fix(deps): deduplicate protobufjs with protocol compatibility coverage #138

Merged
admin merged 12 commits from fix/desktop-protobuf-deduplication into dev 2026-10-09 15:40:07 +00:00
Owner

Refs #117 (protobuf tooling). Stacked on #137; rebase/retarget after preceding squash merges.

Add a narrowly scoped override forcing @grpc/proto-loader to the same pinned protobufjs 8.8.0 already used by the desktop parser. Remove the obsolete nested 7.6.6 dependency and its unused helper packages. Unrelated dependency changes from npm dedupe were excluded.

Four new tests verify the same module resolves for parser/loader, construct and roundtrip defaults for every NodeService method, preserve representative bytes/enums/uint64/task timeout payloads, and perform a unary call plus token stream over a local grpc-js server.

Validation: npm ls reports one deduplicated protobufjs 8.8.0 and no invalid dependencies; 47 tests, TypeScript, production build and whitespace checks passed. This is an intentional major-version override outside proto-loader's declared ^7 range, not a claim of upstream certification; the retained protocol tests guard our actual use. A real Go-daemon/Electron end-to-end test and clean npm ci validation remain pending.

npm audit still reports 14 advisories (7 low, 7 high), unchanged from before this override; this PR does not claim to resolve unrelated security advisories. Existing build warnings remain. No issues closed.

Refs #117 (protobuf tooling). Stacked on #137; rebase/retarget after preceding squash merges. Add a narrowly scoped override forcing @grpc/proto-loader to the same pinned protobufjs 8.8.0 already used by the desktop parser. Remove the obsolete nested 7.6.6 dependency and its unused helper packages. Unrelated dependency changes from npm dedupe were excluded. Four new tests verify the same module resolves for parser/loader, construct and roundtrip defaults for every NodeService method, preserve representative bytes/enums/uint64/task timeout payloads, and perform a unary call plus token stream over a local grpc-js server. Validation: npm ls reports one deduplicated protobufjs 8.8.0 and no invalid dependencies; 47 tests, TypeScript, production build and whitespace checks passed. This is an intentional major-version override outside proto-loader's declared ^7 range, not a claim of upstream certification; the retained protocol tests guard our actual use. A real Go-daemon/Electron end-to-end test and clean npm ci validation remain pending. npm audit still reports 14 advisories (7 low, 7 high), unchanged from before this override; this PR does not claim to resolve unrelated security advisories. Existing build warnings remain. No issues closed.
Sign in to join this conversation.
No Reviewers
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Sisyphus/Sisyphus#138