From 338046b32ebb02ec43e3930d190c51948e66adf4 Mon Sep 17 00:00:00 2001 From: Miguel Angel Simon Sierra Date: Mon, 13 Jul 2026 23:32:54 -0400 Subject: [PATCH] fix(release): resolve packed-consumer transitive deps to local tarballs verifyPackedConsumer installs each package as a file: tarball, but each tarball pins its inter-@hyperframes deps to the exact release version. On a release bump that version is not on the npm registry yet, so bun resolves the transitive deps from the registry and fails. Add an overrides map forcing every @hyperframes/* to the sibling local tarball, making the check self-contained pre-publish. Exercised by the v0.7.57 release PR. --- scripts/verify-packed-manifests.mjs | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/scripts/verify-packed-manifests.mjs b/scripts/verify-packed-manifests.mjs index 5e63b782d4..4274fa19c9 100644 --- a/scripts/verify-packed-manifests.mjs +++ b/scripts/verify-packed-manifests.mjs @@ -310,15 +310,27 @@ function writeConsumerFixture(packDir, packedWorkspaces) { const fixtureDir = join(packDir, "consumer"); mkdirSync(fixtureDir); const rootPackage = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8")); - const dependencies = Object.fromEntries( + const workspaceFileDeps = Object.fromEntries( packedWorkspaces.map(({ filename, packedPackage }) => [packedPackage.name, `file:${filename}`]), ); + const dependencies = { ...workspaceFileDeps }; dependencies.typescript = rootPackage.devDependencies.typescript; dependencies["@types/node"] = rootPackage.devDependencies["@types/node"]; writeFileSync( join(fixtureDir, "package.json"), JSON.stringify( - { name: "packed-consumer", private: true, type: "module", dependencies }, + { + name: "packed-consumer", + private: true, + type: "module", + dependencies, + // Each packed tarball pins its inter-@hyperframes deps to the exact + // release version. On a release bump that version is not on the registry + // yet, so a plain install fails to resolve those transitive deps. Force + // every @hyperframes/* to the sibling local tarball so the check is + // self-contained pre-publish (matches how the packages install together). + overrides: { ...workspaceFileDeps }, + }, null, 2, ),