Land the three Dependabot bumps as one change, with the fixtures they move - #172
Open
silverstein wants to merge 4 commits into
Open
silverstein wants to merge 4 commits into
silverstein wants to merge 4 commits into
Conversation
Dependabot filed these as #48, #128, and #129. All three touch package.json, package-lock.json, and the layout occurrence oracle, so landing them separately means three rebase-and-regenerate cycles where each merge invalidates the next one's lock and fixture. One branch regenerates each artifact once. @modelcontextprotocol/ext-apps 1.7.4 -> 1.7.5 rolldown 1.1.5 -> 1.2.3 vite 8.1.5 -> 8.2.1 All three are devDependencies, so none reaches a shipped artifact. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The oracle binds package.json and package-lock.json by digest, so a bump alone fails ten extraction-phase1-scorer tests. Regenerated with its own generator, never by hand: node scripts/eval-generate-extraction-layout-oracle.mjs --write extraction-phase1-layout-evidence 9/9. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
dist-ui/index.html is a tracked artifact, so a toolchain bump that changes what rolldown emits has to be rebuilt and inspected rather than left stale. Checked against the hazard CLAUDE.md records, because a viewer regression is invisible until someone opens a PDF in Claude Desktop: the Electron host ships an older Chromium, and pdfjs reaching an ES2025 API crashes the viewer while every server-side test stays green. getOrInsertComputed 0 -> 0 (the API that actually crashes it) sumPrecise 18 -> 10 (already shipping, now less of it) bundle 1837347 -> 1836392 bytes pdfjs-dist is untouched at the pinned 5.4.624. Static evidence only: a real Claude Desktop session is still the test that settles it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 19, 2026
mcp-contract asserts the share package's dist-ui/index.html is byte-identical to the source one, so rebuilding the viewer without mirroring it fails the gate on both runtimes. It did: expected 'ba946a27...' to be '95a7c8a7...' The binding is the point of that test, and it caught the omission exactly where it should have. Local runs missed it because this VM was saturated and the full suite could not complete honestly. mcp-contract 43/43, plugin-freshness-coverage, packager-server-coverage, viewer-compat and smoke-mcpb-contract 29/29, share contract reproducible at 44 tools and 122 SBOM components. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lands the three open Dependabot bumps as one change:
@modelcontextprotocol/ext-apps1.7.4 to 1.7.5,rolldown1.1.5 to 1.2.3, andvite8.1.5 to 8.2.1. Supersedes #48, #128, and #129, all three of which wereCONFLICTING/DIRTY.Why one branch. All three PRs touch
package.json,package-lock.json, andtest/fixtures/eval/extraction/phase1/layout-occurrence-oracle.v1.json. Landing them one at a time means three rebase-and-regenerate cycles where each merge invalidates the next one's lock and fixture. One branch regenerates each artifact once and gates once.A coupling all three PRs missed. A lock change has three bindings in this repo, and Dependabot only carried the oracle.
npm run vendor:npm-licensesis required wheneverpackage-lock.jsonmoves, and both artifact builds fail closed if the committed licence evidence does not cover the lock exactly. It came back clean here because all three packages are devDependencies that never reach a shipped artifact, but a runtime bump filed the same way would have failed at build time with the cause several steps upstream. The pinned tool contract is bound to the server version, which does not move here, so it needed no re-pin.The viewer.
dist-ui/index.htmlis a tracked artifact and the new toolchain changes what rolldown emits, so it is rebuilt here rather than left stale. It is also the part of this bump that CI cannot check: the viewer runs inside Claude Desktop's Electron sandbox on an older Chromium, and pdfjs reaching an ES2025 API crashes it while every server-side test stays green. Checked against the specific hazardCLAUDE.mdrecords:getOrInsertComputedsumPrecisegetOrInsertComputedis the API that actually crashes the viewer, and it is absent from both bundles.sumPrecisewas already shipping and the rebuild emits less of it.pdfjs-distis untouched at the pinned 5.4.624.This is static evidence. Opening a PDF in Claude Desktop is the test that settles it, and that check is still owed before this merges.
Verified so far:
extraction-phase1-layout-evidence9/9,sbom-npm-licenses27/27,trajectory-graderversion-pinned tool contract passing, UI build clean on vite 8.2.1. The full suite is left to CI: this VM was running three concurrent embedding jobs at roughly fifteen cores, and local runs under that load fail on 5000ms timeouts that say nothing about the code.🤖 Generated with Claude Code