From f6ef2b7a12169689664eb4feafe39cc0b33b8b6a Mon Sep 17 00:00:00 2001 From: merge-check <140916359+agentHits@users.noreply.github.com> Date: Sun, 1 Nov 2026 08:45:19 -0500 Subject: [PATCH] fix(deps): keep one copy of @trpc/server and undici across the workspace The daily dependency update (deps/auto-update) failed its tests: every router test that expects a TRPCError got "expected TRPCError to be an instance of TRPCError". apps/dokploy declares `@trpc/server` as `^11.19.0`, packages/server as the exact `11.19.0`. The update moved the range to 11.22.1 and left the exact version alone, so the lockfile kept two copies: packages/server threw TRPCError from 11.19.0 and the router and tests checked against the class from 11.22.1. That also breaks how tRPC maps such errors to HTTP status codes. packages/server now declares `@trpc/server` as `^11.19.0` and `undici` as `^8.12.3`, the ranges apps/dokploy already uses. undici had the same split (`^8.12.3` against `8.12.3`) and would have forked on its next release. The installed versions do not change here; the next daily update moves each package in both places to one version. The exact pins came from upstream, where packages/server pins most packages. CLAUDE.md notes the rule: a package that packages/server and an app both declare takes the same range in both. Checks: bun install --frozen-lockfile; bun run typecheck; the update the daily workflow runs (bun update --recursive, one-day release age) on top of this change leaves one @trpc/server and one undici in bun.lock, and the two test files that failed on deps/auto-update, env/blind-env-router.test.ts and git-provider/git-provider-idor.test.ts, pass on it. Co-Authored-By: Claude Opus 5.5 --- CLAUDE.md | 1 + bun.lock | 4 ++-- packages/server/package.json | 4 ++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index d4fb07b004d..a558551d836 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -23,6 +23,7 @@ One GitHub release `agenthits-vX.Y.Z` covers a batch of work, not a single PR (o - Held packages stay pinned to exact versions (`better-auth`, `@better-auth/*`, `better-call`, `@better-fetch/fetch`, `stripe`, `@stepperize/react`, `@dokploy/trpc-openapi`) or `~` (`ssh2`), in their `package.json` and in the root `overrides`, so the workflow does not move them. Keep new holds pinned the same way. - Every other root override is a range `>= ` (for `0.x`, ``), so the override keeps the fixed floor and the workflow still moves the package. A security override follows the same form; an exact version there freezes the package and can silently override a newer direct dependency. +- A package that `packages/server` and an app both declare takes the same range in both (`@trpc/server`, `undici`). With an exact version on one side and a range on the other, the daily update moves only the range and the lockfile keeps two copies; `instanceof` across them then fails, as a `TRPCError` thrown in `packages/server` did in the router tests. - Major updates are done by hand, one PR each (the `dokploy-upgrader` agent), with `bun add @ --minimum-release-age=86400`. - The one-day age is `minimumReleaseAge` in `bunfig.toml` and `MIN_RELEASE_AGE` in the workflow; change both together. - A commit pushed to the branch of the open PR stops its daily rebuild until the PR is merged or closed. diff --git a/bun.lock b/bun.lock index 434f6ae2d99..16c08129de2 100644 --- a/bun.lock +++ b/bun.lock @@ -238,7 +238,7 @@ "@oslojs/crypto": "1.0.1", "@oslojs/encoding": "1.1.0", "@react-email/components": "^1.0.12", - "@trpc/server": "11.19.0", + "@trpc/server": "^11.19.0", "adm-zip": "^0.6.1", "ai": "^7.0.154", "ai-sdk-ollama": "^4.6.0", @@ -273,7 +273,7 @@ "slugify": "^1.6.9", "ssh2": "~1.16.0", "toml": "5.0.1", - "undici": "8.12.3", + "undici": "^8.12.3", "ws": "8.22.0", "yaml": "2.9.1", "zod": "^4.6.7", diff --git a/packages/server/package.json b/packages/server/package.json index 10388d8493a..6d0ce188a20 100644 --- a/packages/server/package.json +++ b/packages/server/package.json @@ -60,7 +60,7 @@ "@oslojs/crypto": "1.0.1", "@oslojs/encoding": "1.1.0", "@react-email/components": "^1.0.12", - "@trpc/server": "11.19.0", + "@trpc/server": "^11.19.0", "adm-zip": "^0.6.1", "ai": "^7.0.154", "ai-sdk-ollama": "^4.6.0", @@ -95,7 +95,7 @@ "slugify": "^1.6.9", "ssh2": "~1.16.0", "toml": "5.0.1", - "undici": "8.12.3", + "undici": "^8.12.3", "ws": "8.22.0", "yaml": "2.9.1", "zod": "^4.6.7"