Skip to content

fix(sdk): Node 24 SDK extraction + restore green CI matrix#952

Open
janvennemann wants to merge 3 commits into
mainfrom
ci/pin-pnpm-version
Open

fix(sdk): Node 24 SDK extraction + restore green CI matrix#952
janvennemann wants to merge 3 commits into
mainfrom
ci/pin-pnpm-version

Conversation

@janvennemann

@janvennemann janvennemann commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

Three fixes to get the test matrix green again across Node 20/22/24. The CI matrix was fully red; root causes were unrelated.

1. fix(sdk): upgrade yauzl 3.3.0 → 3.4.0 (Node 24 SDK extraction) — user-facing bug

On Node 24, yauzl 3.3.0's internally-piped inflate stream produces no output for larger deflate entries — openReadStream returns a stream that never emits data/end. During ti sdk install, extraction stalls at the first big file (lodash.js, 544 KB): readEntry() is never called again, the event loop drains, and Node 24 aborts with "Detected unsettled top-level await". The SDK never finishes installing on Node 24. Node 20/22 are unaffected (which is why only Node 24 CI failed).

yauzl 3.4.0 fixes the inflate-stream composition. Verified end-to-end: ti sdk install 12.2.0.GA completes on Node 24 and lodash.js extracts to its full 544098 bytes. Lockfile updated surgically (yauzl bump + the now-unused buffer-crc32 removal only); --frozen-lockfile verified consistent.

2. ci: pin pnpm (packageManager: pnpm@10.33.3, drop version: latest)

action-setup@v4 + version:latest resolved pnpm 11.x (needs Node ≥22.13 / node:sqlite); the Node 20 matrix crashed during pnpm install. Pinning to pnpm 10.33.3 restores installs.

3. test(sdk): stabilize the sdk list branch assertion

Hardcoded branches.includes('12_6_X') — that branch was removed from the live server (current: 11_1_X, 12_7_X, 13_0_X, 12_8_X, 13_1_X, 13_2_X). Now asserts any \d+_\d+_X version-line branch.

Notes

This was referenced Jun 16, 2026
The `sdk list` test hardcoded `branches.includes('12_6_X')`, asserting a
specific branch exists in the live build-server branch list. That branch has
since been removed (current version-line branches are 11_1_X, 12_7_X, 13_0_X,
12_8_X, 13_1_X, 13_2_X), so the assertion fails and breaks CI on every branch.

Assert that at least one version-line branch (`\d+_\d+_X`) is present instead,
which verifies branch listing works without coupling to a volatile branch name.
@janvennemann janvennemann changed the title ci: pin pnpm version ci: fix test workflow (pin pnpm, stabilize sdk branch-list assertion) Jun 16, 2026
On Node 24, yauzl 3.3.0's internally-piped inflate stream produces no output
for larger deflate entries: `openReadStream` returns a stream that never emits
data or 'end'. During `ti sdk install` this stalls extraction at the first big
file (e.g. lodash.js, 544 KB) — `readEntry()` is never called again, the event
loop drains, and Node 24 aborts with "Detected unsettled top-level await". The
SDK never finishes installing. Node 20/22 are unaffected.

yauzl 3.4.0 fixes the inflate-stream composition. Verified: `ti sdk install
12.2.0.GA` completes on Node 24 and lodash.js extracts to its full 544098 bytes.

3.4.0 drops the buffer-crc32 dependency; lockfile updated surgically (yauzl bump
+ buffer-crc32 removal only), frozen-install verified consistent.
@janvennemann janvennemann changed the title ci: fix test workflow (pin pnpm, stabilize sdk branch-list assertion) fix(sdk): Node 24 SDK extraction + restore green CI matrix Jun 16, 2026
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedyauzl@​3.4.010010010091100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant