fix(deps): dedupe picomatch@4.0.7 entries in pnpm-lock.yaml - #437
Conversation
Rebase-merging #436 and #434 back to back let git text-merge two lockfile diffs that each added picomatch@4.0.7; the result carries the entry twice in both the packages and snapshots sections, and pnpm rejects the file outright (ERR_PNPM_BROKEN_LOCKFILE: duplicated mapping key), breaking every --frozen-lockfile install on develop. The duplicated blocks are byte-identical, so removing the second occurrence restores exactly what a proper lockfile merge would have produced. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
🟢 Approval recommended
The change cleanly removes duplicated lockfile keys and leaves a single picomatch@4.0.7 entry per section, resolving the broken-lockfile error.
Pull request overview
Fixes a broken pnpm-lock.yaml on develop caused by a text-merge that duplicated the picomatch@4.0.7 mapping keys, which prevents pnpm install --frozen-lockfile from working.
Changes:
- Removes the duplicate
picomatch@4.0.7entry under thepackages:section. - Removes the duplicate
picomatch@4.0.7entry under thesnapshots:section.
File summaries
| File | Description |
|---|---|
| pnpm-lock.yaml | Deduplicates picomatch@4.0.7 keys in packages and snapshots to restore a valid lockfile. |
Review details
Copilot wasn't able to review any files in this pull request.
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
- Files reviewed: 0/1 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
A qs advisory published today (DoS via attacker-controlled isBuffer, GHSA-x5fp-wj9c-mxmx / GHSA-4mjr-xmp4-gh2g, vulnerable <6.16.0) trips the pnpm audit gate on every branch, via templates/standalone>express>qs. express's range already admits 6.16.0, so this is a lockfile-only bump. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Added a second commit bumping transitive qs 6.15.3 → 6.16.0: a qs advisory published today (GHSA-x5fp-wj9c-mxmx, DoS, <6.16.0 vulnerable) trips the audit gate on every branch, so the dedupe alone could not go green. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #437 +/- ##
========================================
Coverage 96.01% 96.01%
========================================
Files 151 151
Lines 5750 5750
Branches 1791 1791
========================================
Hits 5521 5521
Misses 229 229
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
develop's lockfile is broken after the back-to-back rebase-merges of #436 and #434: git text-merged two diffs that each added
picomatch@4.0.7, leaving the key duplicated in both thepackages:andsnapshots:sections. pnpm rejects the file (ERR_PNPM_BROKEN_LOCKFILE: duplicated mapping key), so everypnpm install --frozen-lockfileon develop fails — this is also why #435's post-rebase CI run went red at the install step.The duplicated blocks are byte-identical; this removes the second occurrence of each, restoring what a proper lockfile merge would have produced.
🤖 Generated with Claude Code