fix(ci): sync the lockfile with 2.0.3 - #21
Merged
Merged
Conversation
`npm ci` failed on every job, main included:
Invalid: lock file's image-and-video-compressor@2.0.2
does not satisfy image-and-video-compressor@2.0.3
Cause: the 2.0.3 release pinned mcp/ to ^2.0.3 while 2.0.3 did not exist
on the registry yet. mcp/ resolves that dependency from npm rather than
from this repo, so the constraint was unsatisfiable, `npm install` left
the lock entry at 2.0.2, and `npm ci` — which is strict where install is
forgiving — rejected the mismatch.
The pin was right, the order was wrong: it should have been published
first and pinned second. 2.0.3 is on the registry now, so the lock
resolves cleanly.
Verified with the exact command CI runs: `npm ci` exits 0, both packages
build, 184 tests pass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CI is red on
mainand every open PR. This fixes it.The failure
Every job fails at
npm ci, so nothing downstream ever ran.Cause
The 2.0.3 release pinned
mcp/to^2.0.3while 2.0.3 did not exist on the registry yet.mcp/resolvesimage-and-video-compressorfrom npm, not from this repo — the root package is the workspace root, not a workspace member, so there is no local link. With the target version unpublished the constraint was unsatisfiable:npm installleft the lock entry at 2.0.2, andnpm ci, which is strict whereinstallis forgiving, refused it.The pin itself was correct — the MCP schema promises "never enlarges", which only holds from 2.0.3. The order was wrong: publish first, pin second. 2.0.3 is on the registry now, so the lock resolves.
Verified
With the exact command CI runs, not an approximation:
npm ci→ exit 0Related finding, not fixed here
Because
mcp/resolves its dependency from the registry, the MCP tests exercise the published library, not this branch'ssrc/. A library change that breaks the MCP server would not be caught until after publishing.That is a real gap and deserves its own decision rather than a rushed fix — the clean solution is restructuring into
packages/core+packages/mcpso the dependency links locally, which is a bigger change than a CI hotfix should carry.