-
Notifications
You must be signed in to change notification settings - Fork 109
Fix pipeline #1535
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix pipeline #1535
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -7,7 +7,6 @@ | |
| '@xchainjs/xchain-ethereum': patch | ||
| '@xchainjs/xchain-litecoin': patch | ||
| '@xchainjs/xchain-bitcoin': patch | ||
| 'xchainjs-estimate-swap': patch | ||
| '@xchainjs/xchain-cosmos': patch | ||
| '@xchainjs/xchain-kujira': patch | ||
| '@xchainjs/xchain-wallet': patch | ||
|
|
@@ -17,16 +16,12 @@ | |
| '@xchainjs/xchain-util': patch | ||
| '@xchainjs/xchain-bsc': patch | ||
| '@xchainjs/xchain-evm': patch | ||
| 'xchainjs-liquidity': patch | ||
| 'xchainjs-check-tx': patch | ||
| 'xchainjs-loans': patch | ||
| 'txJammer': patch | ||
| --- | ||
|
|
||
| Fix ESM (ECMAScript Module) compatibility issues | ||
|
|
||
| - Update bignumber.js to 9.1.2 for proper ESM support | ||
| - Change bitcore-lib-cash imports from namespace to default imports for ESM compatibility | ||
| - Change bitcore-lib-cash imports from namespace to default imports for ESM compatibility | ||
| - Change @dashevo/dashcore-lib imports from namespace to default imports for ESM compatibility | ||
| - Add .js extensions to coinselect/accumulative imports for ESM | ||
| - Add .js extensions to cosmjs-types imports for ESM | ||
|
Comment on lines
26
to
27
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 💡 Verification agent 🧩 Analysis chainAudit repo for missing .js extensions on ESM-only paths. Ensure all coinselect/accumulative and cosmjs-types imports include .js where required. Run: 🏁 Script executed: #!/bin/bash
# Find potential imports missing ".js" for the noted modules
rg -nP --type=ts --type=tsx --type=js --type=mjs $'from\\s+[\'"](coinselect/accumulative|cosmjs-types[^\'"]*)[\'"]' -SLength of output: 27 🏁 Script executed: #!/bin/bash
set -uo pipefail
echo "Searching repository for imports/requires/dynamic-imports referencing coinselect/accumulative or cosmjs-types (looking for missing .js extensions)..."
# Search common source file extensions (ts, tsx, js, mjs, jsx)
rg -nP -S -g '**/*.{ts,tsx,js,mjs,jsx}' "from\s+['\"][^'\"]*(?:coinselect/accumulative|cosmjs-types[^'\"]*)['\"]" || true
rg -nP -S -g '**/*.{ts,tsx,js,mjs,jsx}' "require\(['\"][^'\"]*(?:coinselect/accumulative|cosmjs-types[^'\"]*)['\"]\)" || true
rg -nP -S -g '**/*.{ts,tsx,js,mjs,jsx}' "import\(['\"][^'\"]*(?:coinselect/accumulative|cosmjs-types[^'\"]*)['\"]\)" || true
echo "Search complete."Length of output: 1037 Add missing .js extension to a cosmjs-types import
🤖 Prompt for AI Agents |
||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -41,7 +41,7 @@ | |
| "@xchainjs/xchain-util": "workspace:*", | ||
| "@xchainjs/xchain-utxo": "workspace:*", | ||
| "@xchainjs/xchain-utxo-providers": "workspace:*", | ||
| "axios": "^1.8.4", | ||
| "axios": "1.12.1", | ||
| "bitcoinjs-lib": "^6.1.7", | ||
| "coinselect": "3.1.12", | ||
| "ecpair": "2.1.0" | ||
|
Comment on lines
+44
to
47
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 💡 Verification agent 🧩 Analysis chainLGTM: dependency pin to 1.12.1. No further changes needed here. If this package is consumed by others, double-check the workspace lockfile yields a single axios copy. (cdnjs.com) 🏁 Script executed: #!/bin/bash
# Verify only one version of axios is locked
fd -a 'yarn.lock' -x rg -n '^axios@' {}Length of output: 0 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "1) Show axios entry in packages/xchain-litecoin/package.json (if present):"
rg -n -C2 '"axios"\s*:' packages/xchain-litecoin/package.json || true
echo
echo "2) Find any package.json that mentions axios (dependencies/devDependencies/peerDependencies):"
rg -n --hidden --no-ignore-vcs -S '"axios"\s*:\s*".+?"' || true
echo
echo "3) Inspect lockfiles for axios entries (yarn.lock, package-lock.json, pnpm-lock.yaml, npm-shrinkwrap.json):"
find . -type f \( -name 'yarn.lock' -o -name 'package-lock.json' -o -name 'pnpm-lock.yaml' -o -name 'npm-shrinkwrap.json' \) -print 2>/dev/null | while read -r lock; do
echo "---- $lock ----"
rg -n --hidden --no-ignore-vcs -S 'axios@|\"axios\"|axios-[0-9]+\.[0-9]+\.[0-9]+' "$lock" || true
done
echo
echo "4) Heuristic: list distinct axios version strings found anywhere:"
rg -o --hidden --no-ignore-vcs -S 'axios@?([^\s:,"]*?)([0-9]+\.[0-9]+\.[0-9]+)' || true
rg -o --hidden --no-ignore-vcs -S 'axios-[0-9]+\.[0-9]+\.[0-9]+' || trueLength of output: 2900 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "Looking for lockfiles..."
locks=$(find . -type f \( -name 'yarn.lock' -o -name 'package-lock.json' -o -name 'pnpm-lock.yaml' -o -name 'npm-shrinkwrap.json' \) -print)
if [ -z "$locks" ]; then
echo "No lockfiles found."
exit 0
fi
for lock in $locks; do
echo
echo "---- $lock ----"
# Show any lines that mention axios with small context
rg -n --hidden --no-ignore-vcs -F 'axios' "$lock" -C3 || true
echo
# If yarn.lock, print entire axios blocks (entry + next 8 lines) to capture 'version' lines
if [[ "$(basename "$lock")" == "yarn.lock" ]]; then
echo "Axios blocks from yarn.lock (entry + 8 lines):"
sed -n '/^axios@/,+8p' "$lock" || true
echo
echo "Distinct semver strings found in those axios blocks:"
sed -n '/^axios@/,+8p' "$lock" | rg -oE '([0-9]+\.[0-9]+\.[0-9]+)' | sort -u || true
else
echo "Heuristic: distinct semver strings near axios occurrences in $lock:"
# show semver candidates near lines containing axios
rg -n --hidden --no-ignore-vcs -F 'axios' "$lock" -C3 | rg -oE '([0-9]+\.[0-9]+\.[0-9]+)' | sort -u || true
fi
echo "---- end $lock ----"
done
echo
echo "Also listing package.json files that declare axios and their declared ranges:"
rg -n --hidden --no-ignore-vcs -S '"axios"\s*:\s*".+?"' || trueLength of output: 16172 Unify axios to a single version in the workspace lockfile yarn.lock contains axios versions 1.12.1, 1.10.0, 1.9.0 and 1.7.7. Most packages under packages/* pin "axios":"1.12.1" but examples/frameworks/vite-example/package.json uses "^1.6.1" and transitive deps (e.g. @ledgerhq/*) pull older versions. Add a root-level resolution or update the conflicting deps and run yarn install/dedupe; verify yarn.lock resolves only axios@1.12.1. 🤖 Prompt for AI Agents |
||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -35,7 +35,7 @@ | |
| "@xchainjs/xchain-client": "workspace:*", | ||
| "@xchainjs/xchain-mayamidgard": "workspace:*", | ||
| "@xchainjs/xchain-util": "workspace:*", | ||
| "axios": "^1.8.4", | ||
| "axios": "1.12.1", | ||
| "axios-retry": "^3.9.1" | ||
|
Comment on lines
+38
to
39
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 💡 Verification agent 🧩 Analysis chainGood pin: axios 1.12.1 fixes known CVEs and improves determinism.
Run to ensure no leftovers and a single hoisted version: 🏁 Script executed: #!/bin/bash
# Show all axios specifiers not equal to "1.12.1"
rg -nP --glob '!**/node_modules/**' '"axios"\s*:\s*"(?!1\.12\.1)[^"]+"' -C2
# Inventory all axios versions across the repo
rg -nP --glob '!**/node_modules/**' '"axios"\s*:\s*"[^"]+"' | awk -F: '{print $1": "$0}' | sed -E 's/.*"axios":\s*"([^"]+)".*/\1/' | sort -u
# Check for multiple axios versions in lockfiles (if present)
fd -a 'yarn.lock' -x rg -n 'axios@' {}
fd -a 'pnpm-lock.yaml' -x rg -n 'axios@' {}
fd -a 'package-lock.json' -x rg -n '"axios@' {}Length of output: 575 Enforce a single hoisted axios@1.12.1 — lockfile contains older versions Good pin: axios 1.12.1 fixes known CVEs and improves determinism.
🤖 Prompt for AI Agents |
||
| }, | ||
| "devDependencies": { | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
💡 Verification agent
🧩 Analysis chain
Default import for bitcore-lib-cash may be unsafe.
If bitcore-lib-cash is CommonJS, default imports require TS esModuleInterop/syntheticDefaultImports or an actual ESM default export. Please confirm the library/version and tsconfig flags.
🌐 Web query:
💡 Result:
No. bitcore-lib-cash is published as CommonJS (package.json has "main":"index.js" and no "module"/ESM export) and its type defs use export = (CommonJS style). Import with require() or a named/namespace import (e.g. import * as bitcore from 'bitcore-lib-cash') rather than a native default ESM import. [1][2]
Sources:
[1] package.json from the published package (shows "main": "index.js" and no "module" field). [unpkg]. (app.unpkg.com)
[2] DefinitelyTyped / @types/bitcore-lib-cash indicates CJS-style export (= export =). (npmjs.com)
Citations:
Don't switch bitcore-lib-cash to a default ESM import — it's CommonJS
bitcore-lib-cash is published as CommonJS (package.json only has "main" and types use
export =), soimport bitcore from 'bitcore-lib-cash'is unsafe. Revert/update the changeset entry (.changeset/ripe-heads-stop.md lines 24–25) and either keep the namespace import (import * as bitcore from 'bitcore-lib-cash'), enable esModuleInterop/allowSyntheticDefaultImports in tsconfig, or only switch once the package provides an ESM default export. Confirm which approach you choose.🤖 Prompt for AI Agents