GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — ci: keep runtime devDependencies in package check by setchy · Pull Request #3670 · gitify-app/gitify

Conversation

@setchy

@setchy setchy commented Nov 10, 2026

Copy link
Copy Markdown
Member

Problem

The packaged dependency check added in #3665 derives FORBIDDEN_PACKAGES from every devDependency, then fails if any of them is present in app.asar.

semver is both:

  • a renderer devDependency (bundled by Vite), and
  • a transitive runtime dependency of electron-updater ([email protected]).

So Build / Verify packaged dependencies fails on main and on every PR, including #3669:

[FAIL] Packaged dependency surface is invalid:
  - Dev-only package must not ship: semver

Fix

Compute the runtime closure from the dependency metadata of the packages actually in the archive, starting at the declared dependencies. A devDependency is only rejected when it is outside that closure.

Verified with a synthetic app.asar containing electron-updater → semver and a stray react: the check now passes semver and still rejects react. The existing formatter/linter/type/test pre-commit hooks pass.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@setchy
setchy requested a review from afonsojramos as a code owner November 10, 2026 06:34
@github-actions github-actions Bot added the build Build, action or package manager changes label Nov 10, 2026
@setchy
ci: keep runtime devDependencies in package check
2caac17 
The packaged dependency check treats every devDependency in package.json as dev-only. semver is both a renderer devDependency and a transitive runtime dependency of electron-updater, so the check fails every build now that the forbidden list is derived from the project.

Compute the runtime closure from the packaged dependency metadata and only reject devDependencies that are outside it.
@setchy
setchy force-pushed the fix/packaged-dependency-check branch from e13d281 to 2caac17 Compare November 10, 2026 06:46
@sonarqubecloud

sonarqubecloud Bot commented Nov 10, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@setchy setchy closed this Nov 10, 2026
@setchy

setchy commented Nov 10, 2026

Copy link
Copy Markdown
Member Author

Replaced by #3671
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@afonsojramos afonsojramos Awaiting requested review from afonsojramos afonsojramos is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

build Build, action or package manager changes

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

1 participant

@setchy
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.