fix[notask]: bump drifted peer ranges + trim redundant SDK peer entries by yuranich · Pull Request #2089 · tetherto/qvac

yuranich · 2026-05-16T09:39:03Z

What problem does this PR solve?

Two related issues in @qvac/sdk's peerDependencies block, both motivated by the same TD-HOLEPUNCH-PEER-DEPS follow-up effort tracked under the QVAC SDK & Platforms project. This PR is the first step — not the full peer-deps cleanup, just the safe-to-land subset.

1. Drifted peer ranges → duplicate copies in consumer `node_modules`

Peer	SDK declared	Resolved by tree	Problem
`compact-encoding`	`^2.19.0`	`2.19.2` held at top by SDK; 17 nested `3.0.x` copies for every `^3.0.0` consumer across the Holepunch tree (hyperswarm, corestore, hypercore, hyperdb, hyperblobs, hyperdht, hyperschema, hyperdispatch, …)	massive duplication + `npm ls invalid` warning on every consumer install

2. Peer entries declared but not owned by the SDK

Peer	Why removable
`bare-dns`	Transitive via `bare-net` (which SDK does peer-declare); SDK source doesn't import it
`bare-http1`	Transitive via `bare-fetch`; SDK source doesn't import it
`bare-https`	Transitive via `bare-fetch`; SDK source doesn't import it — removing entirely instead of bumping, because once SDK stops declaring its own floor, `bare-fetch`'s `^3.0.0` wins naturally
`events`	Only used in `.d.ts` type stubs — `@types/node` already provides the `EventEmitter` type for typecheck; consumers never need the npm `events` package at runtime (Node has it built-in, Bare maps it to `bare-events`)
`tar-stream`	Used in one SDK source site (`server/utils/archive.ts`); no other consumer in the install tree, so no dedup concern from making it a hard dep

How does it solve it?

packages/sdk/package.json only — no source changes.

Bump (within peerDependencies)

- "compact-encoding": "^2.19.0",
+ "compact-encoding": "^3.0.0",

Remove from peerDependencies entirely

- "bare-dns": "^2.1.4",
- "bare-http1": "^4.1.6",
- "bare-https": "^2.1.3",

Reclassify (move out of peerDependencies)

  dependencies: {
+   "tar-stream": "^3.1.8",
  }
  devDependencies: {
+   "events": "^3.3.0",
  }
  peerDependencies: {
-   "events": "^3.3.0",
-   "tar-stream": "^3.1.8"
  }

Expected dedup impact

Change	Effect	Remaining caveat
`compact-encoding → ^3.0.0`	Major dedup. 17+ nested copies of `3.0.x` collapse to a single top-level; silences the `invalid: "^2.19.0" from node_modules/@qvac/sdk` warnings on every consumer's `npm ls`.	A nested `2.19.x` copy still ships under `hyperdb@4.22.x` and `bare-channel@5.2.3` (both still on `^2.x`). Goes away when those upstream packages bump.
`bare-https` removed	Full dedup. SDK was the only `^2` holdout — removing instead of bumping lets `bare-fetch`'s `^3.0.0` win naturally. Single top-level copy.	None
Other removed/reclassified peers	No dedup change; tightens the peer block to what the SDK actually owns, eliminates `npm install` warnings for the yarn 1 / `legacy-peer-deps=true` audience on the three entries the SDK never imported anyway.	None

Considered but kept

llm-splitter — initially proposed for removal because @qvac/rag declares it as its own peer. Closer inspection (and E2E confirmation) showed @qvac/rag marks it optional: true in peerDependenciesMeta, which means npm skips installation by default — only npm install --include=optional pulls it in. Removing the SDK-level required peer broke the LLMChunkAdapter path at runtime (caught by smoke E2E: rag-embeddings-small-chunks, rag-large-document-32kb, rag-medium-document-10kb all failed with "Required dependency missing: llm-splitter is required for LLMChunkAdapter"). The SDK-layer required peer is what guarantees the package is in consumer trees. Revisit if @qvac/rag promotes llm-splitter from optional to required, or bundles it as a hard dep.

