Repository navigation
chore(deps): regenerate promptfoo 0.122.2 lockfile for npm ci - #42
ManintheCrowds wants to merge 2 commits into
Conversation
Bumps [promptfoo](https://github.com/promptfoo/promptfoo) from 0.121.19 to 0.122.2. - [Release notes](https://github.com/promptfoo/promptfoo/releases) - [Changelog](https://github.com/promptfoo/promptfoo/blob/main/CHANGELOG.md) - [Commits](promptfoo/promptfoo@0.121.19...0.122.2) --- updated-dependencies: - dependency-name: promptfoo dependency-version: 0.122.2 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
The Dependabot bump left package-lock.json out of sync (npm ci failed). Co-authored-by: Cursor <[email protected]>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7984cd9721
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "version": "9.0.3", | ||
| "resolved": "https://registry.npmjs.org/gcp-metadata/-/gcp-metadata-9.0.3.tgz", |
There was a problem hiding this comment.
This upgrade hoists gcp-metadata to 9.0.3, which cannot satisfy the bundled [email protected] peer-optional requirement ^7.0.1, while the regenerated lockfile also drops node_modules/mongoose/node_modules/gcp-metadata. As a result, plain npm ci—including the promptfoo-eval workflow's install step—aborts with EUSAGE and Missing: gcp-metadata@ from lock file; this was reproduced with Node 22.22.2/npm 11.4.2. Regenerate the lock while retaining a compatible peer resolution rather than requiring consumers to use --legacy-peer-deps.
Useful? React with 👍 / 👎.
| }, | ||
| "devDependencies": { | ||
| "promptfoo": "0.121.19" | ||
| "promptfoo": "0.122.2" |
There was a problem hiding this comment.
The root package still declares Node ^20.20.0 as supported, and the example README instructs users that Node 20.20+ is valid, but the newly pinned promptfoo package declares node >=22.22.0 in this lockfile. Since npm normally only warns about incompatible engines, Node 20 users can install the example and then invoke an unsupported CLI. Remove the Node 20 range and update the README, or retain a promptfoo version that supports Node 20.
Useful? React with 👍 / 👎.
|
Do not merge: required job CI failed (promptfoo-eval). Local and GitHub both fail RT11 (authorized override expected reversal, got clean) on promptfoo 0.122.2. Leave #40 blocked; do not ship this bump until RT11 is green on Linux CI. |
|
Closing as superseded by #57. |
1 participant
Summary
examples/promptfoo/package-lock.jsonsonpm cisucceeds for promptfoo 0.122.2.npm cifailure.Test plan
npm ciinexamples/promptfooCIgreen (required)promptfoo eval: 16/17; RT11 (authorized override) classifiedcleannotreversal. Do not merge if Linux CI repeats that fail.Supersedes #40.
Made with Cursor