Repository navigation
build(npm): Bump optional dependencies in lockfile to 3.8.2 - #3463
Merged
Merged
Conversation
Co-Authored-By: Daniel Szoke <7881302+szokeasaurusrex@users.noreply.github.com>
szokeasaurusrex
approved these changes
Oct 28, 2026
szokeasaurusrex
requested review from
JPeer264
and removed request for
stephanie-anderson
October 28, 2026 14:04
BYK
enabled auto-merge (rebase)
October 28, 2026 14:08
szokeasaurusrex
added a commit
that referenced
this pull request
Nov 3, 2026
Stops `master` from going red after every release because `package-lock.json` falls behind the `@sentry/cli-*` optional dependency versions in `package.json`. Until now, the release commit bumped `package.json` and a Craft post-release step bumped the lockfile later, once npm listed the new platform packages. That step depends on how fast npm lists them. `@sentry/cli-linux-arm64` has been taking anywhere from about 15 minutes (3.8.1) to 56 minutes (3.8.2) to appear after publish. For 3.8.2 the 30-minute wait from #3451 ran out, so the lockfile never got bumped (fixed by hand in #3463). `bump-version.sh` now writes the new version into the lockfile entries in the same release commit. Each entry gets only `version` and `optional`. These entries don't need npm to resolve anything, so they can be written before the packages exist. If a version isn't on npm yet, `npm ci` warns and skips that optional package instead of failing. The script exits if the lockfile is ever moved off lockfileVersion 1, so a format change can't silently skip the bump. Since the lockfile is in sync from the start: - `scripts/post-release.sh` and the `postReleaseCommand` in `.craft.yml` are removed. Craft skips the post-release step when the script is missing. - Release-branch CI in `test_node.yml` now uses `npm ci` like everything else, without the `npm install --omit=optional` and `napi-postinstall` workaround. It also checks that the lockfile is in sync before publishing. <!-- junior-request-attribution:start --> via @szokeasaurusrex. <!-- junior-request-attribution:end --> <!-- junior-session-footer:start --> <!-- junior-conversation-id:slack%3AC0C01CK9SG2%3A1793196002.139839 --> -- [View Junior Session](https://junior-prod.sentry.dev/conversations/slack%3AC0C01CK9SG2%3A1793196002.139839) [[Sentry]](https://sentry.sentry.io/explore/conversations/slack%3AC0C01CK9SG2%3A1793196002.139839/?project=4510944073809921) <!-- junior-session-footer:end --> Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com> Co-authored-by: Daniel Szoke <7881302+szokeasaurusrex@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the Node CI jobs on
master, which have failed since the 3.8.2 release becausepackage-lock.jsonstill pins the@sentry/cli-*optional dependencies to 3.8.1.The 3.8.2 post-release step never committed the lockfile bump. It timed out after 30 minutes waiting for
@sentry/cli-linux-arm64@3.8.2to show up on npm. Craft published that package at 11:01 UTC, but npm only listed it at 11:57 UTC. This PR reruns the samenpm install --package-lock-only --ignore-scripts --prefer-onlinenow that all platform packages are available.via @szokeasaurusrex.
--
View Junior Session [Sentry]