fix(deps): bump stack-auth to 0.42.2 - #905
Conversation
…-profile to 0.42.2 stack-auth 0.42.2 moves jsonwebtoken from 9.3.1 to 10.4.0. The other three crates release in lockstep with stack-auth from the same monorepo, so their exact pins move together to stay in sync. Signed-off-by: Toby Hede <toby@cipherstash.com>
|
freshtonic
left a comment
freshtonic
left a comment
There was a problem hiding this comment.
Requesting changes — the dependency change itself is correct, but as it stands this lands on main without shipping.
The bump is right
- The four exact pins move to 0.42.2 in lockstep, which is correct:
stack-auth0.42.2 requiresstack-profile0.42.2, so they can't move independently. Cargo.tomlandCargo.lockagree, and the whole CI suite is green.jsonwebtoken9.3.1 → 10.4.0 swaps theringbackend foraws-lc-rs. Two ways that could have bitten here, both checked and fine:stack-authtarget-gatesjsonwebtokentocfg(not(target_arch = "wasm32")), soaws-lc-rs(no wasm32 support) stays out of the wasm build; andaws-lc-sysis already onmainviarustls/quinn, so no new CMake/C toolchain requirement is introduced on the native matrix.
Blocking: no changeset
@cipherstash/protect-ffi is a published package, and this PR changes the Rust dependencies that produce its native binaries — but it carries no changeset (see changeset-bot above). Consequences, following release.yml:
- No changeset means no version bump, so no Version Packages PR entry for the
@cipherstash/protect-ffifixed group. - The
gatejob asks npm which committed versions are missing. With no version bump there is nothing missing, so the FFI branch is skipped and no new binaries publish. - The patched
jsonwebtokentherefore sits onmainbut never reaches anyone consuming@cipherstash/protect-ffior@cipherstash/stack.
Worth flagging separately: ffi-preflight is workflow_dispatch-only and is meant to be pointed at changeset-release/main. No changeset means no Version Packages branch, so the pre-flight that actually builds and smoke-tests the native artifacts never gets a target either. The one job that would exercise aws-lc-rs across Windows/musl/aarch64 doesn't run at any point in this flow.
A patch-level changeset for @cipherstash/protect-ffi should be enough — the fixed group carries the six platform packages with it.
Happy to re-approve once that's added. If the intent was deliberately to let this ride along with a later release rather than publish on its own, say so and dismiss this — but in that case it's worth being explicit, because a security-motivated dependency patch that doesn't publish is easy to mistake for one that did.
(Also note this duplicates cipherstash/protectjs-ffi#154. Given that repo's own description says protect-ffi is "Implemented in @cipherstash/stack", it's worth confirming which one is canonical so the two don't drift.)
Patch-level changeset for @cipherstash/protect-ffi so the jsonwebtoken 9.3.1 -> 10.4.0 fix actually publishes through the fixed platform-package group instead of landing on main with nothing to release. Signed-off-by: Toby Hede <toby@cipherstash.com>
|
Good catch — added a patch-level changeset for |
lint:ffi-changeset flagged this: npm trusted publishing for the seven protect-ffi packages is still pointed at cipherstash/protectjs-ffi during the absorption, not this repo. An active changeset here would bump all seven through the fixed group and misattribute the next stack release. Deferred per the check's own instructions -- the phase-4 cutover PR renames it back. Signed-off-by: Toby Hede <toby@cipherstash.com>
|
Correction to my last comment — the active changeset broke CI. This repo has a temporary guard (`scripts/lint-no-ffi-changeset.mjs`) for the in-progress protect-ffi absorption from `cipherstash/protectjs-ffi`: npm trusted publishing for the seven protect-ffi packages is still pointed at that repo, not this one, so an active changeset here would bump all seven through the fixed group and misattribute the next `stack` release. Deferred it per the check's own instructions (`.md` → `.md.deferred`, commit 415ab2d) — it'll get renamed back in the phase-4 cutover PR that repoints trusted publishing. Net effect: this PR alone won't publish the fix, same as before, but now for a documented reason rather than a missing changeset. The actual publish path for this jsonwebtoken bump right now is a manual `workflow_dispatch` of protectjs-ffi's Release workflow after cipherstash/protectjs-ffi#154 merges — that repo doesn't use changesets, versioning there is a manual trigger, not automatic on merge. |
…radicted Review findings on the cutover PR, all four in its own additions. **Six orphaned fixtures.** CIP-3719 said to delete "its self-test, fixtures"; the first pass deleted the self-test and left `scripts/__tests__/fixtures/lint-no-ffi-changeset/` behind, then recorded in the plan that no fixtures existed. That conclusion came from checking `scripts/fixtures/` — the wrong directory. The self-test used a tmpdir for two cases only; the rest resolved these six files. Nothing referenced them once the test was gone, and `test:scripts` passes either way, which is why the claim needed checking rather than inferring. Deleted, and the plan's correction reversed rather than left to mislead the next reader. **Prose contradicted its own checklist, twice.** AGENTS.md and the protect-ffi README asserted publishing had moved while the same commit left the plan's "Repoint npm trusted publishing" box unticked; and the plan's summary claimed "Phases 3 and 5 are built" over four unticked Phase 5 boxes. Both reconciled in the direction of what is true: the repoint is done, and all four Phase 5 items verified against the tree — the `./diagnostics` subpath with `import` and `require` conditions, the doctor probe that keeps the separate auth probe, the missing-binary e2e, and both changesets. The repoint box carries what is genuinely still open: npm accepts a publisher scoped to `npm stage publish` alone, which reads as enabled and fails every `npm publish`, and that setting is unverified on all seven. **Step 2's verification criterion was stale.** It told a reviewer to expect a patch bump of the six Stack packages. `.changeset/prisma-next-0-17.md` takes them to major through the fixed group, on `origin/main` already and with no FFI changeset in play. Left as-is it invites reading an unrelated major as evidence the FFI bump misbehaved. AGENTS.md also now names #905 as carrying a parked changeset, since AGENTS.md is the file agents actually read and a `.md.deferred` is inert rather than loud now that the guard is gone. CIP-3719
Round-2 review findings, all in this PR's own prose. Both axes reached the same place from different directions: the docs were written as though the cutover had completed, when what has completed is the first of seven steps. - AGENTS.md and the protect-ffi README asserted publishing works here in unqualified present tense. Nothing has published from this repository yet — 0.31.0 came from the old one, and the release, the verification and the archive are all still ahead. Both now say the path is configured rather than proven, and point at the plan for what is open. - AGENTS.md named #905 as carrying a parked changeset. That is transient state in durable doctrine: the line goes false the day #905 merges, and the fact is already recorded in the plan where such things belong. The general rule stays, the PR number goes. - The Phase 4 step-4 criterion had lost its "only after the versioned pre-flight is green" sentence when the box was ticked, so a reader skimming boxes no longer saw the ordering rule at all. Restored; the note below it still records that the repoint in fact ran ahead of the pre-flight, and why that was judged acceptable. - The changesets-`ignore` rationale still described the guard in the present tense, in a section the earlier reconciliation walked past. Left open deliberately: three independent reviews now suggest replacing the deleted guard with its inverse — fail CI on any `.changeset/*.md.deferred`, since such a file is inert to changesets and, as of this PR, inert to CI too. That is a design decision against CIP-3719's explicit instruction to delete the script, not a defect fix, so it is not taken here. CIP-3719
2 participants
Summary
cipherstash-client,cts-common,stack-auth, andstack-profilefrom 0.42.0 to 0.42.2 inpackages/protect-ffi/crates/protect-ffi/Cargo.toml— these four crates release in lockstep from the same monorepo, so their exact pins move together.stack-auth0.42.2 moves itsjsonwebtokendependency from 9.3.1 to 10.4.0.Test plan
cargo build— cleancargo test --lib— 310 passed, 0 failedcargo tree -i jsonwebtokenconfirms resolution to 10.4.0