Out of scope (deferred)

bare-subprocess → ^6.0.0: only bare-link@3.2.2 in the SDK tree requires v6 (5-day-old release at original audit). bare-runtime@1.x — the runtime SDK code executes in — is still on ^5.0.0. Bumping would only flip which version sits at the top (still two copies until upstream bare-runtime moves). Revisit later.
bare-fetch → ^3.0.0: floor stale (latest 3.0.1, 2 weeks old), no duplication in the tree today. Marginal upside.
compact-encoding peer → dep / drop entirely: defensible to leave as a peer since the rest of the Holepunch stack declares it that way. Out of scope here.
The remaining 15+ bare-* peers that ARE used by SDK source (bare-fs, bare-path, bare-rpc, etc.) — those are correctly classified as peers per Bare runtime stdlib convention (stateful singletons).

Source-impact verification

bare-dns / bare-http1 / bare-https: not imported by any SDK source file. Removing from peers is pure metadata.
events: only referenced in .d.ts type stubs under packages/sdk/types/{bare-net,corestore,hyperdrive,hyperswarm,bare-subprocess,pear-pipe}/index.d.ts. @types/node@^24 is already in devDependencies and provides the EventEmitter type. Moving events to devDependencies keeps the SDK build self-contained without forcing it on consumers.
tar-stream: imported once at server/utils/archive.ts (extract sharded model archives). No other consumer in the SDK install tree. Moving to dependencies doesn't change the install footprint, and matches its single-consumer-in-tree status.
compact-encoding: imported once at packages/sdk/pear/pre.ts as cenc.encode(cenc.any, …) / cenc.decode(cenc.any, …). Verified at audit time that v3.0.1 has identical encode/decode/any exports and round-trips identically with v2.19.2.

How was it tested?

bun install in packages/sdk — clean.
bun run typecheck — clean.
Dedup verification via /tmp/sdk-dedup-check.sh against a freshly-packed @qvac/sdk@0.11.0 in a clean consumer project — ✅ PASS, no Holepunch singletons duplicated (single copy of corestore, hyperblobs, hyperdb, hyperdht, hyperdrive, hyperswarm each).
E2E smoke on macOS caught the initial wrong llm-splitter removal (3 RAG tests failed); confirmed restored after revert.

🔌 API Changes

None.

Two related changes to the SDK's `peerDependencies` block, both motivated by the same TD-HOLEPUNCH-PEER-DEPS follow-up effort: keep the peer block to what the SDK actually owns, and stop shipping duplicate copies of stateful Holepunch / bare-* singletons in consumer trees. Drifted ranges bumped: - compact-encoding ^2.19.0 -> ^3.0.0 (major dedup: 17+ nested ^3.x copies across hyperswarm/corestore/hypercore/ hyperdb/hyperblobs/hyperdht/hyperschema/ hyperdispatch/protomux/... collapse to a single top-level; silences the `npm ls invalid` warning on every consumer install) Redundant peer entries removed: - bare-dns (transitive via bare-net; SDK doesn't import it; no need to re-declare a floor on what bare-net already pins) - bare-http1 (transitive via bare-fetch; same reasoning) - bare-https (transitive via bare-fetch; removing entirely instead of bumping ^2.1.3 -> ^3.0.0 — once SDK stops declaring its own floor, bare-fetch's ^3.0.0 wins and the duplication resolves) Moved out of peerDependencies (still listed where SDK source needs them): - events -> devDependencies (only used by `.d.ts` type stubs; @types/node already provides the EventEmitter type; consumers don't need the npm `events` package at runtime — Node has it built-in and Bare maps it to bare-events) - tar-stream -> dependencies (used in server/utils/archive.ts; no other consumer in the install tree so no dedup concern from making it a hard dep) llm-splitter KEPT as a required SDK peer. @qvac/rag declares it as an *optional* peer in its own manifest, which means npm skips installation unless --include=optional is passed. Removing the SDK-level required peer broke the LLMChunkAdapter path at runtime (caught by E2E smoke: rag- embeddings-small-chunks, rag-large-document-32kb, rag-medium-document-10kb all failed with "Required dependency missing: llm-splitter is required for LLMChunkAdapter"). The SDK-layer required peer is what guarantees the package is installed in consumer trees. Revisit if @qvac/rag ever promotes llm-splitter from optional to required, or bundles it as a hard dep. bare-subprocess v6 still deferred for the same reason as before: the only v6 consumer in the SDK tree today is bare-link@3.2.2 (5-day-old release at original audit time), and bare-runtime@1.x is still firmly on ^5.0.0. Revisit when bare-runtime catches up. This is the first step of the broader peer-deps cleanup effort tracked in the QVAC SDK & Platforms Asana project. Future steps may consider moving compact-encoding out of peers entirely and auditing the remaining optional peers, but those are out of scope here. No source changes; package.json metadata only. Validation: - `bun install` in packages/sdk -> clean. - `bun run build` -> clean. - Dedup check via `/tmp/sdk-dedup-check.sh` against packed SDK -> ✅ no Holepunch singletons duplicated. - E2E smoke catch on initial revision (no llm-splitter) confirmed the removal was wrong; reverted. Co-authored-by: Cursor <cursoragent@cursor.com>

