docs: record why msw and jsdom are held below latest - #119
Merged
Conversation
Both are pinned back and nothing in the repo said why. package.json carries a bare version, and the reasoning lived only in a comment on a merged PR. Dependabot re-proposes both weekly, so the next person either re-derives the investigation or lands the bump and breaks CI again. Both failures are the kind that produce no assertion to point at: msw 2.15.0 aborts the Node process mid-teardown via a libuv assertion, so tests vanish with their worker and the suite just reports a lower file count; jsdom 30 returns an empty NodeList for a valid selector, so Vue Test Utils assertions pass vacuously. Each entry therefore carries a paste-and-run reproduction and the condition for releasing the hold, not just a version number.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
frontend/package.jsonpinsmswat 2.7.3 andjsdomat 26.1.0, and nothing in the repo said why. The reasoning existed only in a comment on merged PR #108 and in open PR #110.Dependabot re-proposes both weekly, so the cost of not writing this down is paid repeatedly: either someone re-derives the investigation, or the bump lands and breaks CI again.
Why these two need more than a version number
Both fail in a way that produces no assertion to point at:
169 passed (172)with no failure message. Isolating it took several full-suite runs.NodeListfor a valid selector, so Vue Test Utilsfind(...).exists()assertions pass vacuously. Rewriting the one visible assertion would turn CI green while hiding an unknown number of silent passes — which is exactly why that hold is not a workaround.So each entry carries a paste-and-run reproduction and an explicit release condition, not just blocked.
Changes
docs/dependency-holds.md— new. One entry per hold: evidence, reproduction, how it was isolated, and when to release. States that stale entries must be deleted.frontend/CLAUDE.md— a short section above Commands pointing at it, so the warning is where someone reaching for a bump will actually be.No code or dependency changes.