chore(deps): pin axios to 1.8.4 to unblock CI#370
Open
luis-almeida wants to merge 1 commit into
Open
Conversation
lerna bootstrap was running yarn install inside each package and drifting the root node_modules/axios from the locked 1.8.4 to whatever ^1.7.5 currently resolves to (1.16.0), breaking zcli-core/src/lib/auth.test.ts in axios' fetch adapter. Pinning to an exact version removes the drift, and --frozen-lockfile makes future resolver drift a CI failure instead of a silent one.
Contributor
There was a problem hiding this comment.
Pull request overview
Pins axios to an exact version across the monorepo to eliminate version drift introduced by lerna bootstrap during postinstall, restoring CI stability (notably zcli-core/src/lib/auth.test.ts) and ensuring CI fails fast if the lockfile and manifests diverge.
Changes:
- Pin
axiosfrom^1.7.5to1.8.4in all packages that declare it directly. - Update
yarn.lockto reflect the pinnedaxios@1.8.4resolution. - Make CI installs deterministic by switching to
yarn install --frozen-lockfilein the test workflow.
Reviewed changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
yarn.lock |
Updates the locked axios resolution key to include axios@1.8.4. |
packages/zcli-themes/package.json |
Pins axios to 1.8.4 to prevent bootstrap re-resolving. |
packages/zcli-core/package.json |
Pins axios to 1.8.4 to stabilize auth/request behavior under CI. |
packages/zcli-connectors/package.json |
Pins axios to 1.8.4 for consistent installs across packages. |
packages/zcli-apps/package.json |
Pins axios to 1.8.4 for consistent installs across packages. |
.github/workflows/test.yml |
Uses --frozen-lockfile to prevent silent dependency drift in CI. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
|
I'd recommend going with #371, which address the issue with the latest version of |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
All PRs cut after 2026-05-01 have red CI in
zcli-core/src/lib/auth.test.ts. Root cause:lerna bootstrapre-resolvesaxios: ^1.7.5inside each package and overwrites the rootnode_modules/axiosaway from the locked1.8.4. Recent axios releases changed the fetch adapter's error-path handling, breaking the existing test stubs.Pinning axios to an exact
1.8.4removes the drift.1.8.4is also the first version with the fix for CVE-2025-27152 (affects<1.8.2). Adding--frozen-lockfileto CI'syarn installmakes any future resolver drift a hard CI failure instead of a silent one.Timeline
axios: ^1.7.5and switches to axios' fetch adapter. The caret range makes resolution time-dependent.latest. The fetch adapter's error path now touchesresponse.body, which theauth.test.tsstubs don't provide.yarn install→ lerna bootstrap → drift → 4 failures inauth.test.ts. Every PR opened from now on is red until master is fixed.References
N/A
Risks
Low.
1.8.4is what master's last green CI resolved to. Unblocks #369 and every other PR.