build: Bump archiver from 7.0.1 to 8.0.0 in the npm-major group - #14
Conversation
Bumps the npm-major group with 1 update: [archiver](https://github.com/archiverjs/node-archiver). Updates `archiver` from 7.0.1 to 8.0.0 - [Release notes](https://github.com/archiverjs/node-archiver/releases) - [Changelog](https://github.com/archiverjs/node-archiver/blob/master/CHANGELOG.md) - [Commits](archiverjs/node-archiver@7.0.1...8.0.0) --- updated-dependencies: - dependency-name: archiver dependency-version: 8.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-major ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
![ninja6-agent[bot]](https://avatars.githubusercontent.com/in/4723705?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review: bump archiver 7.0.1 -> 8.0.0
Reviewed by installing both versions in a scratch project on Node v24.19.0 and running this
repository's own call shape, rather than reading release notes. Summary up front: this bump
fixes a build that is broken on main today. Merging it makes the repository strictly better.
Finding 1 - main's build is broken on 7.0.1; 8.0.0 is what makes it work
tools/build-pack.mjs constructs the archive as:
const archiver = require("archiver"); // via createRequire
const archive = new archiver.ZipArchive({ zlib: { level: 9 } });archiver.ZipArchive does not exist in 7.0.1. Measured, same script, both versions:
| 7.0.1 | 8.0.0 | |
|---|---|---|
typeof archiver |
function |
object |
| exported keys | create, registerFormat, isRegisteredFormat |
Archiver, JsonArchive, TarArchive, ZipArchive |
new archiver.ZipArchive({...}) |
TypeError: archiver.ZipArchive is not a constructor |
writes a valid zip |
So npm run build (and every build:* script) throws on main at step 5, after the textures
have been rasterised. 8.0.0 is the first release that exposes the class-based API this code was
written against. The pre-bump state is not working, and the bump is the fix - not a risk.
Verified with npm ci against this PR's lockfile: archiver@8.0.0 installs and the exact
createZipArchive body from tools/build-pack.mjs produces a zip.
Finding 2 - no workflow installs dependencies or runs the build (medium; pre-existing, independent of this PR)
There are five workflows: agent-review-gate, dco, standards, scorecard, icons. The word
npm appears in none of them. icons.yml is the only one that executes repository code, and
it runs node scripts/export-icons.mjs - which imports only node: builtins - under a paths:
filter on docs/assets/**. Nothing ever runs npm ci, and nothing ever executes
tools/build-pack.mjs.
That is why the three green checks on this PR say nothing about it: DCO checks sign-off, Standards
checks repository layout, and the gate is a status shim. A CI job that merely installed and ran
npm run build would have caught Finding 1 whenever it was introduced, and would have
demonstrated this PR's value automatically. Worth a follow-up issue: a build.yml that runs
npm ci and at least one npm run build:32.
Finding 3 - 8.0.0 is ESM-only, so the real minimum Node is above the declared >=18.0.0 (medium, non-blocking)
archiver@8.0.0 ships "type": "module" with "exports": "./index.js" and declares
engines: { node: ">=18" }. But build-pack.mjs reaches it through createRequire(...), and
require() of an ESM package only works where Node supports require(esm) - 20.19+ / 22.12+,
never on 18.x. Reproduced by running the same script under --no-experimental-require-module,
which is what an 18.x runtime does:
Error [ERR_REQUIRE_ESM]: require() of ES Module .../archiver/index.js ... not supported
package.json still declares "engines": { "node": ">=18.0.0" }. On Node 18 the build now fails
for a different reason than it does today. This is not a regression - the build fails on Node
18 with 7.0.1 too, per Finding 1 - so it does not block the merge, but the declaration is wrong
either way.
Two follow-ups, in order of preference:
-
Drop the
createRequireshim.build-pack.mjsis already ESM, and the named import is the
supported entry point on 8.0.0:import { ZipArchive } from "archiver";
Verified: this works under
--no-experimental-require-module, i.e. it would work on Node 18 as
well, and it removescreateRequire/node:modulefrom the file. Note that
import archiver from "archiver"does not work - 8.0.0 provides no default export
(SyntaxError: does not provide an export named 'default'). Use the named import, or
import * as archiver. -
Raise
engines.nodeto whatever floor is actually intended. If thecreateRequireshim stays,
the honest floor is>=20.19.0.
Worth noting for whoever picks that up: no workflow pins a Node version for the build, because no
workflow builds. icons.yml uses node-version: '22', which resolves to a 22.x new enough for
require(esm) - but that is luck, not a declared contract.
Finding 4 - lockfile is consistent with the manifest (no issue)
The +58/-530 is large but entirely accounted for. package.json changes one line
(^7.0.1 -> ^8.0.0); @resvg/resvg-js is untouched and its platform binaries remain in the tree.
Every removed entry is a 7.x-only transitive: archiver-utils and its lodash / graceful-fs,
and the glob v10 subtree that came with it (path-scurry, minipass, lru-cache, jackspeak,
foreground-child, cross-spawn, @isaacs/cliui, and the whole string-width-cjs /
strip-ansi-cjs / wrap-ansi-cjs duplication). That accounts for the bulk of the -530.
Every added or rewritten entry is an 8.x transitive: zip-stream@7.0.5, compress-commons@7.0.1,
crc32-stream@7.0.1, is-stream@4.0.1, readdir-glob@3.0.0 with minimatch@10.2.6,
brace-expansion@5.0.9, balanced-match@4.0.4. 8.0.0 dropping archiver-utils, lodash and
glob is the whole reason the tree shrinks.
No unrelated dependency is dropped or altered, and npm ci against the lockfile succeeds
(46 packages).
Verdict
Approving. Not because the checks are green - they exercise nothing here - but because the call
shape in tools/build-pack.mjs was measured against both versions and only works on 8.0.0. Not
merging leaves npm run build throwing a TypeError.
Findings 2 and 3 are real, but neither is caused by this PR and neither is made worse by it. They
belong in their own issues: a CI job that actually builds, and an engines floor that matches what
the code needs.
1 participant
Bumps the npm-major group with 1 update: archiver.
Updates
archiverfrom 7.0.1 to 8.0.0Release notes
Sourced from archiver's releases.
... (truncated)
Changelog
Sourced from archiver's changelog.
Commits
52d1d34release 8.0.0 (#832)5547c6dUpdate dependency zip-stream to v7.0.5 (#837)08c7370Update release-drafter/release-drafter action to v7 (#836)8810635Update dependency mocha to v11 (#806)756d1a1Update docusaurus monorepo to v3.10.1 (#804)74725a7Update dependency rimraf to v6 (#774)0a42a6cUpdate dependency chai to v6 (#834)639553bUpdate dependency zip-stream to v7.0.4 (#830)1d550c6Update actions/checkout action to v6 (#833)fed1618Update dependency yauzl to v3.3.0 (#831)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for archiver since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions