Skip to content

dep-check 0.9.1: the org audit read the pre-0.9.0 drift shape - #26

Merged
usetheodev merged 1 commit into
mainfrom
workspace
Aug 27, 2026
Merged

dep-check 0.9.1: the org audit read the pre-0.9.0 drift shape#26
usetheodev merged 1 commit into
mainfrom
workspace

Conversation

@usetheodev

Copy link
Copy Markdown
Contributor

Releases @theokit/dep-check@0.9.1. Follow-up to #24, fixing something 0.9.0 introduced.

What 0.9.0 broke

It gave ceilingDrift a direction field and taught check C to use it. ceilingDrift has a second caller — dep-check audit, the organisation-wide sweep — and that one was left reading the old shape.

A published package whose floor sits above latest would have printed:

[contract] @theokit/sat@1.0.0  peerDependencies  @theokit/sdk  >=99.0.0  latest 4.59.0 (undefined behind)

undefined behind, filed under contract — the exact mislabelling 0.9.0 set out to remove, surviving in the one command that sweeps packages no repository in this checkout contains.

After

[unpublished] @theokit/sat@1.0.0  peerDependencies  @theokit/sdk  >=99.0.0  latest 4.59.0 (nothing published satisfies this)

Same three-way severity as check C, same wording.

How it was caught

Not by a test — by asking, before calling the work done, which commands ceilingDrift reaches and whether they all read the new shape. The audit is not part of the per-repository gate, so nothing would have exercised it until someone ran a scope-wide sweep, and by then undefined behind would have read as a finding rather than as a defect in the reporter.

Sixth defect of this family the gate has produced today, and the first I introduced while fixing the fifth.

0.9.0 gave `ceilingDrift` a `direction` and taught check C to use it. The
organisation-wide audit calls the same function and was left reading the old
shape, so a published package whose floor sits above `latest` would have
printed `(undefined behind)` and been filed under `contract` — the exact
mislabelling 0.9.0 set out to remove, surviving in the one command that
sweeps packages no repository here contains.

Caught before it ran anywhere: the audit is not part of the per-repository
gate, so nothing would have exercised it until someone swept the scope.

Refs #24
@usetheodev
usetheodev merged commit 878707f into main Aug 27, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants