From 7ff3f7901e8b4db55d7ed4cff50c3e5938ac800c Mon Sep 17 00:00:00 2001 From: Kris Zyp Date: Tue, 1 Sep 2026 05:52:15 -0600 Subject: [PATCH] fix(deps): dedupe nested msgpackr instance under rocksdb-js package-lock.json carried a stale node_modules/@harperfast/rocksdb-js/node_modules/msgpackr entry (added by 2e65550d7, an unrelated REST pagination PR) even though root and rocksdb-js both pin msgpackr to the same exact 2.0.6. build-tools/check-shrinkwrap-pins.mjs correctly rejects any nested copy under rocksdb-js regardless of version, since msgpackr carries per-instance structure state and two instances sharing one database is a decode-corruption risk, not a cosmetic duplicate. Removing the redundant lock entry lets npm hoist rocksdb-js's msgpackr dependency to the root instance, matching what the exact-version pins already declare. Verified clean via `npm ci`: no nested node_modules/@harperfast/rocksdb-js/node_modules/msgpackr directory, and require.resolve('msgpackr') from rocksdb-js resolves to the same file as the root instance. Co-Authored-By: Claude Sonnet 5 --- package-lock.json | 9 --------- 1 file changed, 9 deletions(-) diff --git a/package-lock.json b/package-lock.json index 2ec4fd0369..46d8b05811 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2661,15 +2661,6 @@ "node": "^22.18.0 || >=24.0.0" } }, - "node_modules/@harperfast/rocksdb-js/node_modules/msgpackr": { - "version": "2.0.6", - "resolved": "https://registry.npmjs.org/msgpackr/-/msgpackr-2.0.6.tgz", - "integrity": "sha512-plGul/tqjt9vqWFR9zyqyLZls6gb5KTLvnsRO2B9+TZ8tNiXiVI/CR8LiDWlAX4IUeVkQ9gsmzKA6voC2QOciw==", - "license": "MIT", - "optionalDependencies": { - "msgpackr-extract": "^3.0.4" - } - }, "node_modules/@harperfast/skills": { "version": "1.12.2", "resolved": "https://registry.npmjs.org/@harperfast/skills/-/skills-1.12.2.tgz",