From 95633a228377194aaab9f8d4f1d66bbbb37caf87 Mon Sep 17 00:00:00 2001 From: cliffhall Date: Sat, 5 Sep 2026 17:14:44 -0400 Subject: [PATCH] chore: address Copilot review round 3 (#2226) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two factual corrections, both suppressed comments. - `.claude/skills/local-dev/SKILL.md`: the react/react-dom exception cited "19.2.8 today, against the root's 19.2.7" — a skew this PR removes. Dropped the version pair; the point being made is about which install resolves the pair, and it stands without a number that goes stale on the next bump. - `verify-dep-lockstep.mjs`: the `devDependencies` bullet claimed all four surfaced skews were a devDependency somewhere. `react` is a root runtime dependency whose client copies are peer-installed, so it is three of four — which is a better illustration of why the union spans fields as well as installs, and the bullet now says so. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01J86a6vMcA9csPtdsg7ZcCZ Signed-off-by: cliffhall --- .claude/skills/local-dev/SKILL.md | 2 +- scripts/verify-dep-lockstep.mjs | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.claude/skills/local-dev/SKILL.md b/.claude/skills/local-dev/SKILL.md index 947211e7..5236cb2a 100644 --- a/.claude/skills/local-dev/SKILL.md +++ b/.claude/skills/local-dev/SKILL.md @@ -147,7 +147,7 @@ supposed to rule out. **`react` and `react-dom` are the exception, and stay pinned per client.** They are a matched pair — `react-dom` reaches into React internals — and `react-dom` is still web-declared, so npm resolves it and its React peer together inside -`clients/web/node_modules` (19.2.8 today, against the root's 19.2.7). Pointing +`clients/web/node_modules`. Pointing `react` at the root while `react-dom` resolves from the client would pair a renderer with a React it was not installed against, which is the same split the pin exists to prevent, arrived at from the other side. `dedupe` still collapses diff --git a/scripts/verify-dep-lockstep.mjs b/scripts/verify-dep-lockstep.mjs index 03c54991..9d898027 100644 --- a/scripts/verify-dep-lockstep.mjs +++ b/scripts/verify-dep-lockstep.mjs @@ -283,9 +283,11 @@ export function toleratesSkew(name, holders, tolerated) { * boundary this tier polices is "does the repo name a package npm will install * for us", not "does it ship": * - * • `devDependencies` — the `@types/*` and toolchain case #2226 is about; every - * one of the four skews this tier first surfaced was a devDependency - * somewhere. + * • `devDependencies` — the `@types/*` and toolchain case #2226 is about, and + * three of the four skews this tier first surfaced (`@types/node`, + * `@types/react`, `@vitejs/plugin-react`) were a devDependency somewhere. + * The fourth, `react`, is a root runtime dependency whose client copies are + * peer-installed — which is why the union spans fields as well as installs. * • `optionalDependencies` — a direct declaration npm attempts to install like * any other. Omitting it would leave an optional-only package free to hold * conflicting top-level copies in two installs while this tier reported