Repository navigation
Enforce exact import version constraints matching package.json - #78
Merged
Merged
Conversation
… job Co-authored-by: forevermatt <6233204+forevermatt@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix import statements to include version constraints
Enforce exact import version constraints matching package.json
Aug 19, 2026
…ersions.mjs Co-authored-by: forevermatt <6233204+forevermatt@users.noreply.github.com>
Co-authored-by: forevermatt <6233204+forevermatt@users.noreply.github.com>
…port_versions.mjs Co-authored-by: forevermatt <6233204+forevermatt@users.noreply.github.com>
forevermatt
marked this pull request as ready for review
August 19, 2026 19:49
forevermatt
requested review from
briskt,
ethancanne and
hobbitronics
and removed request for
a team
August 19, 2026 19:49
forevermatt
reviewed
Aug 19, 2026
briskt
approved these changes
Aug 20, 2026
hobbitronics
approved these changes
Aug 24, 2026
This will help us keep the list in package.json current, which helps us know if there are security advisories about any of the dependencies we use.
Using just the major version makes it easier to maintain this, since we won't have to update the import statements merely due to npm updating exact package versions in package.json.
Contributor
|
@briskt and @hobbitronics - Here are the changes I made since you reviewed this PR. It's basically just fixing the check-imported-versions code to also fail on (non-built-in) dependencies not listed in package.json, plus adding some missing dependencies and pinning more dependencies at major versions (so this won't take a lot of manual maintaining as versions change). |
1 of 3 tasks
Contributor
|
@briskt and @hobbitronics - I have made enough changes on this PR that it might merit a 2nd look. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Import specifiers in several JS files used version constraints that didn't match
package.json(or had none at all), meaning automated tests could run against different package versions than Pipedream uses in production.Added
importstatement versions matchFixed
importstatements that didn't match package.json file@pipedream/platformto package.json, pinned at caret-major-versionssh2-sftp-clientto package.json and pin everywhere at ^12@pipedream/platformfor testsPR checklist: