Repository navigation
Conversation
@types/node 26.4.0, lint-staged 17.4.1, nx 23.1.2, vue 3.5.42, zod 4.5.1, tar-stream 3.2.1, @vue/test-utils 2.5.0, happy-dom 20.11.13, vue-router 5.3.0
…dled types
tar-stream 3.2.1 is a types-only release: `npm diff` against 3.2.0 shows
exactly two changed files, package.json and a new index.d.ts. It declares
`exports["."].types`, which shadows @types/tar-stream@3.1.4 — and the
bundled types model tar-stream on `streamx` rather than node:stream.
The runtime objects were already streamx before the bump, so every stream
hop here is behaviourally unchanged; only the declarations moved. Adapt
the call sites and drop @types/tar-stream, which is now dead in both apps
(it stays in the tree transitively via @types/tar-fs).
- `Headers` -> `Header` (the plural name no longer exists upstream)
- `entry.end()` -> `entry.end(undefined)`; streamx types the argument as
required, and its WritableState.end no-ops on undefined and null
- node<->streamx crossings assert at the boundary: docker-modem only calls
.on('error') and .pipe(req) on the archive, and node's pipe/pipeline
duck-type their peer through write/end/'drain'
Also fixes the same break in test/unit/bucket-file.spec.ts, which CI's
build:types cannot see (every tsconfig.build.json is `include: src/**`).
|
Warning Review limit reachedNext included review available in 33 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (17)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Updates a set of minor/patch dependencies across the Hub monorepo and applies the minimal TypeScript-level adaptations required to keep builds and type-checking green after tar-stream@3.2.1 started shipping its own (streamx-based) type declarations.
Changes:
- Bump 9 dependencies (
@types/node,lint-staged,nx,vue,zod,tar-stream,@vue/test-utils,happy-dom,vue-router) across workspaces and syncpackage-lock.json. - Adapt
tar-streamcall sites to the new exportedHeadertype and streamx-vs-node stream typing differences (targetedunknown as NodeJS.*Streambridges, andend(undefined)where required by types). - Remove direct
@types/tar-streamdevDependencies fromapps/server-storageandapps/server-core-worker, and fix a unit test type-check break inapps/server-storage.
Reviewed changes
Copilot reviewed 17 out of 18 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
package.json |
Bumps root dev tooling deps (@types/node, lint-staged, nx). |
package-lock.json |
Lockfile updates for all 9 bumps; removes stale @types/tar-stream edges and updates resolved versions/integrities. |
apps/server-core/package.json |
Bumps zod runtime dependency. |
apps/server-messenger/package.json |
Bumps zod runtime dependency. |
apps/server-telemetry/package.json |
Bumps zod runtime dependency. |
apps/server-storage/package.json |
Bumps tar-stream + zod, drops @types/tar-stream. |
apps/server-core-worker/package.json |
Bumps tar-stream + zod, drops @types/tar-stream. |
apps/client-ui/package.json |
Bumps vue and zod. |
docs/package.json |
Bumps vue for the VitePress docs workspace. |
packages/core-kit/package.json |
Bumps zod dependency. |
packages/storage-kit/package.json |
Bumps zod dependency. |
packages/telemetry-kit/package.json |
Bumps zod dependency. |
packages/messenger-kit/package.json |
Bumps zod dependency. |
packages/client-vue/package.json |
Bumps vue, vue-router, zod, @types/node, @vue/test-utils, happy-dom (deps + devDeps where applicable). |
apps/server-storage/src/adapters/http/controllers/bucket/stream.ts |
Bridges streamx-typed tar entry sink to node:stream/promises pipeline() via a double assertion. |
apps/server-storage/test/unit/bucket-file.spec.ts |
Bridges streamx-typed tar extract sink to node’s pipe() in the unit test (type-check fix). |
apps/server-core-worker/src/adapters/docker/container-pack.ts |
Updates Headers→Header, and bridges pack/extract streamx types at dockerode and node piping boundaries; updates end(undefined). |
apps/server-core-worker/src/app/components/analysis-builder/handlers/execute/module.ts |
Updates end(undefined) and bridges pack into dockerode.buildImage() call chain. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
Superseded — closing as fully redundant. All 8 non-tar-stream bumps in this group (@types/node, lint-staged, nx, vue, zod, @vue/test-utils, happy-dom, vue-router) are already on master via #1862. tar-stream 3.2.0 → 3.2.1 was the only remaining unique change here, and #1862 deliberately declined that one: it's a types-only release ( I resolved this branch's merge conflicts against current master to confirm: combining master's #1862 (decline the bump) with #1875 (container-pack directory-mode functionality, merged since this PR opened) yields a tree that is byte-for-byte identical to |
Supersedes #1858, whose build fails. Same 9 dependency updates, plus the code changes needed to keep the pipeline green.
@types/nodelint-stagednxvuezodtar-stream@vue/test-utilshappy-domvue-routerWhy #1858 failed
Nine
tscerrors across three files, inserver-storageandserver-core-worker. All of them trace to one bump:tar-stream3.2.1 is a types-only release.npm diff --diff=tar-stream@3.2.0 --diff=tar-stream@3.2.1reports exactly two changed files —package.jsonand a brand-newindex.d.ts. The runtime is byte-identical (verified independently:diff -rexcluding*.d.ts/package.jsonbetween the two installed copies reports no differences).What changed is resolution. 3.2.1 declares
exports["."].types, which unconditionally shadows@types/tar-stream@3.1.4. The DefinitelyTyped package modelled tar-stream onnode:stream; the bundled types model it onstreamx. SoPack,Extractand the entry sink are suddenly structurally unrelated to the node stream types thatdockerodeandnode:stream/promisesexpect — even though the objects were already streamx before the bump and satisfy both contracts at runtime.The DT package was an approximation that upstream has now superseded, so this is a real improvement in type fidelity, not a regression to work around.
The fix
Adapt the call sites; drop
@types/tar-streamfrom both apps, where it is now dead. It stays in the tree transitively via@types/tar-fs, so nothing else moves — the lockfile delta is exactly the two stale devDependency edges.Headers→Header. The plural name no longer exists upstream. It was load-bearing: it types four members of the exportedDockerContainerPackOptions.entry.end()→entry.end(undefined). streamx types the argument as required; itsWritableState.endexplicitly no-ops on bothundefinedandnull(else if (data !== undefined && data !== null) this.push(data)), and never consultsarguments.length. This was the one place a types-only fix could have corrupted a tar entry by pushing a stray chunk, so it was checked against the source rather than assumed.as unknown asbridges at the node↔streamx crossings. Each was checked against what the consumer actually calls, not just against what makestscquiet:putArchive:docker-modemcalls only.on('error')and.pipe(req)on the archive — neverisPaused/unpipe/wrap, the three membersNodeJS.ReadableStreamdeclares and streamx lacks.pipeline(source, entry)andreadable.pipe(extract): node duck-types its peer throughwrite/end/'drain', and streamx'swritereturns a real boolean and emitsdrain, so backpressure survives the bridge. This matters inbucket/stream.ts, where the await is what backpressures the MinIO read behind a slow HTTP consumer.as NodeJS.WritableStreamdoes not compile (TS2352) — streamx's runtime-agnosticEventEmitterdeclareslisteners()differently from@types/node— so the double assertion is compiler-forced rather than stylistic.The assertions erase to nothing. Transpiling old vs. new with both
tscand@swc/coregives byte-identical output forbucket/stream.ts, and exactly one delta in each of the other two files:entry.end()→entry.end(undefined).A second break site CI cannot see
apps/server-storage/test/unit/bucket-file.spec.ts:102carries the identical error on the extract side. Everytsconfig.build.jsonisinclude: ['src/**/*.ts'], sobuild:typesnever looks at it and the suite still passes (vitest transpiles via SWC and the runtime is unchanged) — buttsc --noEmit -p apps/server-storage/tsconfig.json, the pre-push check.agents/conventions.mdprescribes for test-touching changes, does fail. Fixed here so the bump is adapted in one place.Verification
Run locally against this branch:
npm run buildnpm run testnpm run linttsc -p apps/server-{storage,core-worker}/tsconfig.jsonmasterwith the old dependency treenpm ciis not a gate for the@types/tar-streamremoval, contrary to what it looks like: npm only validates that manifest edges are satisfied by the lock, not that the lock has no extras, so a stale edge would have landed silently. The lockfile is synced with a plainnpm install(never--package-lock-only, which strips the non-host-platform optional entries).Worth knowing about the other eight bumps
Nothing else needed a code change, but one behavioural change is worth flagging because it is silent:
zod 4.5.0 changed
.min()/.max()/.length()on strings from counting UTF-16 code units to counting Unicode code points..max()only loosens, but.min()strictly tightens for astral-plane input:z.string().min(3)accepted"😀😀"(4 code units, 2 code points) under 4.4.3 and rejects it under 4.5.1. This reaches every free-form string field without a charset guard —node.name, registry and analysis fields among them. It is upstream behaving more correctly, not a regression, and no test asserts on it, but a user who could previously name something with two emoji now cannot.Also non-events, each checked against real usage rather than release notes alone:
@vue/test-utils2.5.0's breaking change is dropping class components (none here, and stub matching — which the client-vue harness depends on forVCIcon) is byte-unchanged;vue-router5.3.0's codegen fixes are all inert for this route tree;@types/node26.4.0 did not change the stream typings at all, so thepipelineerror was 100% attributable to tar-stream.Follow-up, not in scope here
analysis-builder/handlers/execute/module.tssizes the Dockerfile tar entry withcontent.length(UTF-16 code units) while writing UTF-8 bytes.Sink._finalrejects whenwritten !== header.size, so a single non-ASCII character in an analysis entrypoint path fails the image build with an opaqueSize mismatch. It predates this PR and is left alone; tar-stream's buffer overload is both shorter and correct.