chore: loosen base package dependency version constraints#2305
Merged
ava-silver merged 8 commits intoMay 5, 2026
Merged
Conversation
Contributor
Author
This stack of pull requests is managed by Graphite. Learn more about stacking. |
ava-silver
force-pushed
the
ava.silver/chore/loosen-base-package-version-constraints
branch
from
May 4, 2026 19:52
b6c416a to
c3bd7f5
Compare
ava-silver
changed the base branch from
graphite-base/2305
to
ava.silver/chore/fix-windows-e2e-node24-ebadf
May 4, 2026 19:52
1 task
ava-silver
force-pushed
the
ava.silver/chore/loosen-base-package-version-constraints
branch
2 times, most recently
from
May 4, 2026 20:18
89705a9 to
e694a3e
Compare
ava-silver
marked this pull request as ready for review
May 4, 2026 20:46
Drarig29
approved these changes
May 5, 2026
| try { | ||
| await retryRequest(() => uploadMultipart(requestBuilder, payload, opts.useGzip ?? false), { | ||
| onRetry: opts.onRetry, | ||
| onRetry: opts.onRetry as ((e: unknown, attempt: number) => any) | undefined, |
Contributor
There was a problem hiding this comment.
nit Can we change the definition of UploadOptions.onRetry instead?
Switches @datadog/datadog-ci-base dependencies from exact pinned versions to ^ ranges so that users consuming it as a library can rely on their own lockfiles for version management, rather than being stuck on specific patch versions when vulnerabilities are reported.
Newer minor versions resolved by ^ ranges in the base package have stricter type signatures: async-retry's onRetry now uses unknown instead of Error, and deep-extend requires T extends object constraints. - Cast opts.onRetry in upload helper to satisfy the new async-retry types while keeping the public UploadOptions API unchanged - Use instanceof Error guards in direct retryRequest callers (tag, trace, measure, dora) that access e.message in onRetry callbacks - Add extends object constraint to resolveConfigFromFile generic - Handle undefined parsedConfig in resolveConfigFromFile
plugin-coverage, plugin-deployment, plugin-gate, plugin-junit, plugin-sarif, and plugin-terraform all had the same issue — onRetry callbacks accessing e.message when e is now typed as unknown by the updated @types/async-retry. Use instanceof Error guards consistently.
simple-git 3.34.0+ introduced @simple-git/argv-parser and @simple-git/args-pathspec for argument handling, which causes the Windows e2e tests to hang/be killed mid-run. Pin to ~3.33.0 (patch-only) to avoid this until a fixed minor version is available. All other deps keep ^ ranges as intended.
jest-diff 30.3.0 causes an EBADF: bad file descriptor error in Node 24 on Windows during ESM/CJS module loading. Pin to ~30.2.0 (patch-only) alongside the existing simple-git ~3.33.0 constraint.
The Windows e2e EBADF failure is caused by a GitHub Actions runner image update (git 2.54.0 → 2.53.0), not by these package versions. Corentin's unrelated PR shows the same failure on the same runner image.
ava-silver
force-pushed
the
ava.silver/chore/loosen-base-package-version-constraints
branch
from
May 5, 2026 14:56
e694a3e to
cc2032b
Compare
Base automatically changed from
ava.silver/chore/fix-windows-e2e-node24-ebadf
to
master
May 5, 2026 15:59
ava-silver
deleted the
ava.silver/chore/loosen-base-package-version-constraints
branch
May 5, 2026 16:10
This was referenced May 5, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why?
Loosens version constraints in
@datadog/datadog-ci-basefrom exact pinned versions to^(semver-compatible) ranges. This comes up in context of #2302 -- when users depend on the base package as a library, exact pins mean they get stuck on vulnerable patch versions until we release an update. With^ranges, their lockfiles can resolve newer compatible versions independently.The
@datadog/datadog-cimain package and plugin packages continue to use exact pinning (they're vendored), so this only affects library consumers of the base package.How?
Core change:
@datadog/datadog-ci-basethat uses^ranges, placed before the catch-all exact-pin rule in.syncpackrc.jsondependenciesanddevDependenciesinpackages/base/package.jsonfromx.y.zto^x.y.zTypeScript fixes (required by the
^ranges):The loosened ranges caused yarn to resolve newer minor versions of
@types/async-retry(1.4.8 → 1.4.9) and@types/deep-extend(0.4.31 → 0.4.32), which ship stricter type signatures:@types/[email protected]:onRetrycallback parameter changed from(error: Error)to(e: unknown). Inupload.ts, the publicUploadOptions.onRetrytype is kept asError(no API break) and an internal cast handles the mismatch. In the 9 command/plugin files that callretryRequestdirectly with inlineonRetrycallbacks,e.messageaccesses are updated to useinstanceof Errorguards.@types/[email protected]: generics now requireextends object. Added the constraint toresolveConfigFromFile<T>and handled theundefinedcase fromgetConfig.Review checklist