github-actions · 2026-05-19T14:37:23Z

QVAC E2E — `android` — ✅ all tests passed (83/91, 2331s)

Config: suite=smoke · filter=(none) · exclude=(none)
View run · Artifacts: reports · Device Farm logs

github-actions · 2026-05-19T14:37:25Z

QVAC E2E — `windows` — ⚠️ no results

Config: suite=smoke · filter=(none) · exclude=(none)
View run · Artifacts: reports

The test job did not produce a results artifact. Check the run for job-level failures.

github-actions · 2026-05-19T14:37:27Z

QVAC E2E — `linux` — ✅ all tests passed (91/91, 271s)

Config: suite=smoke · filter=(none) · exclude=(none)
View run · Artifacts: reports

github-actions · 2026-05-19T14:37:29Z

QVAC E2E — `macos` — ✅ all tests passed (91/91, 355s)

Config: suite=smoke · filter=(none) · exclude=(none)
View run · Artifacts: reports

github-actions · 2026-05-19T14:37:34Z

QVAC E2E — `ios` — ✅ all tests passed (82/91, 1169s)

Config: suite=smoke · filter=(none) · exclude=(none)
View run · Artifacts: reports · Device Farm logs

yuranich · 2026-05-19T17:38:28Z

/review

github-actions · 2026-05-19T17:38:59Z

Tier-based Approval Status

**PR Tier:** TIER1

**Current Status:** ✅ APPROVED

**Requirements:**
- 1 Team Member approval ✅ (1/1)
- 1 Team Lead OR Management approval ✅ (1/1)



---
*This comment is automatically updated when reviews change.*

* fix: drop SDK peerDependencies; enforce in CI Completes the peer-deps cleanup trajectory started in #2089 by removing the peerDependencies + peerDependenciesMeta blocks from @qvac/sdk entirely and adding a CI gate that asserts the invariant holds on every SDK pod PR. Policy: - dependencies: every package directly imported by SDK source. - devDependencies: build / typecheck / lint-only modules. - No peer declarations -- host owns anything SDK doesn't import. CI gate (.github/workflows/pr-checks-sdk-pod.yml, sdk-only): - Packs the tarball and installs it into a fresh consumer dir. - Fails on any ERESOLVE / `npm warn peer` line on install. - Fails if any of corestore / hyperswarm / hyperdrive / hyperdb / hyperblobs / hyperdht resolves to more than one copy. - Smoke-imports @qvac/sdk and asserts >= 50 named exports. * fix: split SDK conditional modules into optionalDependencies Promote the 7 packages that are runtime-conditional (per-platform or per-feature) from devDependencies into optionalDependencies: - @modelcontextprotocol/sdk (MCP, only if hosting an MCP server) - bare-link (Bare-only linker shim) - compact-encoding (pin to ^3 to dedupe Holepunch v3 tree) - expo-device (Expo runtime only) - expo-file-system (Expo runtime only) - pear-pipe (Pear runtime only) - react-native-bare-kit (RN/Expo runtime only) Why not regular dependencies: - Backend consumers (npm install --omit=optional) get a 182-package tree instead of 790; mobile/Pear consumers get the plug-n-play default with all 7 auto-installed. Why not peerDependencies: - npm 7+ auto-installs peers and emits ERESOLVE on range drift, which is the exact failure mode this PR is fixing for Keet. Validated: - Keet-shape repro (cross-worker-bare-kit@^2 + @qvac/sdk): 0 ERESOLVE. - Default install: 0 peer warnings, 7/7 optionals present. - --omit=optional: 0 peer warnings, lean tree, Holepunch invariant still holds (single copy of corestore / hyperswarm / hyperdrive / hyperdb / hyperblobs / hyperdht / react-native-bare-kit). * test[ci]: add --omit=optional install gate to SDK consumer check The default-install gate validates the plug-n-play path (all optionals present); it does not exercise the lean backend path that consumers get with `npm install --omit=optional`. That path was implicitly trusted when we adopted optionalDependencies in the previous commit. Refactor the inline gate into a check_consumer() helper and call it twice: 1. Default install (plug-n-play): all 7 optionalDeps installed. Catches Keet-style ERESOLVE from optional deps' peer ranges colliding with other deps. Validates mobile/Pear consumer profile. 2. Lean install (--omit=optional): no optionalDeps. Catches (a) backend-required packages accidentally classified as optional, (b) SDK entry-point eagerly importing an optional module. Both scenarios run the same three assertions: - No ERESOLVE / `npm warn peer` lines. - Single copy of corestore / hyperswarm / hyperdrive / hyperdb / hyperblobs / hyperdht. - Smoke import yields >= 50 named exports. Validated locally: lean install yields 385 named exports (well above threshold), Holepunch invariant holds, 0 peer warnings. Adds ~60s of CI per SDK pod PR. * update dev deps * fix: address review — restore expo-build-properties; revert bare-subprocess major bump - Add expo-build-properties to optionalDependencies. withQvacSDK wires it by string into the Expo plugin chain, so dropping it entirely broke plug-n-play for Expo consumers (the consumer-install gate runs in a Node consumer dir, so it didn't catch the missing Expo plugin module). Keeping it optional preserves the previous behavior while letting Node-only backends skip it via --omit=optional. - Revert bare-subprocess to ^5.2.3 (was bumped to ^6.0.0 by bun add). v5→v6 is a major bump for what is only a dev-time shim consumed by scripts/bare-bootstrap.js; staying on the prior major avoids dragging drift into the dev tree and keeps NOTICE accurate. Validated: - bun install + bun run build clean. - Consumer install gate (default + --omit=optional): both green, Holepunch invariant holds, 385 named exports. * chore: drop hyperdb + hyperblobs from SDK dependencies Neither package is imported by SDK source — they were guarantor pins for @qvac/registry-client, which declares both as non-optional peerDependencies. npm 7+ auto-installs non-optional peers, so the consumer install graph is unchanged: hyperdb and hyperblobs still resolve to a single copy in both default and --omit=optional installs, satisfied by registry-client's own peer ranges. Aligns with the "declare what you import, nothing else" policy. Validated: - bun install + bun run build clean. - Default install (790 pkgs): single copy of corestore / hyperswarm / hyperdrive / hyperdb / hyperblobs / hyperdht. - --omit=optional install (182 pkgs): same. - 0 peer warnings in both scenarios; 385 named exports.

