From 4e35968fd13b6162bcbcdbf69d3f257786020c4a Mon Sep 17 00:00:00 2001 From: Erny Sans Date: Sat, 22 Aug 2026 19:29:15 -0500 Subject: [PATCH] build(deps): advance the shared-helpers pin to keep the graph on one commit Moves the pin from 31ef85e7 (2026-08-20) to 0c9d53a5 (2026-08-22), one commit further on and a clean descendant: 1 ahead, 0 behind. Same rule as the previous alignment, applied again rather than restated. A set of pins is coherent only if it names one commit per package across the whole graph, so the target is chosen to match what the rest of the graph resolves -- not to be current. This is the follow-on half of that earlier change: the previous commit was the one the graph agreed on then, this is the one it agrees on now. Default-branch HEAD was f85e67fd, 7 commits further, at the time of this change. Not taken, and the reason was re-derived rather than carried over from the last pass: those 7 commits touch 4 documentation files and 1 test file, and zero files under src/ or lib/, so HEAD is runtime-identical to 0c9d53a5. That selector was positive-controlled against the 31ef85e7.. 0c9d53a5 range, where it reports 31 src/ and lib/ files -- so the zero is a measurement rather than a pattern that cannot match. "Documentation-only" would have been slightly wrong, hence the file-by-file count: one of the seven is a test. Where HEAD is runtime-identical, matching the graph is the whole tiebreak, and it also carries the smaller unreviewed delta. Measured against this repository's tree, before and after, 2026-08-23: before 316 packages 10 advisories (10 moderate, 0 high) sharp 0.35.3 after 316 packages 10 advisories (10 moderate, 0 high) sharp 0.35.3 Deliberately unchanged. The sharp upgrade past the libvips fix line landed with the previous pin, so there is nothing left for this one to clear; the remaining 10 moderate advisories are unrelated to this move. A dependency bump that resolves nothing new is the expected shape here, and is reported rather than dressed up. What this pin does change is the declared contract. The upstream commit adds an allow-list to the user helper that drops caller-supplied authorization fields before a Firestore write, and its Helper class gains a sanitizeProfile member (13 members to 14). Both create and add already existed at the previous pin, and add delegates to create, so the new filter sits under both entry points. None of that is a runtime control acquired *here*. This package imports shared-helpers in type position only -- tsc elides it, and no @fabricelements specifier appears in any emitted lib/*.js -- so this package never executes the helper it now names. For this repository the change is bookkeeping: it keeps the graph on one commit and keeps a duplicate copy out of downstream trees. It should not be counted as applying a security control. One consequence worth stating so nobody mis-measures it. A consumer resolves this package's transitive pins from whichever commit of *this* package it itself pins. A consumer still pinned to an older commit here will keep resolving the shared-helpers commit that older commit declares, so copy count in a downstream tree collapses only once that consumer advances its pin of this package too. Measuring immediately after this merge and finding two copies would be the expected reading, not evidence the change did nothing. Verified: lib/ is byte-identical after a full clear-and-rebuild, so no regenerated output accompanies this change. The green typecheck is not vacuous -- asserting a number against User.InterfaceLinks.behance at the new pin still fails with TS2322, so the upstream declarations resolve rather than degrading to any across a commit that rewrote lib/user.d.ts. --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index 59866c5..5e1ff14 100644 --- a/package-lock.json +++ b/package-lock.json @@ -8,7 +8,7 @@ "name": "@furcata/core-node", "version": "1.0.0", "dependencies": { - "@fabricelements/shared-helpers": "github:FabricElements/shared-helpers#31ef85e7c011149749742243f13d096f8e6cb629", + "@fabricelements/shared-helpers": "github:FabricElements/shared-helpers#0c9d53a5e965c726d2cff2c319345c5ff63a3637", "zod": "^4.4.3" }, "devDependencies": { @@ -186,9 +186,9 @@ } }, "node_modules/@fabricelements/shared-helpers": { - "version": "1.1.0", - "resolved": "git+ssh://git@github.com/FabricElements/shared-helpers.git#31ef85e7c011149749742243f13d096f8e6cb629", - "integrity": "sha512-AmjfeD3a1CjgX/N+Qm2kYWjA9Q/Xow5q240NZopLMLdpSfxZsiuxw3vytSuz2S20TAeFZtUOueBTKR4ElZXCkA==", + "version": "2.0.0", + "resolved": "git+ssh://git@github.com/FabricElements/shared-helpers.git#0c9d53a5e965c726d2cff2c319345c5ff63a3637", + "integrity": "sha512-ODdjoeKl9pITppSp2FmxkiACVinzBa3ncuKWG2mqZEoQNRNTfBoiXKLyth4XeWCZEnkLN6tlvzY4CbiSVyu1oA==", "license": "BSD-3-Clause", "dependencies": { "@google-cloud/bigquery": "^8.3.1", diff --git a/package.json b/package.json index e296f4c..fe0a1e7 100755 --- a/package.json +++ b/package.json @@ -23,7 +23,7 @@ "./interface": "./lib/interface/index.js" }, "dependencies": { - "@fabricelements/shared-helpers": "github:FabricElements/shared-helpers#31ef85e7c011149749742243f13d096f8e6cb629", + "@fabricelements/shared-helpers": "github:FabricElements/shared-helpers#0c9d53a5e965c726d2cff2c319345c5ff63a3637", "zod": "^4.4.3" }, "devDependencies": {