Repository navigation
build: gate ncu at 7h, not 24h, to match minimumReleaseAge - #621
Merged
Merged
Conversation
`cooldown` returned the bare number 1. ncu reads a bare number as DAYS, so this repo has been asking for 24 hours while its own pnpm-workspace.yaml asks for 7 (`minimumReleaseAge: 420`) and every other repo in the fleet returns the string "7h". The effect is a silent no-op rather than an error: anything published 7-24h ago is invisible here but visible everywhere else, so the deps-train reports "no non-major updates" for node-cli while bumping the same package next door. Today that hid two updates — pnpm 11.18.0 (15h old) and better-sqlite3 13.0.2 (20h old). This looks like a missed migration: the other seven repos moved from `1` to "7h" and kept the old "1 day" prose in their comments, which is still there. node-cli kept the old value too. Audited all eight repos across 495 dependency names — every cooldown now resolves to 0h (in-house scopes) or 7h, and node-cli was the only outlier. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm4oPDceHFw3DN6MQG8wbz
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
.ncurc.cjsreturned the bare number1forcooldown. ncu reads a bare number as days, so this repo has been asking for a 24h supply-chain delay while:pnpm-workspace.yamlasks for 7h (minimumReleaseAge: 420), and"7h".It fails as a silent no-op, not an error. Anything published 7–24h ago is invisible here but visible everywhere else, so the deps-train reports
no non-major updatesfornode-cliwhile bumping the same package in the repo next door. That's how this surfaced:ui-iconsofferedpnpm→11.18.0andnode-cliclaimed nothing was available, despite sitting on 11.17.0.Two updates were being hidden right now:
pnpmbetter-sqlite3Both clear 7h, neither clears 24h.
What
1→"7h", and the comment now says what the value is for and why it must stay a duration string.Likely a missed migration: the other seven repos moved from
1to"7h"but kept the old "Set cooldown to 1 day" / "@returns Cooldown days restriction" prose, which is still in their configs today.node-clikept the old value as well as the old prose.Verification
cooldownis a function of the package name and could special-case a subset). Every cooldown now resolves to 0h for in-house scopes or 7h for third-party.node-cliwas the only outlier, and no repo has a stray.ncurcin another format.deps-train --only node-cli(dry-run) now reports exactlypnpm→11.18.0, better-sqlite3→13.0.2, matching an independent read-only ncu sweep at both gates.ncu-only config: no lockfile or dependency change in this PR.
🤖 Generated with Claude Code
https://claude.ai/code/session_01Pm4oPDceHFw3DN6MQG8wbz