ginkgobioworks / react-json-schema-form-builder / 24573449443

72%

push

github

Pin yaml@^2.8.3 as direct devDependency to stabilize lockfile

Dependabot-generated lockfile updates kept stripping
node_modules/tsup/node_modules/yaml@2.8.3, breaking `npm ci` with
"Missing: yaml@2.8.3 from lock file" on every dependabot PR.

Root cause: tsup's transitive dep postcss-load-config@6.0.1 declares
yaml as an optional peerDependency, and npm's handling of optional
peers in nested packages is inconsistent across npm versions. Whether
the nested entry gets written to the lockfile depends on which npm
version ran `npm install`, so dependabot's environment and a local
install disagree, and npm ci's strict mode rejects the mismatch.

Pin yaml as a top-level devDependency so it's hoisted to
node_modules/yaml and postcss-load-config dedupes against it. This
removes the flaky nested entry entirely and the lockfile stays
stable across dependabot regenerations.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

794 of 1130 branches covered (70.27%)

Branch coverage included in aggregate %.

891 of 1197 relevant lines covered (74.44%)

21.83 hits per line