From 15997a06d07e387eb50fc620b1f2cbc47d739043 Mon Sep 17 00:00:00 2001 From: Mohamed Boudra Date: Wed, 4 Nov 2026 21:54:29 +0700 Subject: [PATCH] fix(ci): pin semver away from incomplete attestations (#8787) The pkijs lockfile regeneration bumped tiny-async-pool's semver to 5.7.3 and app-builder-lib's @electron/get semver to 6.3.2, both published 2026-11-02 in one batch. Some Cloudflare edges cached the attestation document for 5.7.3 before the publish attestation attached, so `npm audit signatures` fails with EMISSINGSIGNATUREKEY depending on the runner's region. Pin both back to the 2023 releases with per-parent, range-keyed overrides so global-agent's semver ^7 under @electron/get is left alone. --- docs/development.md | 11 ++++++++++- package-lock.json | 12 ++++++------ package.json | 8 +++++++- 3 files changed, 23 insertions(+), 8 deletions(-) diff --git a/docs/development.md b/docs/development.md index 5c891b2121..ddebf3ffff 100644 --- a/docs/development.md +++ b/docs/development.md @@ -594,7 +594,16 @@ rerun passes only by landing elsewhere. To confirm, fetch the URL from several runners and compare `content-length`, the `cf-ray` colo suffix, and the number of `attestations` entries (#7730 has the probe). To fix, remove or replace that version in the lockfile. If the dependent’s range cannot be changed, pin a clean -version in root `overrides` and regenerate the lockfile. Report the URL to npm so they purge it. +version in root `overrides`. Report the URL to npm so they purge it. + +A lockfile regeneration is itself how new bad versions enter: the pkijs fix re-resolved the +electron-builder tree and pulled in `semver` 5.7.3 and 6.3.2, published two days earlier, and +5.7.3 then failed the same way. After editing `overrides`, run `npm install --package-lock-only` +and check that the changed `resolved` lines in `package-lock.json` are only the ones you meant. + +A per-parent override such as `"tiny-async-pool": { "semver": "5.7.2" }` applies to that +parent's whole subtree, so it can also downgrade a grandchild that needs a different major. Key +the child by range (`{ "semver@^5": "5.7.2" }`) so only matching edges are replaced. ## ACP provider catalog versions diff --git a/package-lock.json b/package-lock.json index 7e561ceb9d..f1cbf595c3 100644 --- a/package-lock.json +++ b/package-lock.json @@ -15088,9 +15088,9 @@ } }, "node_modules/app-builder-lib/node_modules/@electron/get/node_modules/semver": { - "version": "6.3.2", - "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.2.tgz", - "integrity": "sha512-GYrCADwpu6yV5OAvchkQ27Z5wwMxWAEMg5NNWjyHh/5DboFFqbdbvYNIvZouQpxXyeMPoTOh0vdPYKlf0ZswdQ==", + "version": "6.3.1", + "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz", + "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==", "dev": true, "license": "ISC", "bin": { @@ -35100,9 +35100,9 @@ } }, "node_modules/tiny-async-pool/node_modules/semver": { - "version": "5.7.3", - "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.3.tgz", - "integrity": "sha512-kM18BPOqTi0+TB68703/GJRpAML5Me+IDQsR1J26YB3EFKKNEyHIVZuWDX7+WKQB3tHwDwgk24BfhdpWUbytvQ==", + "version": "5.7.2", + "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz", + "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==", "dev": true, "license": "ISC", "bin": { diff --git a/package.json b/package.json index b017f0b106..83f56c1d31 100644 --- a/package.json +++ b/package.json @@ -149,6 +149,9 @@ "overrides": { "@codemirror/language": "6.12.4", "@codemirror/view": "6.43.6", + "@electron/get@^3.0.0": { + "semver@^6": "6.3.1" + }, "expo": "~57.0.30", "expo-router": "~57.0.28", "lightningcss": "1.30.1", @@ -158,6 +161,9 @@ "react-native": "0.86.3", "react-native-gesture-handler": "~2.32.0", "react-native-reanimated": "4.5.5", - "react-native-worklets": "0.10.4" + "react-native-worklets": "0.10.4", + "tiny-async-pool": { + "semver@^5": "5.7.2" + } } }