Skip to content

Remove yalc artifact from spec/dummy lockfiles#977

Merged
justin808 merged 2 commits intomainfrom
jg-codex/issue-968-remove-yalc
Mar 16, 2026
Merged

Remove yalc artifact from spec/dummy lockfiles#977
justin808 merged 2 commits intomainfrom
jg-codex/issue-968-remove-yalc

Conversation

@justin808
Copy link
Copy Markdown
Member

@justin808 justin808 commented Mar 15, 2026

Summary

  • replace file:.yalc/shakapacker with the published 9.6.1 dependency in spec/dummy/package.json
  • regenerate both spec/dummy/package-lock.json and spec/dummy/yarn.lock so they no longer reference local .yalc paths
  • verify spec/dummy resolves [email protected]

Testing

  • npm install --package-lock-only --ignore-scripts (in spec/dummy)
  • yarn install --non-interactive (in spec/dummy)
  • npm ls shakapacker (in spec/dummy)

Closes #968.

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Mar 15, 2026

Walkthrough

The pull request updates the shakapacker dependency in the dummy app's package.json from a local yalc reference to a published semantic version range, removing a development artifact.

Changes

Cohort / File(s) Summary
Dependency Update
spec/dummy/package.json
Updated shakapacker dependency from local yalc file reference (file:.yalc/shakapacker) to published semantic version (^9.6.1).

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 The yalc's been packed away with care,
Now shakapacker floats in the air,
From local files to the registry's grace,
Dependencies find their proper place!

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly summarizes the main change: removing yalc artifacts from spec/dummy lockfiles, which is the primary objective of this PR.
Linked Issues check ✅ Passed The PR addresses issue #968 by replacing the local yalc file reference with a published semantic version, removing development artifacts from lockfiles as required.
Out of Scope Changes check ✅ Passed The changes are limited to updating package.json dependency specification, which is directly in scope for removing yalc artifacts as defined in issue #968.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
  • 📝 Generate docstrings (stacked PR)
  • 📝 Generate docstrings (commit on current branch)
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch jg-codex/issue-968-remove-yalc
📝 Coding Plan
  • Generate coding plan for human review comments

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@greptile-apps
Copy link
Copy Markdown
Contributor

greptile-apps Bot commented Mar 15, 2026

Greptile Summary

Cleans up a yalc development artifact that was accidentally committed to spec/dummy. The file:.yalc/shakapacker dependency is replaced with the published ^9.6.1 from npm, and both package-lock.json and yarn.lock are regenerated to resolve from the registry instead of the local .yalc path.

  • Replaced local file:.yalc/shakapacker with ^9.6.1 in spec/dummy/package.json
  • Regenerated spec/dummy/package-lock.json — removes .yalc/shakapacker node entries and resolves [email protected] from npm with integrity hash
  • Regenerated spec/dummy/yarn.lock — cleans up duplicate peer-dependency specifier ranges introduced by the yalc link and adds missing platform-specific optional dependency entries
  • No functional changes to project behavior; this is a lockfile hygiene fix

Confidence Score: 5/5

  • This PR is safe to merge — it's a straightforward cleanup of an accidentally committed local dependency reference.
  • The change is minimal and well-scoped: a single dependency specifier fix in package.json with regenerated lockfiles. The published [email protected] version matches the root package.json version. No code logic changes, no new dependencies, no yalc references remain in the lockfiles.
  • No files require special attention.

Important Files Changed

Filename Overview
spec/dummy/package.json Single-line change replacing local file:.yalc/shakapacker reference with published ^9.6.1 from npm registry. Clean and correct.
spec/dummy/package-lock.json Regenerated lockfile removes .yalc/shakapacker entries and resolves [email protected] from npm registry with proper integrity hash. No yalc references remain.
spec/dummy/yarn.lock Regenerated lockfile resolves shakapacker@^9.6.1 to version 9.6.1 from npm registry. Peer dependency specifier ranges cleaned up (removed yalc-introduced duplicates). Additional platform-specific optional dependencies now properly listed.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["spec/dummy/package.json"] -->|"before: file:.yalc/shakapacker"| B["Local .yalc directory\n(version 9.6.0-rc.3)"]
    A -->|"after: ^9.6.1"| C["npm registry\n([email protected])"]
    A --> D["package-lock.json\n(regenerated)"]
    A --> E["yarn.lock\n(regenerated)"]
    D --> C
    E --> C
    style B fill:#f96,stroke:#333,color:#000
    style C fill:#6f9,stroke:#333,color:#000
Loading

Last reviewed commit: 2286bcc

Comment thread spec/dummy/package.json Outdated
@claude
Copy link
Copy Markdown
Contributor

claude Bot commented Mar 15, 2026

Review

This is a clean, well-scoped fix that removes accidentally-committed yalc artifacts from the repo. The lockfile regenerations look correct — both now resolve shakapacker from the npm registry at 9.6.1 rather than a local .yalc path.

One minor concern: The spec/dummy/package.json engine requirement ("node": ">=18.0.0") is inconsistent with what [email protected] actually requires (>= 20, per the root package.json). This means CI could pass on Node 18 even though the package itself doesn't support it. Worth bumping to >=20.0.0 to stay in sync.

One workflow question (left inline): Using ^9.6.1 points spec/dummy at the published npm package, not the local source. If developers change the JS package and run bundle exec rspec, they'd be testing against the published version. Whether to use `file:../.." instead depends on the intended workflow — happy to discuss if this was a deliberate decision.

@claude
Copy link
Copy Markdown
Contributor

claude Bot commented Mar 15, 2026

Review

Good cleanup — removing the yalc artifact is the right call.

One concern worth discussing: the PR description says it replaces the dependency with ^9.6.1 (caret range), but the actual package.json change uses 9.6.1 (exact pin, no caret). This differs from every other dependency in the file, which all use ^.

More importantly, an exact-pinned published version means:

  • spec/dummy now tests against the published npm package rather than the local source. Any JS changes in this repo won't be reflected in the dummy app until a new version is published and this pin is manually bumped.
  • Each new release requires a manual update here.

Suggested alternative: "shakapacker": "file:../.."} — this references the local npm package (the root package.json), which is what the yalc approach was approximating in the first place. It's cleaner and ensures spec/dummy always tests the current source.

If there's a reason the local-file reference was abandoned (e.g., CI resolution issues), it would be worth documenting that decision. If not, `file:../.." seems like the more correct fix.

Comment thread spec/dummy/package.json
@justin808 justin808 merged commit 73a08bd into main Mar 16, 2026
12 checks passed
@justin808 justin808 deleted the jg-codex/issue-968-remove-yalc branch March 16, 2026 04:43
justin808 added a commit that referenced this pull request Mar 17, 2026
### Summary

Adds the v9.7.0 changelog section with release notes for all
user-visible changes since v9.6.1:

- **Added**: rspack v2 support (PR #975)
- **Fixed**: Config exporter path traversal and annotation format
validation (PR #914)
- **Fixed**: `webpack-subresource-integrity` v5 named export handling
(PR #978, fixes #972)

Version diff links at the bottom of the file are updated accordingly.

### Pull Request checklist

- [x] ~Add/update test to cover these changes~
- [x] ~Update documentation~
- [x] Update CHANGELOG file

### Other Information

Non-user-visible PRs (#920, #965, #970, #971, #977, #979, #981, #982)
were intentionally excluded per changelog policy.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Documentation-only change updating `CHANGELOG.md`; no runtime code or
dependency changes are introduced in this PR.
> 
> **Overview**
> Adds a new `v9.7.0` section to `CHANGELOG.md` documenting user-visible
changes (rspack v2 support and two fixes around config export
security/validation and `webpack-subresource-integrity` v5 exports).
> 
> Updates the compare links at the bottom so `[Unreleased]` now compares
from `v9.7.0`, and adds the new `[v9.7.0]` tag link.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
8942a43. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Added rspack v2 support

* **Bug Fixes**
  * Improved security and validation handling

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 4.6 <[email protected]>
justin808 added a commit that referenced this pull request Mar 18, 2026
## Summary
- replace `file:.yalc/shakapacker` with the published `9.6.1` dependency
in `spec/dummy/package.json`
- regenerate both `spec/dummy/package-lock.json` and
`spec/dummy/yarn.lock` so they no longer reference local `.yalc` paths
- verify `spec/dummy` resolves `[email protected]`

## Testing
- `npm install --package-lock-only --ignore-scripts` (in `spec/dummy`)
- `yarn install --non-interactive` (in `spec/dummy`)
- `npm ls shakapacker` (in `spec/dummy`)

Closes #968.
justin808 added a commit that referenced this pull request Mar 18, 2026
### Summary

Adds the v9.7.0 changelog section with release notes for all
user-visible changes since v9.6.1:

- **Added**: rspack v2 support (PR #975)
- **Fixed**: Config exporter path traversal and annotation format
validation (PR #914)
- **Fixed**: `webpack-subresource-integrity` v5 named export handling
(PR #978, fixes #972)

Version diff links at the bottom of the file are updated accordingly.

### Pull Request checklist

- [x] ~Add/update test to cover these changes~
- [x] ~Update documentation~
- [x] Update CHANGELOG file

### Other Information

Non-user-visible PRs (#920, #965, #970, #971, #977, #979, #981, #982)
were intentionally excluded per changelog policy.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Documentation-only change updating `CHANGELOG.md`; no runtime code or
dependency changes are introduced in this PR.
> 
> **Overview**
> Adds a new `v9.7.0` section to `CHANGELOG.md` documenting user-visible
changes (rspack v2 support and two fixes around config export
security/validation and `webpack-subresource-integrity` v5 exports).
> 
> Updates the compare links at the bottom so `[Unreleased]` now compares
from `v9.7.0`, and adds the new `[v9.7.0]` tag link.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
8942a43. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Added rspack v2 support

* **Bug Fixes**
  * Improved security and validation handling

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 4.6 <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Remove yalc development artifact from spec/dummy/package-lock.json

1 participant