feat(pr-checks): reject unbounded dependency ranges in Node PR checks - #92
Open
pilundain wants to merge 1 commit into
Open
feat(pr-checks): reject unbounded dependency ranges in Node PR checks#92pilundain wants to merge 1 commit into
pilundain wants to merge 1 commit into
Conversation
Adds a check-dependency-ranges composite action that fails when package.json declares a version range with no upper bound (*, latest, x, or a bare >= / > comparator without a < companion), and wires it into the two Node testing reusables (npm and pnpm) before dependency install. Motivation: a security override written as a bare ">=" floated a CommonJS consumer onto an ESM-only major and crashed a service at init with ERR_REQUIRE_ESM, while CI stayed green because it tested on a newer Node than the deployed runtime. Unbounded ranges tend to arrive from hurried security bumps or copy-pasted examples, not from deliberate versioning decisions. Scope decisions: - dependencies, devDependencies, optionalDependencies and overrides (including nested override objects) are checked; peerDependencies are NOT — open-ended peer ranges are a legitimate library convention, bounded by the consumer. - Non-registry specifiers (git/file/link/workspace/catalog protocols) are skipped, npm: aliases are judged by their aliased range, and each || alternative is judged on its own. - pr-checks-node-pnpm-build is intentionally untouched: it is a build-only workflow, and PR gating belongs to the testing reusables. The step is on by default; a repo that needs time to fix existing ranges can pass check-dependency-ranges: false to the reusable workflow.
null-paorodrigues
force-pushed
the
feat/check-dependency-ranges
branch
from
August 25, 2026 18:58
6fe8739 to
2e04a7a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
A new
check-dependency-rangescomposite action fails PR Checks whenpackage.jsondeclares a version range with no upper bound —*,latest,x, or a bare>=/>with no<companion — wired intopr-checks-node-npmandpr-checks-node-pnpmbefore dependency install (fails fast, needs nonode_modules). On by default; a repo can passcheck-dependency-ranges: falsewhile it fixes existing ranges.Verification
workspace:*,catalog:,npm:aliases, bounded>=1 <2,^3 || >=4(flagged), nested overrides (flagged), open peer ranges (allowed).