[BUILD]: Upgrade package ws from 8.20.1 to 8.21.1 - #894
Draft
MacOS wants to merge 2 commits into
Draft
Conversation
MacOS
added
enhancement
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…ock, which downgrades ws again to 8.20.1
MacOS
marked this pull request as draft
July 28, 2026 12:49
michalharakal
added a commit
that referenced
this pull request
Jul 29, 2026
…ugins First slice of #804. Two convention plugins land in build-logic/convention, and three representative modules migrate to prove the shapes. sk.ainet.multiplatform absorbs the Kotlin Multiplatform boilerplate that every library module copies today: the target list, the android { } body, explicitApi(), kotlin-test in commonTest, and the Karma hardening that was duplicated as 23 byte-identical karma.config.d files. The single shared copy now lives at gradle/karma.config.d/ and is wired in via KotlinKarma.useConfigDirectory. Which platforms a module builds comes from the skainet.targets Gradle property rather than the skainet { } DSL. Targets must exist before the module's own kotlin { } block runs -- the source-set convention accessors create source sets on access, and KGP then refuses to attach a compilation to one that already exists ("The compilation 'main' cannot be created after the source set 'jvmMain'"). A DSL block is evaluated too late for that; Gradle properties are readable while the plugin is applied. Everything non-structural stays in skainet { }. sk.ainet.npm-pins closes the Gradle/JS half of #847 and supersedes #894. PR #894 tried to bump ws 8.20.1 -> 8.21.1 (GHSA-96hv-2xvq-fx4p) by editing kotlin-js-store/wasm/yarn.lock, a generated file; kotlinWasmUpgradeYarnLock put it straight back, leaving a zero-line diff. Declaring npm("ws", ...) in a source set would not have worked either, since ws is transitive. The pin is now one npm-ws line in libs.versions.toml, turned into a Yarn resolutions entry in both the JS and Wasm root package.json files; verifyNpmPins reads the committed lockfiles back and fails on drift. Verified: ./gradlew :module:tasks --all is byte-identical before and after for all three pilots; apiCheck passes with no new dumps; publishToMavenLocal plus validate-published-poms.sh reports all 1131 POMs unchanged; both lockfiles regenerate onto ws 8.21.1; verifyNpmPins passes and fails as expected when a lockfile is tampered with; jsTest/wasmJsTest still receive the Karma timeouts; ./gradlew build is green and reuses the config cache. Progresses #804 Closes #847 Supersedes #894
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This
PRupgrade thewspackage from 8.20.1 to 8.21.1 in theyarn.lockfile in directorywasmto improve security.This
PRincreases the security of the project by bumping packagewsto8.21.1, as the currently used version 8.20.1 has a security vulnerability (see GHSA-96hv-2xvq-fx4p). The OpenSSF Score should improve after thisPRhas been merged.