mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-15 19:52:50 +03:00
b3f8ca0190
The published package ships a PREBUILT .next directory, and next start reads build manifests whose shape changes between minors — so the runtime version must be the one that produced the build. With "next": "^16.2.11", every `npm i -g omniroute` resolved whatever Next was latest at INSTALL time. Next 16.3.1 was published 2026-08-13T22:45Z and added `validationLevel` to its server config schema (0 occurrences in 16.2.12, 74 in 16.3.1). Any install after that timestamp boots a 16.2.12-built .next on the 16.3.1 runtime and crashes immediately: TypeError: Cannot read properties of undefined (reading 'validationLevel') Reproduced on the 192.168.0.17 VPS: a fresh global install of the 3.8.50 tarball crashed in a restart loop; the previous install (next 16.3.0) is healthy, and nothing in this repo changed between them. Published 3.8.49 carries the same range, so new user installs are affected too. react/react-dom were already pinned exactly for this reason; this extends the invariant to next, syncs the lockfile range, and adds tests/unit/next-version-pinned.test.ts as the regression guard (asserts the build-coupled deps are exact and that package.json matches the lockfile version the build actually uses). Co-authored-by: Xiangzhe <bakryun0718@proton.me>
65 lines
2.7 KiB
TypeScript
65 lines
2.7 KiB
TypeScript
/**
|
|
* next-version-pinned.test.ts — `next` must be pinned to an exact version.
|
|
*
|
|
* The published package ships a PREBUILT `.next` directory. That build output is
|
|
* tightly coupled to the exact Next.js runtime that produced it: `next start`
|
|
* reads build manifests whose shape changes between minors. With a caret range,
|
|
* `npm i -g omniroute` resolves whatever Next is latest at INSTALL time, so a
|
|
* fresh upstream release silently breaks every new install even though nothing
|
|
* in this repo changed.
|
|
*
|
|
* That is not hypothetical: Next 16.3.1 (published 2026-08-13T22:45Z) added
|
|
* `validationLevel` to its server config schema, and a `.next` built by 16.2.12
|
|
* crashes at boot with "Cannot read properties of undefined (reading
|
|
* 'validationLevel')" — the symbol has 0 occurrences in 16.2.12 and 74 in
|
|
* 16.3.1. Range `^16.2.11` picked it up on the VPS install (2026-08-14).
|
|
*
|
|
* `react`/`react-dom` are already pinned exactly for the same reason; this test
|
|
* extends that invariant to `next` and keeps package.json in sync with the
|
|
* lockfile version the build actually uses.
|
|
*/
|
|
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { readFile } from "node:fs/promises";
|
|
import { fileURLToPath } from "node:url";
|
|
|
|
const ROOT = new URL("../../", import.meta.url);
|
|
const EXACT_VERSION = /^\d+\.\d+\.\d+(?:-[\w.]+)?$/;
|
|
|
|
/** Deps whose published artifact is coupled to the exact installed runtime. */
|
|
const MUST_BE_EXACT = ["next", "react", "react-dom"];
|
|
|
|
async function readJson(relative: string): Promise<Record<string, unknown>> {
|
|
return JSON.parse(await readFile(fileURLToPath(new URL(relative, ROOT)), "utf8"));
|
|
}
|
|
|
|
test("build-coupled dependencies are pinned to exact versions", async () => {
|
|
const pkg = await readJson("package.json");
|
|
const deps = (pkg.dependencies ?? {}) as Record<string, string>;
|
|
|
|
const ranged = MUST_BE_EXACT.filter((name) => deps[name] && !EXACT_VERSION.test(deps[name]));
|
|
|
|
assert.deepEqual(
|
|
ranged,
|
|
[],
|
|
"these ship a prebuilt artifact and must be pinned exactly (a range lets a fresh " +
|
|
`upstream release break new installs): ${ranged.map((n) => `${n}@${deps[n]}`).join(", ")}`
|
|
);
|
|
});
|
|
|
|
test("pinned next version matches the lockfile version the build uses", async () => {
|
|
const pkg = await readJson("package.json");
|
|
const lock = await readJson("package-lock.json");
|
|
|
|
const declared = ((pkg.dependencies ?? {}) as Record<string, string>).next;
|
|
const packages = (lock.packages ?? {}) as Record<string, { version?: string }>;
|
|
const locked = packages["node_modules/next"]?.version;
|
|
|
|
assert.ok(locked, "next missing from package-lock.json");
|
|
assert.equal(
|
|
declared,
|
|
locked,
|
|
`package.json declares next@${declared} but the lockfile builds with next@${locked}`
|
|
);
|
|
});
|