…es (#2089) Two related changes to the SDK's `peerDependencies` block, both motivated by the same TD-HOLEPUNCH-PEER-DEPS follow-up effort: keep the peer block to what the SDK actually owns, and stop shipping duplicate copies of stateful Holepunch / bare-* singletons in consumer trees. Drifted ranges bumped: - compact-encoding ^2.19.0 -> ^3.0.0 (major dedup: 17+ nested ^3.x copies across hyperswarm/corestore/hypercore/ hyperdb/hyperblobs/hyperdht/hyperschema/ hyperdispatch/protomux/... collapse to a single top-level; silences the `npm ls invalid` warning on every consumer install) Redundant peer entries removed: - bare-dns (transitive via bare-net; SDK doesn't import it; no need to re-declare a floor on what bare-net already pins) - bare-http1 (transitive via bare-fetch; same reasoning) - bare-https (transitive via bare-fetch; removing entirely instead of bumping ^2.1.3 -> ^3.0.0 — once SDK stops declaring its own floor, bare-fetch's ^3.0.0 wins and the duplication resolves) Moved out of peerDependencies (still listed where SDK source needs them): - events -> devDependencies (only used by `.d.ts` type stubs; @types/node already provides the EventEmitter type; consumers don't need the npm `events` package at runtime — Node has it built-in and Bare maps it to bare-events) - tar-stream -> dependencies (used in server/utils/archive.ts; no other consumer in the install tree so no dedup concern from making it a hard dep) llm-splitter KEPT as a required SDK peer. @qvac/rag declares it as an *optional* peer in its own manifest, which means npm skips installation unless --include=optional is passed. Removing the SDK-level required peer broke the LLMChunkAdapter path at runtime (caught by E2E smoke: rag- embeddings-small-chunks, rag-large-document-32kb, rag-medium-document-10kb all failed with "Required dependency missing: llm-splitter is required for LLMChunkAdapter"). The SDK-layer required peer is what guarantees the package is installed in consumer trees. Revisit if @qvac/rag ever promotes llm-splitter from optional to required, or bundles it as a hard dep. bare-subprocess v6 still deferred for the same reason as before: the only v6 consumer in the SDK tree today is bare-link@3.2.2 (5-day-old release at original audit time), and bare-runtime@1.x is still firmly on ^5.0.0. Revisit when bare-runtime catches up. This is the first step of the broader peer-deps cleanup effort tracked in the QVAC SDK & Platforms Asana project. Future steps may consider moving compact-encoding out of peers entirely and auditing the remaining optional peers, but those are out of scope here. No source changes; package.json metadata only. Validation: - `bun install` in packages/sdk -> clean. - `bun run build` -> clean. - Dedup check via `/tmp/sdk-dedup-check.sh` against packed SDK -> ✅ no Holepunch singletons duplicated. - E2E smoke catch on initial revision (no llm-splitter) confirmed the removal was wrong; reverted. Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: drop SDK peerDependencies; enforce in CI Completes the peer-deps cleanup trajectory started in #2089 by removing the peerDependencies + peerDependenciesMeta blocks from @qvac/sdk entirely and adding a CI gate that asserts the invariant holds on every SDK pod PR. Policy: - dependencies: every package directly imported by SDK source. - devDependencies: build / typecheck / lint-only modules. - No peer declarations -- host owns anything SDK doesn't import. CI gate (.github/workflows/pr-checks-sdk-pod.yml, sdk-only): - Packs the tarball and installs it into a fresh consumer dir. - Fails on any ERESOLVE / `npm warn peer` line on install. - Fails if any of corestore / hyperswarm / hyperdrive / hyperdb / hyperblobs / hyperdht resolves to more than one copy. - Smoke-imports @qvac/sdk and asserts >= 50 named exports. * fix: split SDK conditional modules into optionalDependencies Promote the 7 packages that are runtime-conditional (per-platform or per-feature) from devDependencies into optionalDependencies: - @modelcontextprotocol/sdk (MCP, only if hosting an MCP server) - bare-link (Bare-only linker shim) - compact-encoding (pin to ^3 to dedupe Holepunch v3 tree) - expo-device (Expo runtime only) - expo-file-system (Expo runtime only) - pear-pipe (Pear runtime only) - react-native-bare-kit (RN/Expo runtime only) Why not regular dependencies: - Backend consumers (npm install --omit=optional) get a 182-package tree instead of 790; mobile/Pear consumers get the plug-n-play default with all 7 auto-installed. Why not peerDependencies: - npm 7+ auto-installs peers and emits ERESOLVE on range drift, which is the exact failure mode this PR is fixing for Keet. Validated: - Keet-shape repro (cross-worker-bare-kit@^2 + @qvac/sdk): 0 ERESOLVE. - Default install: 0 peer warnings, 7/7 optionals present. - --omit=optional: 0 peer warnings, lean tree, Holepunch invariant still holds (single copy of corestore / hyperswarm / hyperdrive / hyperdb / hyperblobs / hyperdht / react-native-bare-kit). * test[ci]: add --omit=optional install gate to SDK consumer check The default-install gate validates the plug-n-play path (all optionals present); it does not exercise the lean backend path that consumers get with `npm install --omit=optional`. That path was implicitly trusted when we adopted optionalDependencies in the previous commit. Refactor the inline gate into a check_consumer() helper and call it twice: 1. Default install (plug-n-play): all 7 optionalDeps installed. Catches Keet-style ERESOLVE from optional deps' peer ranges colliding with other deps. Validates mobile/Pear consumer profile. 2. Lean install (--omit=optional): no optionalDeps. Catches (a) backend-required packages accidentally classified as optional, (b) SDK entry-point eagerly importing an optional module. Both scenarios run the same three assertions: - No ERESOLVE / `npm warn peer` lines. - Single copy of corestore / hyperswarm / hyperdrive / hyperdb / hyperblobs / hyperdht. - Smoke import yields >= 50 named exports. Validated locally: lean install yields 385 named exports (well above threshold), Holepunch invariant holds, 0 peer warnings. Adds ~60s of CI per SDK pod PR. * update dev deps * fix: address review — restore expo-build-properties; revert bare-subprocess major bump - Add expo-build-properties to optionalDependencies. withQvacSDK wires it by string into the Expo plugin chain, so dropping it entirely broke plug-n-play for Expo consumers (the consumer-install gate runs in a Node consumer dir, so it didn't catch the missing Expo plugin module). Keeping it optional preserves the previous behavior while letting Node-only backends skip it via --omit=optional. - Revert bare-subprocess to ^5.2.3 (was bumped to ^6.0.0 by bun add). v5→v6 is a major bump for what is only a dev-time shim consumed by scripts/bare-bootstrap.js; staying on the prior major avoids dragging drift into the dev tree and keeps NOTICE accurate. Validated: - bun install + bun run build clean. - Consumer install gate (default + --omit=optional): both green, Holepunch invariant holds, 385 named exports. * chore: drop hyperdb + hyperblobs from SDK dependencies Neither package is imported by SDK source — they were guarantor pins for @qvac/registry-client, which declares both as non-optional peerDependencies. npm 7+ auto-installs non-optional peers, so the consumer install graph is unchanged: hyperdb and hyperblobs still resolve to a single copy in both default and --omit=optional installs, satisfied by registry-client's own peer ranges. Aligns with the "declare what you import, nothing else" policy. Validated: - bun install + bun run build clean. - Default install (790 pkgs): single copy of corestore / hyperswarm / hyperdrive / hyperdb / hyperblobs / hyperdht. - --omit=optional install (182 pkgs): same. - 0 peer warnings in both scenarios; 385 named exports.

