mirror of
https://github.com/openclaw/openclaw.git
synced 2026-10-03 17:53:39 +00:00
d0f40a8de2
* chore(deps): refresh dependencies with seven-day cutoff Advance eligible runtime, native, release, and development dependencies published by 2026-09-14T07:00:00Z. Preserve compatibility holds and existing reviewed newer pins. Synchronize release integrity checks and scoped overrides; remove the superseded mailparser override. Preserve Clack cancellation inference with its precise sentinel type and isolate the Vertex proxy fixture from ambient credentials. Timestamp and checksum audits, targeted consumers, native builds/tests, and independent review validate the refresh; required hosted CI remains the landing gate. * fix(deps): preserve Clack cancellation types in exported prompts Give styled configure prompts the exact upstream return types so plugin SDK declaration emission can name the new cancellation sentinel. Runtime behavior and generic option values are unchanged. * fix(deps): preserve release tooling and Android test contracts Regenerate Ruby lock metadata with pinned Bundler 2.6.9, grant Robolectric 4.17 its documented module access only in Android test JVMs, and keep the precise cancellation type without growing an over-cap source file. Both previously failing Ruby lock guards, the line-cap and core type checks, all three configured Android test-task JVM arguments, and the actual Robolectric interceptor before/after probe pass. Independent review found no actionable P0/P1 issues. * fix(deps): close Rustls advisory and align mock session clocks Rustls 0.23.45 has now completed the seven-day cooldown; update only the shared crate pin and lock to the existing security-fixed desktop version. Advance accepted mock Gateway writes on the synthetic fixture timeline and correlate permission tests with the actual mutation and refresh. This repairs a reproduced CI fixture race without changing production behavior or weakening assertions. Validation: 36 Rust gateway-client tests including four TLS handshakes, 50 fixture tests, nine browser cases, scoped changed checks, and independent P0/P1 review passed. * test(ui): keep external session updates on the committed timeline * test: stabilize approval and desktop CI fixtures * build(workboard): refresh assets after dependency rebase
75 lines
2.7 KiB
Bash
Executable file
75 lines
2.7 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
source_root="${1:?trusted Vercel CLI source root is required}"
|
|
destination="${2:?Vercel CLI destination is required}"
|
|
github_output="${3:-}"
|
|
|
|
package_json="${source_root}/package.json"
|
|
package_lock="${source_root}/package-lock.json"
|
|
expected_lock_sha256="3f722fefb49934a2c6ed39b48f1cfe3925d9fb3dcf2549f1af70cef71b64e419"
|
|
expected_vercel_integrity="sha512-D+9Tl8/qjV+wPtrMn0vrHoR+uZOeC6ZbftnniphZNUkPsshkC8LqCm+e3tcla69gQkuEUstVRg2BFJ4/nEVsiQ=="
|
|
test -f "${package_json}"
|
|
test -f "${package_lock}"
|
|
if [[ -e "${destination}" || -L "${destination}" ]]; then
|
|
echo "Vercel CLI destination must not already exist: ${destination}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
install -d -m 0700 "${destination}"
|
|
install -m 0600 "${package_json}" "${destination}/package.json"
|
|
install -m 0600 "${package_lock}" "${destination}/package-lock.json"
|
|
|
|
lock_sha256="$(
|
|
VERCEL_CLI_LOCK="${package_lock}" \
|
|
node -e "const { createHash } = require('node:crypto'); const { readFileSync } = require('node:fs'); process.stdout.write(createHash('sha256').update(readFileSync(process.env.VERCEL_CLI_LOCK)).digest('hex'));"
|
|
)"
|
|
[[ "${lock_sha256}" == "${expected_lock_sha256}" ]] || {
|
|
echo "Pinned Vercel CLI lock SHA-256 mismatch." >&2
|
|
exit 1
|
|
}
|
|
vercel_integrity="$(
|
|
VERCEL_CLI_LOCK="${package_lock}" \
|
|
node -p "require(require('node:path').resolve(process.env.VERCEL_CLI_LOCK)).packages['node_modules/vercel'].integrity"
|
|
)"
|
|
[[ "${vercel_integrity}" == "${expected_vercel_integrity}" ]] || {
|
|
echo "Pinned Vercel CLI integrity mismatch." >&2
|
|
exit 1
|
|
}
|
|
|
|
# Install with lifecycle scripts disabled before any credential is exposed to
|
|
# the CLI process. The committed lock fixes the complete dependency closure.
|
|
(
|
|
cd "${destination}"
|
|
npm ci \
|
|
--ignore-scripts \
|
|
--no-audit \
|
|
--no-fund \
|
|
--omit=dev
|
|
)
|
|
|
|
vercel_version="$(
|
|
VERCEL_CLI_ROOT="${destination}" \
|
|
node -p "require(require('node:path').join(process.env.VERCEL_CLI_ROOT, 'node_modules/vercel/package.json')).version"
|
|
)"
|
|
[[ "${vercel_version}" == "59.16.0" ]] || {
|
|
echo "Pinned Vercel CLI version mismatch: ${vercel_version}" >&2
|
|
exit 1
|
|
}
|
|
test -x "${destination}/node_modules/.bin/vercel"
|
|
vercel_cli="${destination}/node_modules/.bin/vercel"
|
|
# Use Sandbox directly: Vercel's sandbox wrapper overwrites failed remote exits.
|
|
test -x "${destination}/node_modules/.bin/sandbox"
|
|
sandbox_cli="${destination}/node_modules/.bin/sandbox"
|
|
|
|
echo "Materialized vercel@${vercel_version} from lock ${lock_sha256}."
|
|
if [[ -n "${github_output}" ]]; then
|
|
{
|
|
echo "cli=${vercel_cli}"
|
|
echo "sandbox_cli=${sandbox_cli}"
|
|
echo "integrity=${vercel_integrity}"
|
|
echo "lock_sha256=${lock_sha256}"
|
|
echo "version=${vercel_version}"
|
|
} >> "${github_output}"
|
|
fi
|