Repository navigation
chore(deps): bump better-auth 1.6.28 → 1.7.2 on a single-tree lockfile (supersedes #7053) - #8332
Merged
Merged
Conversation
Supersedes the dependabot bump, which carried a regenerated lockfile that
moved 46 package identities: it downgraded the whole `@objectstack/*` family
17.3.0 -> 17.2.0 and forked zod, putting two physical `@objectstack/spec`
copies in the console bundle (+1738.1 KB eager closure, `Bundle Analysis` red)
and breaking `scripts/__tests__/ci-cd-pipeline-doc.test.ts`.
The lockfile here is regenerated from current `main` and moves exactly 8
package identities -- `better-auth` and its seven `@better-auth/*`
subpackages, all 1.6.28 -> 1.7.2. Nothing else moves.
Verified at this head, from the repo root:
- one physical `@objectstack/spec` (17.3.0), zod unchanged at 3.25.76 + 4.4.3
- `pnpm install --lockfile-only` is idempotent on this lockfile (byte-identical)
- eager closure 3472.0 KB vs 3471.9 KB on the base -- `vendor-objectstack`
is the same 4,030.56 kB chunk with the same content hash
- `scripts/__tests__/ci-cd-pipeline-doc.test.ts` 46/46
- `packages/auth` 24 files / 251 tests, and its `type-check`
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TezFG8ZMrNH6n5VTNpPpdH
Contributor
✅ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. 📦 Bundle Size Report
Size Limits
|
Contributor
Author
|
os-dev-report {
"issue": 8326,
"status": "done",
"branch": "claude/issue-8326-better-auth-172-single-tree",
"pr": "https://github.com/objectstack-ai/objectui/pull/8332",
"premise_still_valid": true,
"summary": "Superseded dependabot PR #7053 with a clean two-file bump cut from current main (d8ab2dc0): packages/auth/package.json better-auth ^1.6.28 -> ^1.7.2 plus a lockfile regenerated on that base. main HAD moved since the handed-over measurement commit 192d23e3, so the lockfile was regenerated rather than copied, and 192d23e3's extra root-package.json changes (a pnpm.overrides pin of better-auth plus incidental whitespace renormalisation) were deliberately NOT carried: the override would have frozen better-auth against every future dependabot bump, and the whitespace was out of scope. The committed lockfile moves exactly 8 package identities out of 3634 (better-auth and its seven @better-auth/* subpackages, 1.6.28 -> 1.7.2) against dependabot's 46. PR merged through the merge queue as 614d85b1 at 2026-09-07T13:28:54Z; branch auto-deleted. No changeset, per the gate's own verdict and repo precedent. No ceiling raised anywhere.",
"tests": "All from the repo ROOT of /home/user/objectui-8326; heavy runs through the container verify lock, verdicts read from its 'VERDICT command-exit' line, never a bare $?. (1) pnpm install --frozen-lockfile -> exit 0. (2) turbo run build --filter='./packages/*' --concurrency=2 -> 'Tasks: 39 successful, 39 total', VERDICT command-exit 0. (3) pnpm --filter @object-ui/console build -> VERDICT command-exit 0, vendor-objectstack 4,030.56 kB. (4) node scripts/check-eager-closure-budget.mjs -> exit 0, 'Console eager closure is 3472.0 KB gzipped across 50 of 518 chunks (budget: 3512.7 KB, headroom: 40.7 KB)', all 4 per-chunk budgets green. (5) pnpm exec vitest run --project unit scripts/__tests__/ci-cd-pipeline-doc.test.ts -> 'Test Files 1 passed (1)', 'Tests 46 passed (46)'. (6) pnpm exec vitest run packages/auth/ -> 'Test Files 24 passed (24)', 'Tests 251 passed (251)'. (7) pnpm --filter @object-ui/auth type-check -> VERDICT command-exit 0. (8) node scripts/check-control-bytes.mjs -> exit 0, 6621 tracked text files. (9) node scripts/check-changeset-presence.mjs -> exit 0. BASE MEASUREMENT, same commands, separate worktree at unmodified d8ab2dc0: eager closure 3471.9 KB, vendor-objectstack 4,030.56 kB, SAME chunk content hash BGtOe8bo as the head build, i.e. byte-identical vendor chunk; delta on the aggregate is +0.1 KB (0.003%, rounding). SINGLE-RESOLUTION PROOF read off the installed tree, not the lockfile text: find node_modules/.pnpm -maxdepth 1 returns exactly one @objectstack+spec@17.3.0_ai@7.0.65_zod@4.4.3_ directory, and zod@3.25.76 + zod@4.4.3 only (the pre-existing v3/v4 pair, unmoved); zod peer contexts 99x4.4.3 on base and 99x4.4.3 at head. DETERMINISM CONTROL: pnpm install --lockfile-only on unmodified d8ab2dc0 reproduces the committed lockfile byte-identically (git diff --stat empty), so the graph is a property of the change, not resolver drift. IDEMPOTENCE: re-running pnpm install --lockfile-only on the committed lockfile leaves it byte-identical (cmp clean). NEGATIVE/ABLATION-SHAPED READING, run twice in two independent worktrees from a clean d8ab2dc0: a from-scratch float of ^1.7.2 resolves better-auth to 1.7.3 and forks zod, 25x4.4.3 + 89x4.5.4 -- the identity delta 1.7.2 vs 1.7.3 is the 8 better-auth rows plus zod@4.5.4 and nothing else, and neither better-auth manifest declares zod at all, so it is peer-group re-resolution rather than a declared range. Filed as #8333. REMOTE CI on head d4b7b07d: 30 check runs, 27 success / 3 skipped / 0 failure, including Bundle Analysis, all four Test shards (shard 3/4 is the one red on #7053), Changeset Declaration, Governed Surface Queue Guard, Type Check, Lint. Merge queue rebuilt on main and landed it as 614d85b1.",
"mcp_calls": "8 — create_pull_request, search_issues (1 targeted, after the repo-scoped REST search endpoint returned 403 'sessions are bound to their configured repositories'; channel switch declared), issue_write (filed #8333), update_pull_request (draft false), enable_pr_auto_merge x2, add_issue_comment x2 (#7053 supersede notice, this report). All issue/PR READS went through the zero-quota repo-scoped REST channel.",
"open_questions": [],
"out_of_scope_findings": [
"filed as #8333: better-auth 1.7.3 forks zod 4.4.3 -> 4.5.4 across 89 peer contexts on a CLEAN resolve (reproduced twice, two worktrees) — distinct from #8326, whose 'regenerate from a clean base' remedy would not prevent it; #8332 sidesteps it by pinning 1.7.2 in the lockfile, but the next bump of better-auth walks into it",
"not filed, reported here: dependabot's own PR #7053 remains open and cannot be pushed to (it would rebase the fix away). It needs a human to close it — a seat does not close a dependabot PR. A supersede notice was posted on it."
]
}Notes that do not fit the schema:
Generated by Claude Code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #7053 (
chore(deps): Bump better-auth from 1.6.28 to 1.7.2), which cannot go green on its own branch: the correction is lockfile-only and dependabot would overwrite it on its next rebase. Precedent for the pattern: hotcrm#1740 superseding hotcrm#1264. ⛔ Nothing here closes #7053 — a human closes the dependabot PR.Root cause card: #8326 (not addressed here — this PR carries the corrected bump, not the CI lockfile-integrity check that card asks for).
What #7053 actually measured
better-auth 1.7.2 adds zero bytes. The
+1738.1 KBeager-closure regression and theTest (shard 3/4)failure on that branch both come from its regenerated lockfile, which moved 46 package identities: it downgraded@objectstack/client/core/formula/lint/sdui-parser17.3.0 → 17.2.0 and forked zod, leaving two physical@objectstack/speccopies in the tree. Nothing dedupes two real paths, sopackages/specwas bundled twice (vendor-objectstack4,030,557 → 8,423,436 raw bytes, 2.09×). Registry latest is 17.3.0 for all five and nothing in the workspace asks for 17.2.0 — every range is a floating^17.x, so a fresh resolve can never pick 17.2.0. It was a stale resolution carried across a rebase.What this PR changes
Two files, cut from current
main(d8ab2dc0):packages/auth/package.json—better-auth^1.6.28→^1.7.2(byte-identical to dependabot's manifest edit)pnpm-lock.yaml— regenerated on that base, 49 insertions / 49 deletionsThe lockfile moves exactly 8 package identities, and they are all one family:
Full identity set diffed base-vs-head (3,634 identities): those 8 rows and nothing else.