yuranich requested review from a team as code owners May 16, 2026 09:39

yuranich force-pushed the fix/sdk-peer-drift-bump branch from eb6255c to b812fbb Compare May 18, 2026 07:46

yuranich changed the title ~~fix[notask]: bump drifted peer ranges in SDK (compact-encoding v3, bare-https v3, bare-subprocess v6)~~ fix[notask]: bump drifted peer ranges in SDK (compact-encoding v3, bare-https v3) May 18, 2026

yuranich force-pushed the fix/sdk-peer-drift-bump branch from b812fbb to 50afa6c Compare May 19, 2026 10:18

yuranich changed the title ~~fix[notask]: bump drifted peer ranges in SDK (compact-encoding v3, bare-https v3)~~ fix[notask]: bump drifted peer ranges + trim redundant SDK peer entries May 19, 2026

yuranich force-pushed the fix/sdk-peer-drift-bump branch from 50afa6c to ba9e1ab Compare May 19, 2026 13:16

yuranich added test-e2e-smoke Triggers smoke e2e test suite [Currently SDK-only] verified Authorize secrets / label-gate in PR workflows labels May 19, 2026

yuranich temporarily deployed to release May 19, 2026 13:21 — with GitHub Actions Inactive

This comment has been minimized.

Sign in to view

yuranich temporarily deployed to release May 19, 2026 13:25 — with GitHub Actions Inactive

yuranich temporarily deployed to release May 19, 2026 13:34 — with GitHub Actions Inactive

yuranich temporarily deployed to release May 19, 2026 13:51 — with GitHub Actions Inactive

yuranich temporarily deployed to release May 19, 2026 14:06 — with GitHub Actions Inactive

github-actions Bot added the e2e-tested Test suite has run on this PR. Does not indicate tests pass/fail - see results in comments. label May 19, 2026

yuranich force-pushed the fix/sdk-peer-drift-bump branch from ba9e1ab to 4fce30d Compare May 19, 2026 14:28

opaninakuffo added the test-e2e-smoke Triggers smoke e2e test suite [Currently SDK-only] label May 19, 2026

opaninakuffo temporarily deployed to release May 19, 2026 14:37 — with GitHub Actions Inactive

opaninakuffo had a problem deploying to release May 19, 2026 14:37 — with GitHub Actions Failure

opaninakuffo temporarily deployed to release May 19, 2026 14:47 — with GitHub Actions Inactive

opaninakuffo temporarily deployed to release May 19, 2026 15:01 — with GitHub Actions Inactive

opaninakuffo temporarily deployed to release May 19, 2026 15:09 — with GitHub Actions Inactive

opaninakuffo temporarily deployed to release May 19, 2026 15:42 — with GitHub Actions Inactive

opaninakuffo approved these changes May 19, 2026

View reviewed changes

Merge branch 'main' into fix/sdk-peer-drift-bump

894a338

yuranich temporarily deployed to release May 19, 2026 17:30 — with GitHub Actions Inactive

NamelsKing approved these changes May 19, 2026

View reviewed changes

yuranich merged commit 84f982d into tetherto:main May 19, 2026
19 of 20 checks passed

opaninakuffo mentioned this pull request May 19, 2026

QVAC-19141 fix: drop SDK peerDependencies; enforce in CI #2126

Merged

opaninakuffo mentioned this pull request Jun 5, 2026

QVAC-20395 fix: reclassify SDK deps to optional peers, drop optionalDependencies #2474

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix[notask]: bump drifted peer ranges + trim redundant SDK peer entries#2089

fix[notask]: bump drifted peer ranges + trim redundant SDK peer entries#2089
yuranich merged 3 commits into
tetherto:mainfrom
yuranich:fix/sdk-peer-drift-bump

yuranich commented May 16, 2026 •

edited

Loading

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

github-actions Bot commented May 19, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 19, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 19, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 19, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 19, 2026 •

edited

Loading

Uh oh!

yuranich commented May 19, 2026

Uh oh!

github-actions Bot commented May 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

yuranich commented May 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What problem does this PR solve?

1. Drifted peer ranges → duplicate copies in consumer node_modules

2. Peer entries declared but not owned by the SDK

How does it solve it?

Bump (within peerDependencies)

Remove from peerDependencies entirely

Reclassify (move out of peerDependencies)

Expected dedup impact

Considered but kept

Out of scope (deferred)

Source-impact verification

How was it tested?

🔌 API Changes

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

github-actions Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

QVAC E2E — android — ✅ all tests passed (83/91, 2331s)

Uh oh!

github-actions Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

QVAC E2E — windows — ⚠️ no results

Uh oh!

github-actions Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

QVAC E2E — linux — ✅ all tests passed (91/91, 271s)

Uh oh!

github-actions Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

QVAC E2E — macos — ✅ all tests passed (91/91, 355s)

Uh oh!

github-actions Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

QVAC E2E — ios — ✅ all tests passed (82/91, 1169s)

Uh oh!

yuranich commented May 19, 2026

Uh oh!

github-actions Bot commented May 19, 2026

Tier-based Approval Status

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

yuranich commented May 16, 2026 •

edited

Loading

1. Drifted peer ranges → duplicate copies in consumer `node_modules`

github-actions Bot commented May 19, 2026 •

edited

Loading

QVAC E2E — `android` — ✅ all tests passed (83/91, 2331s)

github-actions Bot commented May 19, 2026 •

edited

Loading

QVAC E2E — `windows` — ⚠️ no results

github-actions Bot commented May 19, 2026 •

edited

Loading

QVAC E2E — `linux` — ✅ all tests passed (91/91, 271s)

github-actions Bot commented May 19, 2026 •

edited

Loading

QVAC E2E — `macos` — ✅ all tests passed (91/91, 355s)

github-actions Bot commented May 19, 2026 •

edited

Loading

QVAC E2E — `ios` — ✅ all tests passed (82/91, 1169s)