docs(deps): warn that ADL conformance fork bumps need inspection - #145
Merged
Conversation
The two overrides pin personal forks under a third-party account: 0 stars, last pushed January 2017, ~278 commits behind a maintained upstream. Their whole substantive delta is ~36 lines in lib/test.js — a debug logger the ADL runner uses to print HTTP traffic. The code is benign; the risk is structural, because a takeover, force-push or revived branch on that account changes what Renovate offers as a routine digest update. Both PRs Renovate opened in August 2026 were rejected on inspection, and neither was a normal upgrade: the supertest one proposed moving BACKWARDS (the pin tracks the ipc branch, Renovate followed the stale master HEAD, and the 'update' was four months older, dropping a 'try to avoid crash' commit), and the super-request one broke all eight conformance cells with 0 of 1364 tests executed — the battery failed to start. Records that history next to the pins, where a reviewer of the next bump will actually see it, along with what to check and the durable fixes: upstream the logger so the forks can go, or mirror them into this org so a third-party account cannot move them underneath us. Placed inside the overrides mapping deliberately — a comment in the document prelude is dropped by the YAML writeback on the first bump. Verified by simulating a digest bump against this file: 70 comments in, 70 out, warning intact, one line changed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Records, next to the pins themselves, that these two overrides are not ordinary dependencies and that any future Renovate bump must be inspected rather than merged on green.
Why
forwardemail/supertestrchadwic/supertest,rchadwic/super-requestlib/test.js— a debug logger feedingprocess.postMessageso the ADL runner can print HTTP trafficThe code is benign. The risk is structural: an unmaintained fork under a third-party personal account, which a takeover, force-push or revived branch can move underneath us — and Renovate will present that as a routine "digest update".
Not hypothetical. Both PRs Renovate opened were rejected on inspection, and neither was a normal upgrade:
supertest) proposed moving backwards. The pin tracks theipcbranch; Renovate followed the stalemasterHEAD, so the "update" was four months older, silently dropping a"try to avoid crash"commit.super-request) broke all eight conformance cells —0of1364tests executed, i.e. the battery failed to start.What the note says
Read the fork's diff and the branch it came from before merging any bump, and confirm the conformance matrix is green — those tests are the only thing exercising this code. Closing a bad PR is the right move; Renovate won't re-propose an unchanged digest.
It also records the durable fixes in preference order: get the logger upstreamed (or replaced with a superagent plugin) so the forks can go entirely; failing that, mirror both forks into this org.
Placement
Deliberately inside the
overrides:mapping. A comment in the document prelude is dropped by the YAML writeback on the first bump — the same trap documented at the top of the file. Verified by simulating a digest bump against this exact file:pnpm install --frozen-lockfileandfmt:checkstill pass.