Repository navigation
fix(dsh-plugin): bump dev cordis 4.0.4 -> 4.0.5 (pnpm lock only) - #3
Merged
Merged
Conversation
cordis-plugin-include@1.0.10 (cordis@4.0.4's optional peer ~1.0.9, also pulled in by dsh-agent-preset-registry) peers on cordis ~4.0.5. npm's strict peer resolver turns that into ERESOLVE; pnpm only warned. 4.0.5 still satisfies every dsh 0.1.7-rc.2 dev package's cordis ~4.0.4 peer, and the plugin's own peer range stays '*'. dsh-plugin is a pnpm package (packageManager pnpm@11.7.0, pnpm-lock.yaml, docs say pnpm install); only pnpm-lock.yaml is re-resolved, no npm lock is added. lib/ build output unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
改动（只动
dsh-plugin/）package.json：devDependencies@deepseek-ai/cordis4.0.4 → 4.0.5（npm latest）。peerDependencies 仍为*，不排除实际安装版本；dsh 0.1.7-rc.2 各 dev 包要求的cordis ~4.0.4仍满足。pnpm-lock.yaml：用 pnpm 11.7.0--lockfile-only重新解析。没有新增package-lock.json。包管理器说明
这个子目录用 pnpm，依据有三条：
packageManager: pnpm@11.7.0；仓库里只有pnpm-lock.yaml和pnpm-workspace.yaml；docs/dsh-plugin.md和dsh-plugin/README.md写的安装步骤都是pnpm install。npm install/npm ci不在支持范围内。原来报的 ERESOLVE 是用 npm 安装时出现的：
cordis-plugin-include@1.0.10要求 peercordis ~4.0.5，而 devDependencies 锁的是 4.0.4，npm 的严格 peer 解析会直接报错。改动前pnpm install --frozen-lockfile本来就能成功（这个 peer 不匹配在 pnpm 下只是警告），所以这次改动的作用是把 dev 依赖对齐到满足 peer 要求的版本，不是修复 pnpm 安装失败。pnpm peers check剩下的缺失 peer（dsh-workspace 等）改动前后完全一样，都是原来就有的。验证
在断网 bwrap 沙箱里跑（
--unshare-net，不挂 /home，env -i，不带凭据）。store 和元数据缓存事先在沙箱外用--ignore-scripts下载好。pnpm install --frozen-lockfile --offlinenode --test testnpm run build的产物和已入库的lib/完全一致，所以 lib 不用更新。