From dc47df3e2bce84122add472624b8d067396e9dee Mon Sep 17 00:00:00 2001 From: interacsean Date: Wed, 15 Jul 2026 12:53:14 +1000 Subject: [PATCH] fix(deps): raise auth-public-client floor to ^0.5.1 Bump the @tailor-platform/auth-public-client dependency floor from ^0.5.0 to ^0.5.1 so fresh installs can no longer resolve the broken 0.5.0 release. Exempt @tailor-platform/auth-public-client from the minimumReleaseAge maturity gate so 0.5.1 can be installed before it clears the 3-day window; the gate guards against compromised third-party republishes, not first-party Tailor packages. Co-Authored-By: Claude Opus 4.8 --- .changeset/raise-auth-client-floor.md | 5 +++++ packages/core/package.json | 2 +- pnpm-lock.yaml | 10 +++++----- pnpm-workspace.yaml | 6 ++++++ 4 files changed, 17 insertions(+), 6 deletions(-) create mode 100644 .changeset/raise-auth-client-floor.md diff --git a/.changeset/raise-auth-client-floor.md b/.changeset/raise-auth-client-floor.md new file mode 100644 index 00000000..c4c016ca --- /dev/null +++ b/.changeset/raise-auth-client-floor.md @@ -0,0 +1,5 @@ +--- +"@tailor-platform/app-shell": patch +--- + +Raise the `@tailor-platform/auth-public-client` dependency floor from `^0.5.0` to `^0.5.1` so fresh installs cannot resolve the broken `0.5.0` release. diff --git a/packages/core/package.json b/packages/core/package.json index 327e83ab..a0449ee5 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -54,7 +54,7 @@ "@internationalized/date": "3.12.2", "@standard-schema/spec": "^1.1.0", "@tailor-platform/app-shell-vite-plugin": "workspace:*", - "@tailor-platform/auth-public-client": "^0.5.0", + "@tailor-platform/auth-public-client": "^0.5.1", "change-case": "^5.4.4", "class-variance-authority": "^0.7.1", "clsx": "^2.1.1", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 2fa05d43..b3b42362 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -246,8 +246,8 @@ importers: specifier: workspace:* version: link:../vite-plugin '@tailor-platform/auth-public-client': - specifier: ^0.5.0 - version: 0.5.0 + specifier: ^0.5.1 + version: 0.5.1 change-case: specifier: ^5.4.4 version: 5.4.4 @@ -3146,8 +3146,8 @@ packages: '@swc/types@0.1.26': resolution: {integrity: sha512-lyMwd7WGgG79RS7EERZV3T8wMdmPq3xwyg+1nmAM64kIhx5yl+juO2PYIHb7vTiPgPCj8LYjsNV2T5wiQHUEaw==} - '@tailor-platform/auth-public-client@0.5.0': - resolution: {integrity: sha512-yDfzrQZaUKc45VWjTJiZAtRr+XyMtduyKifLnIIxBxXPu52Ubedri7ccIOJ7FJ5ID3nk/kOAWzjWU+/fyg7Fog==} + '@tailor-platform/auth-public-client@0.5.1': + resolution: {integrity: sha512-7H42uyLPaxjeF/LM/cBMohR1mpjYiL3yteswJlXKpOI1HvoMOGcIfEMwZoeYa1hojAkdzI4f6LMtsDqnv1SegQ==} engines: {node: '>=18.0.0'} '@tailor-platform/function-kysely-tailordb@0.1.3': @@ -8216,7 +8216,7 @@ snapshots: dependencies: '@swc/counter': 0.1.3 - '@tailor-platform/auth-public-client@0.5.0': + '@tailor-platform/auth-public-client@0.5.1': dependencies: openid-client: 6.8.1 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 5e109a21..20b88d7a 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -40,6 +40,12 @@ trustLockfile: true # Require packages to be published for at least 3 days before allowing install (default: 1 day) minimumReleaseAge: 4320 +# First-party Tailor packages are exempt from the maturity gate: the gate guards +# against compromised third-party republishes, not packages we publish ourselves. +# Note: this matches on package name (glob), so it exempts all versions, not a +# specific one. +minimumReleaseAgeExclude: + - "@tailor-platform/auth-public-client" # Deny all lifecycle scripts (postinstall, install, preinstall). # pnpm resolves optionalDependencies correctly so these fallback scripts are unnecessary.