Skip to content

fix: tighten package.json dependancies for @devcycle / @openfeature to patch versions - #1114

Merged
jonathannorris merged 2 commits into
mainfrom
fix-tighten-package-dependancies
Jul 16, 2025
Merged

fix: tighten package.json dependancies for @devcycle / @openfeature to patch versions#1114
jonathannorris merged 2 commits into
mainfrom
fix-tighten-package-dependancies

Conversation

@jonathannorris

@jonathannorris jonathannorris commented Jul 16, 2025

Copy link
Copy Markdown
Member

fix: tighten package.json dependencies for @devcycle / @openfeature to patch versions

This change updates all SDK packages to use tilde (~) version ranges instead of caret (^) for internal @devcycle and @openfeature dependencies, restricting updates to patch versions only.

Changes

  • Updated 12 SDK package.json files across sdk/ directory
  • Changed dependency version ranges from ^ to ~ for all @devcycle/* packages
  • Changed dependency version ranges from ^ to ~ for @openfeature/* packages
  • Preserved ^ ranges for peerDependencies and third-party packages

Impact

  • Before: "@devcycle/types": "^1.30.0" (allows minor + patch updates)
  • After: "@devcycle/types": "~1.30.0" (allows patch updates only)

This ensures more predictable dependency resolution and reduces the risk of breaking changes from minor version updates in internal packages.

@vercel

vercel Bot commented Jul 16, 2025

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
js-sdks-web-elements ✅ Ready (Inspect) Visit Preview 💬 Add feedback Jul 16, 2025 8:15pm
js-sdks-with-provider ✅ Ready (Inspect) Visit Preview 💬 Add feedback Jul 16, 2025 8:15pm
1 Skipped Deployment
Name Status Preview Comments Updated (UTC)
js-sdks-next-js-page-router ⬜️ Ignored (Inspect) Jul 16, 2025 8:15pm

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR tightens internal @devcycle and @openfeature dependency ranges from caret (^) to tilde (~) across multiple SDK package.json files, ensuring only patch updates are automatically allowed for internal packages.

  • Changed dependency ranges for internal @devcycle/* and @openfeature/* packages from ^ to ~
  • Left peerDependencies and third-party dependencies unchanged

Reviewed Changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated no comments.

Show a summary per file
File Description
sdk/react/package.json Updated ^ to ~ for @devcycle/js-client-sdk and @devcycle/types
sdk/react-native/package.json Updated ^ to ~ for all three @devcycle dependencies
sdk/react-native-expo/package.json Updated ^ to ~ for @devcycle SDK packages
sdk/openfeature-web-provider/package.json Updated ^ to ~ for @devcycle/js-client-sdk
sdk/openfeature-react-provider/package.json Updated ^ to ~ for two internal dependencies
sdk/openfeature-nestjs-provider/package.json Updated ^ to ~ for @devcycle/nodejs-server-sdk
sdk/openfeature-angular-provider/package.json Updated ^ to ~ for two internal dependencies
sdk/nodejs/package.json Updated ^ to ~ for five internal dependencies
sdk/nextjs/package.json Updated ^ to ~ for four internal dependencies
sdk/nestjs/package.json Updated ^ to ~ for two internal dependencies
sdk/js/package.json Updated ^ to ~ for @devcycle/types
sdk/js-cloud-server/package.json Updated ^ to ~ for @devcycle/types

@phaym

phaym commented Jul 16, 2025

Copy link
Copy Markdown
Contributor

does our automated release process touch these? wondering if theres some automated bumping of our shared deps via lerna/nx

@jonathannorris

Copy link
Copy Markdown
Member Author

does our automated release process touch these? wondering if theres some automated bumping of our shared deps via lerna/nx

yea I looked at the release scripts, they should auto-increment these versions, but I didn't see anywhere they set ^. I guess we will see on the next release what they do.

@phaym

phaym commented Jul 16, 2025

Copy link
Copy Markdown
Contributor

I guess we will see on the next release what they do.

ok. quick chat gpt query says it doesn't touch the range specifier, only the number which makes sense

@jonathannorris
jonathannorris force-pushed the fix-tighten-package-dependancies branch from 3d0e32c to 5c68504 Compare July 16, 2025 20:13
@jonathannorris
jonathannorris merged commit f303115 into main Jul 16, 2025
14 checks passed
@jonathannorris
jonathannorris deleted the fix-tighten-package-dependancies branch July 16, 2025 20:21
jonathannorris added a commit that referenced this pull request May 26, 2026
- uuid ^8.3.2 -> ^11.1.1 in package.json and sdk/js/package.json (runtime, alerts #1113/#1114)
- uuid resolution ^11.1.1 added to root and all e2e sub-project package.json files (alerts #1105-#1109)
- qs resolutions added for exact-pinned 6.13.0 and 6.14.0 -> ^6.15.2 in root (alerts #1110-#1112)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants