From ab98a14e36f8659ff680490084828d83d9302ac2 Mon Sep 17 00:00:00 2001 From: Chen Machluf Date: Wed, 26 Aug 2026 16:56:48 +0300 Subject: [PATCH] fix: pin axios exactly so consumers cannot resolve an uncached release MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A library's lockfile does not constrain its consumers. Deno and Cloudflare Workers resolve `npm:@base44/sdk@x.y.z` against this package.json's range, not against package-lock.json — so `^1.18.1` meant every function redeploy picked whatever 1.x npm had published most recently, even though the lockfile here has always said 1.18.1. That took down generated backend functions today: axios 1.20.0 shipped, redeploys started resolving it, and the Deno runtime runs `--cached-only` against a cache warmed with 1.18.1 — so any edited function 502'd on cold start while untouched warm functions kept serving. It is also a supply-chain gap. `minimumReleaseAge` gives this repo a 7-day cooldown on new releases, but that applies at *our* install time; a consumer resolving a caret at deploy time gets a package published minutes ago with no cooldown at all. The resolved version is unchanged (1.18.1, exactly what the lockfile already pinned), so this is inert for anything installing from the lockfile and only changes what a `npm:` consumer resolves. Co-Authored-By: Claude Opus 5 (1M context) --- package-lock.json | 2 +- package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package-lock.json b/package-lock.json index b36ae31..018dae7 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,7 +9,7 @@ "version": "0.8.44", "license": "MIT", "dependencies": { - "axios": "^1.18.1", + "axios": "1.18.1", "partysocket": "^0.0.23", "socket.io-client": "^4.8.3", "uuid": "^13.0.2" diff --git a/package.json b/package.json index e4afe3f..b666b92 100644 --- a/package.json +++ b/package.json @@ -26,7 +26,7 @@ "create-docs:process": "node scripts/mintlify-post-processing/file-processing/file-processing.js" }, "dependencies": { - "axios": "^1.18.1", + "axios": "1.18.1", "partysocket": "^0.0.23", "socket.io-client": "^4.8.3", "uuid": "^13.0.2"