fix(deps): unblock Dependabot's pnpm resolve (release age and trust checks) by ThomasK33 · Pull Request #346 · coder/agent-tty

ThomasK33 · 2026-11-05T21:31:47Z

Why

#176 moved the repo to pnpm so that Dependabot can update dependencies. After it merged, Dependabot's first npm version-update run on main failed every update with update_not_possible. GitHub Actions updates worked (#341 to #345), but no npm update PR opened.

Two pnpm checks block Dependabot's resolve. Dependabot runs pnpm update <dep> --lockfile-only --config.minimum-release-age=10080 (its 7-day cooldown) on an empty pnpm store, and pnpm applies both checks to every locked package, not only the one being updated:

Release age. @coder/libghostty-vt-node@0.1.0-beta.7 was published 2 days ago: ERR_PNPM_NO_MATURE_MATCHING_VERSION ... does not meet the minimumReleaseAge constraint. This is the error in the Dependabot log.
Trust downgrade. With the first check out of the way, the next error is ERR_PNPM_TRUST_DOWNGRADE on semver@5.7.2. That 2023 backport has no provenance and was published after semver 7.5.1, which has it. release-please reaches it through conventional-changelog-writer > meow > read-pkg-up > read-pkg > normalize-package-data. A store that already holds the locked packages skips the trust check, so this error shows only on an empty store.

What changed

pnpm-workspace.yaml:
- minimumReleaseAgeExclude: ['@coder/libghostty-vt-node@0.1.0-beta.7']. Only that exact locked release skips the age check. A newer release of the package stays behind both the 1-day local age and the 7-day cooldown.
- trustPolicyExclude gains semver@5.7.2, next to the existing @octokit/endpoint@9.0.6 entry.
.github/dependabot.yml: the cooldown comment explains both checks. A change to this file also makes Dependabot run again on main right after the merge.
New .agents/skills/verify-agent-tty/scripts/dependabot-resolve.sh, listed in the skill's Helpers table. It replays Dependabot's resolve on copies of package.json, pnpm-lock.yaml and pnpm-workspace.yaml against an empty store, prints one line per dependency and a count line, and exits 1 when one fails. It exits 2 on a setup error, including a pnpm whose version differs from the packageManager pin.

The lockfile does not change: pnpm install --frozen-lockfile passes and leaves pnpm-lock.yaml unchanged.

Validation

With a fake pnpm 12 first on PATH, the script exits 2 and names both versions.
dependabot-resolve.sh commander@latest on main's pnpm-workspace.yaml: FAIL with the release-age error (exit 1).
On this branch: commander@latest, zod@latest, vitest@4.1.12 and typescript@latest resolve (4 of 4, exit 0).
Empty-store replay with both of Dependabot's command forms (with and without --no-save -r) for 8 direct dependencies: 16 of 16 pass. Without the semver@5.7.2 entry it fails with the trust downgrade, and without the age entry it fails with the age error.
pnpm install --frozen-lockfile, mise run --force format-check and mise run --force workflow-lint pass.
The live check is the Dependabot run on main after the merge.

BEGIN_COMMIT_OVERRIDE
fix(deps): unblock Dependabot's pnpm resolve (release age and trust checks)
END_COMMIT_OVERRIDE

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

…ot can update

ThomasK33 · 2026-11-05T21:31:57Z

@codex review

ThomasK33 · 2026-11-05T21:32:04Z

@codex security review

chatgpt-codex-connector · 2026-11-05T21:32:13Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T23:50:58.690616Z	`68cb142`	Manual request
🔒 Security Review	✅ Completed 2026-11-05T23:53:23.290260Z	`68cb142`	Manual request

Security findings

Advisory findings (1)

🟡 Keep future @coder releases behind the cooldown · Medium

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-11-05T21:34:24Z

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: ea51d97120

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

🛡️ Codex Security Review

Here are some automated security review suggestions for this pull request.

Reviewed commit: ea51d97120

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

…bot resolve replay

… release age

ThomasK33 · 2026-11-05T23:04:10Z

@codex review

ThomasK33 · 2026-11-05T23:04:18Z

@codex security review

chatgpt-codex-connector · 2026-11-05T23:07:03Z

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: c2ebe925b8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-11-05T23:08:49Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: c2ebe925b8

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

… pnpm

ThomasK33 · 2026-11-05T23:48:21Z

@codex review

ThomasK33 · 2026-11-05T23:48:28Z

@codex security review

chatgpt-codex-connector · 2026-11-05T23:50:57Z

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 68cb142333

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-11-05T23:53:21Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 68cb142333

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

ThomasK33 · 2026-11-06T00:33:39Z

Review record for the merge decision.

Final commit: 68cb142.
CI on the final commit: every check passed, including quality-gates, quality-gates-macos and pr-title. One duplicate pr-title run was cancelled by the workflow's concurrency setting.
Codex: 3 rounds. Round 1 security review: the @coder/* wildcard let future releases skip the age checks. Fixed with an exact-version entry. Rounds 2 and 3: both reviews found no issues. There are no unresolved threads.
Independent verifiers: ISSUES on ea51d97 (an empty store still failed on the semver@5.7.2 trust check, fixed). ISSUES on c2ebe92 (four minor comment and script findings, fixed). PASS on 68cb142.
Clean-context advisor: READY. Its one remaining limit is that no CI check catches a newly locked release younger than 7 days. I did not add one, because such a check would depend on registry state and fail unrelated PRs. The effect lasts at most one weekly Dependabot run, and dependabot-resolve.sh and the dependabot.yml comment cover it.
Reason for stopping: every gate is clean on the final commit. The live check is the Dependabot run on main after the merge.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

fix(deps): exempt @coder packages from pnpm's release age so Dependab…

ea51d97

…ot can update

chatgpt-codex-connector Bot reviewed Nov 5, 2026

View reviewed changes

Comment thread pnpm-workspace.yaml Resolved

ThomasK33 added 2 commits November 5, 2026 23:01

fix(deps): exempt semver@5.7.2 from the trust check and add a Dependa…

e168516

…bot resolve replay

fix(deps): exempt only the locked libghostty-vt-node release from the…

c2ebe92

… release age

ThomasK33 changed the title ~~fix(deps): exempt @coder packages from pnpm's release age so Dependabot can update~~ fix(deps): unblock Dependabot's pnpm resolve (release age and trust checks) Nov 5, 2026

fix(deps): correct the Dependabot replay notes and require the pinned…

68cb142

… pnpm

ThomasK33 added this pull request to the merge queue Nov 6, 2026

Merged via the queue into main with commit 4f75b74 Nov 6, 2026
26 of 27 checks passed

ThomasK33 deleted the fix/dependabot-release-age branch November 6, 2026 00:48

ThomasK33 mentioned this pull request Nov 6, 2026

fix(deps): clear the moderate dev-dependency advisories that Dependabot cannot fix #347

Merged

github-actions Bot mentioned this pull request Nov 6, 2026

chore(release): 0.6.0 #172

Open

ThomasK33 mentioned this pull request Nov 6, 2026

fix: stop the event log at its size limit and name the cause #340

Merged

Conversation

ThomasK33 commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What changed

Validation

Uh oh!

ThomasK33 commented Nov 5, 2026

Uh oh!

ThomasK33 commented Nov 5, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Security findings

Advisory findings (1)

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

🛡️ Codex Security Review

Uh oh!

Uh oh!

ThomasK33 commented Nov 5, 2026

Uh oh!

ThomasK33 commented Nov 5, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026

🛡️ Codex Security Review

Uh oh!

ThomasK33 commented Nov 5, 2026

Uh oh!

ThomasK33 commented Nov 5, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026

🛡️ Codex Security Review

Uh oh!

ThomasK33 commented Nov 6, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ThomasK33 commented Nov 5, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Nov 5, 2026 •

edited

Loading