You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "rusackas (via GitHub)" <gi...@apache.org> on 2026/01/26 17:43:13 UTC
[PR] fix(deps): pin query-string and global-box to prevent ESM resolution issues [superset]
rusackas opened a new pull request, #37450:
URL: https://github.com/apache/superset/pull/37450
## Summary
This PR fixes a transitive dependency resolution issue that was causing multiple Dependabot PRs to fail CI.
**Problem:**
When npm regenerates the lockfile (during dependency updates), peer dependencies can resolve to different versions:
- `query-string >=5.1.1` was resolving to **9.x** (ESM-only) instead of **6.x** (CommonJS)
- `global-box` was being **dropped entirely** from the dependency tree
**Symptoms in CI:**
- Jest: `SyntaxError: Cannot use import statement outside a module` (query-string ESM issue)
- Storybook: `Module not found: Error: Can't resolve 'global-box'` (encodable dependency)
**Solution:**
Add these as explicit dependencies with pinned versions:
- `query-string`: 6.14.1 (CommonJS version, compatible with Jest)
- `global-box`: 2.0.2 (required by @encodable/registry)
## Affected Dependabot PRs
Once this PR is merged, these PRs can be rebased and should pass CI:
- #37319 - core-js (ui-core)
- #37240 - @luma.gl/core
- #37239 - @deck.gl/mesh-layers
- #37237 - @luma.gl/shadertools
- #37151 - memoize-one
- #36662 - fetch-mock
- #36565 - ts-loader
- #36560 - @storybook/addon-controls
- #37417 - ag-grid-react (ui-core)
## Test Plan
- [ ] CI passes on this PR
- [ ] Rebase an affected Dependabot PR and verify it passes
🤖 Generated with [Claude Code](https://claude.ai/code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(deps): pin query-string and global-box to prevent ESM resolution issues [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #37450:
URL: https://github.com/apache/superset/pull/37450#issuecomment-3800842669
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(deps): pin query-string and global-box to prevent ESM resolution issues [superset]
Posted by "codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>.
codeant-ai-for-open-source[bot] commented on PR #37450:
URL: https://github.com/apache/superset/pull/37450#issuecomment-3800847096
## **Sequence Diagram**
This PR pins query-string and global-box in package.json to force compatible CommonJS versions and reintroduce a missing transitive dependency, preventing CI failures caused by npm lockfile regenerations during dependency updates.
```mermaid
sequenceDiagram
participant Dependabot
participant npm
participant CI
participant Repo
Dependabot->>npm: Run dependency update (regenerate lockfile)
npm-->>Repo: Resolve deps (query-string -> 9.x (ESM), global-box dropped)
Repo->>CI: Run tests (Jest/Storybook)
CI-->>Dependabot: Fail (SyntaxError / Module not found)
Repo->>Repo: Add pinned deps (query-string@6.14.1, global-box@2.0.2) in package.json
Repo->>npm: Install & regenerate lockfile
npm-->>CI: Resolved compatible deps
CI-->>Dependabot: Tests pass (Dependabot PRs can be rebased)
```
---
*Generated by [CodeAnt AI](https://codeant.ai)*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(deps): remove encodable dependency and pin query-string to fix Dependabot CI failures [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas merged PR #37450:
URL: https://github.com/apache/superset/pull/37450
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(deps): remove encodable dependency and pin query-string to fix Dependabot CI failures [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #37450:
URL: https://github.com/apache/superset/pull/37450#issuecomment-3801261439
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers a full AI review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(deps): remove encodable dependency and pin query-string to fix Dependabot CI failures [superset]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #37450:
URL: https://github.com/apache/superset/pull/37450#issuecomment-3801708442
🎪 [Showtime](https://github.com/mistercrunch/superset-showtime) is building environment on [GHA](https://github.com/apache/superset/actions/runs/21373574790) for [9b6a4cf](https://github.com/apache/superset/commit/9b6a4cf)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org