Bump brace-expansion, @rollup/plugin-commonjs and shx - #99
Merged
Conversation
Removes [brace-expansion](https://github.com/juliangruber/brace-expansion). It's no longer used after updating ancestor dependencies [brace-expansion](https://github.com/juliangruber/brace-expansion), [@rollup/plugin-commonjs](https://github.com/rollup/plugins/tree/HEAD/packages/commonjs) and [shx](https://github.com/shelljs/shx). These dependencies need to be updated together. Removes `brace-expansion` Updates `@rollup/plugin-commonjs` from 22.0.2 to 29.0.3 - [Changelog](https://github.com/rollup/plugins/blob/master/packages/commonjs/CHANGELOG.md) - [Commits](https://github.com/rollup/plugins/commits/commonjs-v29.0.3/packages/commonjs) Updates `shx` from 0.3.4 to 0.4.0 - [Release notes](https://github.com/shelljs/shx/releases) - [Changelog](https://github.com/shelljs/shx/blob/main/CHANGELOG.md) - [Commits](shelljs/shx@v0.3.4...v0.4.0) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: dependency-type: indirect - dependency-name: "@rollup/plugin-commonjs" dependency-version: 29.0.3 dependency-type: direct:development - dependency-name: shx dependency-version: 0.4.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
onyb
approved these changes
Aug 3, 2026
onyb
added a commit
that referenced
this pull request
Aug 4, 2026
CI verified almost nothing about its own output. The IIFE bundle shipped to npm was only checked with `test -s`, and the package smoke test asserted `typeof initialize === 'function'` without ever calling it. Reviewing the plugin-commonjs 22->29 bump in #99 meant verifying the bundle by hand, because nothing in CI could have caught a regression in it. Add a zero-dependency suite (node:test / node:assert / node:vm) that runs the real artifacts: - behavior: drives the full wallet surface -- connect, events, signMessage, signTransaction single and batch, signAndSendTransaction, the error paths, disconnect -- through lib/esm, lib/cjs and the IIFE bundle, then requires all three to agree. Cross-target equality is what catches a bundler change that silently diverges the bundle from the tsc output. Covers VersionedTransaction.deserialize and bs58.decode, the CJS-interop paths a bundler regression actually breaks. - registration: registerWallet swallows every error it hits, so a failed registration is indistinguishable from a successful one at the call site. Assert on the observable effect (exactly one wallet registered) instead. - bundle: reject a commonjsRequire shim, which plugin-commonjs emits for unresolvable requires and which throws at runtime; assert the bundle stays unmangled, since rollup.config.js runs terser with mangle and compress off to keep the artifact auditable and nothing enforced that; validate the sourcemap. Size is logged, not gated -- this project has explicitly traded size for auditability, so a byte budget would enforce a goal it does not have and would block routine dependency bumps. - package: assert every declared entry point reaches the tarball, that no development files leak into it, and that lib/cjs/package.json still pins "commonjs". Also fix engines.node, which claimed >=16 while @solana/web3.js -> @solana/codecs-numbers had already moved the real runtime floor to >=20.18.0. The new drift check compares the declared floor against every non-dev package in the lockfile, so this cannot silently rot again. Run the suite on node 20/22/24 in PR CI, and before publish -- previously a broken bundle could be published on the strength of `test -s` alone.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes brace-expansion. It's no longer used after updating ancestor dependencies brace-expansion, @rollup/plugin-commonjs and shx. These dependencies need to be updated together.
Removes
brace-expansionUpdates
@rollup/plugin-commonjsfrom 22.0.2 to 29.0.3Changelog
Sourced from @rollup/plugin-commonjs's changelog.
... (truncated)
Commits
1e4025bchore(release): commonjs v29.0.308a5b17fix(commonjs): make #1868 es5-compatible (#1981)5800bf3chore(repo): test migration to vitest. phase 4 (#1978)2de0d62chore(release): commonjs v29.0.2ab65325fix(commonjs): conditional exports (#1952)7d22981chore(repo): addrollup-pluginkeyword in package.json (#1955)a79ae55chore(release): commonjs v29.0.1bb41cfdchore(release): commonjs v29.0.114ae186fix(commonjs): correctly replaces shorthand "global" property in object (#1957)c8e78c8chore(release): commonjs v29.0.0Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@rollup/plugin-commonjssince your current version.Updates
shxfrom 0.3.4 to 0.4.0Release notes
Sourced from shx's releases.
Commits
8886c3e0.4.0e8db3bcrefactor: code cleanup for the --negate flag6184003Adding a global --negate flag (#189)b3d5b80fix: add back ShellJS version in --version5106c6bchore: update dependenciese8bb9f8chore: drop some dependencies and simplify3bb21d9chore: drop non-LTS node versionsb70e666chore: update shelljs and drop old node supportf8b0b37doc: Fix typo in README03c2964chore(dependencies): update js-yamlDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.