From 7258fdb07987d8c64920a3a69dfc6a11e300c576 Mon Sep 17 00:00:00 2001 From: Kris Zyp Date: Fri, 10 Jul 2026 15:08:20 -0600 Subject: [PATCH 1/2] fix: resolve uWebSockets.js via https, not ssh, in package-lock.json MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The optional dependency (#1096) was locked to a git+ssh:// URL, which requires a private key against github.com. Our Docker build stage has no SSH credentials, so npm silently skips it as a failed optional dependency — the resulting image never bundles the native addon, and HARPER_UWS_UDS / HARPER_UWS_HTTP are inert even when set. git+https needs no credentials for a public repo. Verified npm ci installs uWebSockets.js's native binaries successfully in a credential-less, HOME-stripped environment matching the Docker build stage (previously failed silently there). --- package-lock.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package-lock.json b/package-lock.json index 4cd3abb53..93e29c19e 100644 --- a/package-lock.json +++ b/package-lock.json @@ -14828,7 +14828,7 @@ }, "node_modules/uWebSockets.js": { "version": "20.68.0", - "resolved": "git+ssh://git@github.com/uNetworking/uWebSockets.js.git#624987739d4da0acb628aaf2a10fc43e7ce27c5c", + "resolved": "git+https://github.com/uNetworking/uWebSockets.js.git#624987739d4da0acb628aaf2a10fc43e7ce27c5c", "license": "Apache-2.0", "optional": true }, From 663f8502d290f2e7c3c27e55b996aedfbc099dda Mon Sep 17 00:00:00 2001 From: Kris Zyp Date: Fri, 10 Jul 2026 15:32:42 -0600 Subject: [PATCH 2/2] fix: pin uWebSockets.js via tarball URL, not a github: git spec MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous fix (hand-editing package-lock.json's resolved field to git+https) only patched the lockfile snapshot. package.json still declared the dependency via the github: shorthand (github:uNetworking/uWebSockets.js#v20.68.0), and npm/hosted-git-info canonicalizes ANY github.com git dependency back to git+ssh:// when regenerating — confirmed this happens even with an explicit git+https:// spec in package.json, with a clean npm cache. A future plain `npm install` would have silently reverted the lockfile fix and reintroduced the silent-skip-in-Docker bug. Switch to a plain tarball URL (https://.../archive/.tar.gz) instead. npm treats this as a remote-tarball dependency, not a hosted-git one, so hosted-git-info's ssh canonicalization never applies — resolved stays a plain https URL with a pinned integrity hash, immune to regeneration regressing it. Verified npm ci installs all 15 native .node binaries in a HOME-stripped, credential-less environment (matching the Docker build stage) both before and after a full npm install regenerates the lockfile from package.json. --- package-lock.json | 9 +++++---- package.json | 2 +- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index 93e29c19e..65af0f0f2 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@harperfast/harper-pro", - "version": "5.1.15", + "version": "5.2.0-alpha.2", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@harperfast/harper-pro", - "version": "5.1.15", + "version": "5.2.0-alpha.2", "license": "Elastic-2.0", "dependencies": { "@aws-sdk/client-s3": "^3.1012.0", @@ -143,7 +143,7 @@ "bufferutil": "^4.0.9", "segfault-handler": "^1.3.0", "utf-8-validate": "^5.0.10", - "uWebSockets.js": "github:uNetworking/uWebSockets.js#v20.68.0" + "uWebSockets.js": "https://github.com/uNetworking/uWebSockets.js/archive/624987739d4da0acb628aaf2a10fc43e7ce27c5c.tar.gz" } }, "node_modules/@agoric/babel-generator": { @@ -14828,7 +14828,8 @@ }, "node_modules/uWebSockets.js": { "version": "20.68.0", - "resolved": "git+https://github.com/uNetworking/uWebSockets.js.git#624987739d4da0acb628aaf2a10fc43e7ce27c5c", + "resolved": "https://github.com/uNetworking/uWebSockets.js/archive/624987739d4da0acb628aaf2a10fc43e7ce27c5c.tar.gz", + "integrity": "sha512-BcXO02DANWelQzJyMd2G875nBeZDDYHZxqE7uOH9cAsf62Ur3hl5+4crdqBWvFF+DzbUxJoswPqvE3i2aAEZ1g==", "license": "Apache-2.0", "optional": true }, diff --git a/package.json b/package.json index 093a97e56..38b456350 100644 --- a/package.json +++ b/package.json @@ -253,6 +253,6 @@ "bufferutil": "^4.0.9", "segfault-handler": "^1.3.0", "utf-8-validate": "^5.0.10", - "uWebSockets.js": "github:uNetworking/uWebSockets.js#v20.68.0" + "uWebSockets.js": "https://github.com/uNetworking/uWebSockets.js/archive/624987739d4da0acb628aaf2a10fc43e7ce27c5c.tar.gz" } }