ^10.5.4 -> ^10.5.2 (restored to ^10.5.4) - @opentelemetry/api 1.9.1 -> ^1.9.0 (restored to exact 1.9.1) Both the Copilot and the prior review on #1111 flagged the tailwind/ autoprefixer downgrades. This restores the hardened floors and regenerates the lockfile: tailwindcss/@tailwindcss/* -> 4.3.3, autoprefixer -> 10.5.4, with only benign in-range transitive moves (enhanced-resolve 5.21.6->5.24.5, browserslist deduped to 4.28.6). All ~20 upward bumps from #1111 are kept. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AA8A8xh3WQQkhVL5pLSmVB
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Important Review skippedAuto reviews are limited based on label configuration. 🏷️ Required labels (at least one) (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository YAML (base), Repository UI (inherited), Organization UI (inherited) Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔍 PR Validation |
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. OpenSSF ScorecardScorecard details
Scanned Files
|
Agent Completion Truth Gate: BLOCKEDReasons: Machine-readable verdict{
"details": {
"collection_errors": [
"incomplete_linked_issue_contract",
"missing_linked_issue",
"missing_closing_issue_reference",
"missing_agent_run_id",
"missing_agent_login"
],
"invalid_fields": [
"issue.number",
"policy.agent_login",
"policy.run_id"
]
},
"reasons": [
"invalid_payload"
],
"verdict": "blocked"
} |
Owner
Author
|
@coderabbitai review Context for the review: this is a narrow dependency-floor restoration. The only intended manifest changes are in Generated by Claude Code |
Contributor
|
✅ Action performedReview finished.
|
Owner
Author
CI status — the floor-fix itself is green; the two reds are pre-existing / maintainer-gatedVerified on head ✅ Passing (and confirming the change)
🔒 Net: the dependency change is green (build, deploy, and dependency-review all pass). The two red checks are a pre-existing scanner false-positive and the human-gated completion gate — the same posture under which #1111 was merged. Leaving the merge and gate clearance to a maintainer. Generated by Claude Code |
Owner
Author
|
Blocker-watch containment at exact head This two-file forward fix correctly targets the four dependency-floor regressions introduced by merged #1111, but it remains draft because:
No code or branch history was changed here. The next daily control pass should bind one focused issue and retain exactly one canonical branch after comparing #1114 with this current-main repair. |
This was referenced Aug 1, 2026
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
…the exact pin The prior commit restored the exact `1.9.1` pin in apps/web/package.json but left a stale nested `apps/web/node_modules/@opentelemetry/api` at `1.9.0` in the lockfile. An exact pin requires the resolved node to match exactly, so `npm ci` would reject the tree (VADE flagged this on the PR). Evict the stale nested node and re-resolve: the apps/web edge now dedupes to the single root `@opentelemetry/api@1.9.1`, with no other `@opentelemetry/api` node remaining below the pin. Lockfile-only change; no manifest edit. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AA8A8xh3WQQkhVL5pLSmVB
Owner
Author
Fixed the VADE
|
| pkg | main manifest |
main lock |
status on current main |
|---|---|---|---|
tailwindcss / @tailwindcss/postcss |
^4.3.2 ⬇ |
4.3.2 | consistent, but floor regressed by #1111 |
autoprefixer |
^10.5.2 ⬇ |
10.5.2 | consistent, but floor regressed by #1111 |
@opentelemetry/api |
^1.9.0 ⬇ |
1.9.1 | exact pin loosened by #1111 |
@sentry/nextjs |
^10.69.0 |
10.65.0 | still drifted / invalid (pre-#1111, #1110's scope) |
@stripe/stripe-js |
^9.12.1 |
9.9.0 | still drifted / invalid (pre-#1111, #1110's scope) |
Key point: #1114 is lockfile-only by design — #1110 forbids manifest edits — which was correct on its base (abd9332), where the manifest already declared the high floors and only the lock had drifted. After #1111 lowered those manifest floors, a lockfile-only fix can no longer restore them (re-resolution lands back on 4.3.2, satisfying the lowered ^4.3.2). Restoring them on current main requires a manifest edit — exactly what #1164 does and what #1110's constraint prohibits. #1114 is also now mergeable_state: dirty against current main.
Neither PR alone is a complete current-main repair:
- fix(deps): restore apps/web dependency floors regressed by #1111 #1164 restores the four build(deps): bump the npm-minor-patch group across 1 directory with 26 updates #1111-regressed floors (tailwind trio + otel exact pin) but does not touch the
@sentry/@stripedrift. - fix(deps): realign apps/web lockfile with declared ranges #1114 fixes the
@sentry/@stripedrift but is stale, and can't restore the tailwind/otel floors without the manifest edit its issue forbids.
Recommendation (for the daily control pass to decide): adopt #1164 as the current-main canonical branch and either (A) extend it to also realign the @sentry 10.65→10.69 / @stripe 9.9→9.12.1 lock drift (folding in #1114's remaining scope; note this pulls the 4 @apm-js-collab transitive bumps #1114 documented, a runtime-affecting change worth its verification), then close #1114 and update #1110 to permit the now-required manifest edit; or (B) keep #1164 scoped to the #1111 regression and let a rebased #1114 handle sentry/stripe separately.
I've kept #1164 scoped to the #1111 regression and have not unilaterally closed #1114 or expanded into the runtime-affecting sentry bump. Happy to execute option (A) on a maintainer's go-ahead.
Generated by Claude Code
9 tasks
15 tasks
Owner
Author
Closing — branch orphaned by the secret-purge force-pushNo common ancestor with current The work is unlanded and still wanted — Branch retained for archive-tagging. Generated by Claude Code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Canonical issue
Closes # (no tracking issue — forward-fix for a regression merged to
mainvia #1111)Outcome
Restores three
apps/webdependency floors (and one exact pin) that #1111 silently rolled back onmain, without disturbing any of that PR's ~20 legitimate upward bumps. Keeps the tailwind toolchain on the patched4.3.3line andautoprefixeron10.5.4, matching the hardened floorsmainhad deliberately pinned ine1181c2.Scope
apps/web/package.json—tailwindcss^4.3.2→^4.3.3@tailwindcss/postcss^4.3.2→^4.3.3autoprefixer^10.5.2→^10.5.4@opentelemetry/api^1.9.0→1.9.1(restore exact pin)package-lock.jsonregenerated to resolvetailwindcss/@tailwindcss/*→4.3.3,autoprefixer→10.5.4.Risk
4.3.3/ autoprefixer10.5.4are the versionsmainran before build(deps): bump the npm-minor-patch group across 1 directory with 26 updates #1111.mainreturns to the build(deps): bump the npm-minor-patch group across 1 directory with 26 updates #1111 post-merge state.Root cause
#1111 was squash-merged (
6ea7b6a) from a stale base (abd9332) that predatedmain's floor-hardening ine1181c2, so it reflected the old^4.3.2floors. A dependabot rebase would have prevented this; the merge landed before the rebase. Both the Copilot review and the prior review on #1111 flagged the downgrades.Verification
tailwindcss@4.3.3,@tailwindcss/postcss@4.3.3,autoprefixer@10.5.4(verified vianpm install --package-lock-only).enhanced-resolve5.21.6→5.24.5,browserslistdeduped to 4.28.6) — no other version changes.Production evidence
Not applicable — dependency-manifest change; validated via lockfile resolution. Vercel preview will attach on CI.
Agent handoff
mainOpened as draft — the merge to protected
mainis left to a maintainer.Generated by Claude Code