Single-resolution proof
Read off the installed tree, not the lockfile text —
find node_modules/.pnpm -maxdepth 1:@objectstack/spec, at 17.3.0; all seven@objectstack/*packages resolve to a single 17.3.0zod@4.4.3on the base, 99 ×zod@4.4.3here — no forkpnpm install --frozen-lockfileexits 0 at this headpnpm install --lockfile-onlyon the committed lockfile leaves it byte-identical (cmpclean)pnpm install --lockfile-onlyon unmodifiedd8ab2dc0reproduces that lockfile byte-identically (git diff --statempty). So the graph here is a property of the change, not of resolver drift.Before / after — eager closure
Both numbers measured in this container, same base commit, same commands:
d8ab2dc0vendor-objectstackrawvendor-objectstackchunk hashBGtOe8boBGtOe8bovendor-objectstackgzip vs ceiling+0.1 KBon the aggregate is rounding at the 0.003% level; the objectstack vendor chunk is emitted with the same content hash on both sides, i.e. byte-identical. ⛔ No ceiling was raised —scripts/check-eager-closure-budget.mjsis green as committed, with 40.7 KB of aggregate headroom and every per-chunk budget green.Verification at this head (repo root, exit codes captured before any pipe)
pnpm install --frozen-lockfileturbo run build --filter='./packages/*' --concurrency=239 successful, 39 totalpnpm --filter @object-ui/console buildnode scripts/check-eager-closure-budget.mjs✅ Console eager closure is 3472.0 KB … (budget: 3512.7 KB, headroom: 40.7 KB)pnpm exec vitest run --project unit scripts/__tests__/ci-cd-pipeline-doc.test.tsTest Files 1 passed (1)·Tests 46 passed (46)pnpm exec vitest run packages/auth/Test Files 24 passed (24)·Tests 251 passed (251)pnpm --filter @object-ui/auth type-checktsc --noEmit && tsc -p tsconfig.test.json)node scripts/check-control-bytes.mjs✅ OK (6621 tracked text files)node scripts/check-changeset-presence.mjsHeavy runs went through the container's shared verify lock; every verdict above is the lock's own
VERDICT command-exit 0line, not a bare$?.Changeset: none, deliberately
scripts/check-changeset-presence.mjsprints:That is the gate's designed answer, not a loophole: its header states the trade in as many words — the eight guarded manifest fields are
sideEffects,exports,main,module,types,files,peerDependencies,engines, and "dependenciesstaying out is the part of the old trade that is KEPT rather than reversed." Repo precedent agrees: the sibling bumps from this same dependabot batch — #7054 (motion), #7055 (js-yaml), #7056 (i18next), #7059/#7060 (fumadocs) — all landed with no changeset. ⛔ Noskip-changesetlabel either: in this repo the label reads nothing, and the empty-frontmatter declaration is for when the gate does ask.One thing a reviewer should know before merging
The committed lockfile pins better-auth at 1.7.2 under a
^1.7.2range, which is what #7053 names and what pnpm preserves on every subsequentpnpm install(verified: the idempotence run above). But a from-scratch float of^1.7.2today resolves to 1.7.3, and 1.7.3 forks zod:4.4.3stays on the 25 workspace-declared contexts while 89 peer contexts move to4.5.4(ai,@ai-sdk/*,better-call,fumadocs-core,better-authitself). Reproduced twice, in two independent worktrees, from a cleand8ab2dc0. Nothing in the 1.7.3 manifests declares a zod range that excludes 4.4.3 — the identity delta 1.7.2→1.7.3 is the eight better-auth rows pluszod@4.5.4and nothing more — so this is peer-group re-resolution, not a declared constraint. Filed separately; it will be the next dependabot bump's problem, and it is exactly the class #8326 asks CI to catch.🤖 Generated with Claude Code
https://claude.ai/code/session_01TezFG8ZMrNH6n5VTNpPpdH
Generated by Claude Code