101 lines
3.8 KiB
Plaintext
101 lines
3.8 KiB
Plaintext
The identity of the dependency sets that decide what licenses/inventory.zon has
|
|
to cover. This file is a snapshot, not a source: src/licenses_drift_test.zig
|
|
recomputes each section from build.zig.zon and admin/package-lock.json and fails
|
|
when it disagrees with what is recorded here. Prose before the first section
|
|
header is ignored by the guard.
|
|
|
|
Updating a section without reviewing licenses/inventory.zon defeats the point of
|
|
the guard. When a section changes, work out what the change means for the
|
|
shipped bytes first, then record it.
|
|
|
|
The runtime closure is every lockfile package not marked `dev`. That is a
|
|
superset of what the bundler emits — the guard cannot run rollup — so packages
|
|
tree-shaken out of admin/dist appear here too; the inventory explains each of them
|
|
instead of carrying its licence.
|
|
|
|
The bundled-packages section is the one the Zig guard cannot compute: it is the
|
|
set of npm packages that actually contribute a module to admin/dist, read off the
|
|
sourcemap `sources` lists of a `vite build --sourcemap`. Only the frontend gate
|
|
can produce it, so gates.yml recomputes it there and fails on a difference. It
|
|
is what closes the hole the runtime-closure section leaves open — a package
|
|
already in the closure that application code starts importing changes no
|
|
lockfile and no version, but it does change this list.
|
|
|
|
The base image section is here for the same reason: the container image is a
|
|
released artifact, and the one third-party file it carries that the binary does
|
|
not — the Mozilla CA bundle — comes out of that base. A new tag or a rebuilt
|
|
digest both change the line, which forces somebody to re-read what the new base
|
|
ships before the inventory can claim it.
|
|
|
|
The generators section is the other direction: packages the lockfile marks `dev`
|
|
whose own output nevertheless ends up in admin/dist, and so in the binary. Its
|
|
membership is a judgement, not a query — it was settled by reading a
|
|
`vite build --sourcemap` of admin/, both the sourcemap `sources` lists and the
|
|
regions of each chunk no sourcemap segment maps back to a source file. The
|
|
versions here are read from the lockfile like any other section.
|
|
|
|
[build.zig.zon dependencies]
|
|
mbedtls url=https://github.com/Mbed-TLS/mbedtls/archive/refs/tags/mbedtls-3.6.7.tar.gz hash=N-V-__8AALrvlQKVtYlvv9dpBnbrJfdwR_F0wAgwsvZhAF1Y
|
|
sqlite url=https://sqlite.org/2026/sqlite-amalgamation-3530400.zip hash=N-V-__8AAGVtrgCcOcmjrOJnagmnRyMrcKaOo09KbU-vu8w8
|
|
|
|
[npm runtime closure]
|
|
@internationalized/date 3.12.3 Apache-2.0
|
|
@internationalized/number 3.6.7 Apache-2.0
|
|
@internationalized/string 3.2.10 Apache-2.0
|
|
@react-types/shared 3.36.1 Apache-2.0
|
|
@stylexjs/stylex 0.19.0 MIT
|
|
@swc/helpers 0.5.23 Apache-2.0
|
|
@tanstack/history 1.162.0 MIT
|
|
@tanstack/query-core 5.101.4 MIT
|
|
@tanstack/react-query 5.101.4 MIT
|
|
@tanstack/react-router 1.170.18 MIT
|
|
@tanstack/react-store 0.9.3 MIT
|
|
@tanstack/router-core 1.171.15 MIT
|
|
@tanstack/store 0.9.3 MIT
|
|
aria-hidden 1.2.6 MIT
|
|
client-only 0.0.1 MIT
|
|
clsx 2.1.1 MIT
|
|
cookie-es 3.1.1 MIT
|
|
css-mediaquery 0.1.2 BSD
|
|
invariant 2.2.4 MIT
|
|
isbot 5.2.1 Unlicense
|
|
js-tokens 4.0.0 MIT
|
|
loose-envify 1.4.0 MIT
|
|
react 19.2.8 MIT
|
|
react-aria 3.51.0 Apache-2.0
|
|
react-aria-components 1.20.0 Apache-2.0
|
|
react-dom 19.2.8 MIT
|
|
react-stately 3.49.0 Apache-2.0
|
|
scheduler 0.27.0 MIT
|
|
seroval 1.5.6 MIT
|
|
seroval-plugins 1.5.6 MIT
|
|
styleq 0.2.1 MIT
|
|
tslib 2.8.1 0BSD
|
|
use-sync-external-store 1.6.0 MIT
|
|
|
|
[npm build-time generators whose output ships]
|
|
rolldown 1.1.5 MIT
|
|
vite 8.1.5 MIT
|
|
|
|
[container base image]
|
|
alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce
|
|
|
|
[npm packages bundled into admin/dist]
|
|
@internationalized/string
|
|
@stylexjs/stylex
|
|
@tanstack/history
|
|
@tanstack/query-core
|
|
@tanstack/react-query
|
|
@tanstack/react-router
|
|
@tanstack/react-store
|
|
@tanstack/router-core
|
|
@tanstack/store
|
|
clsx
|
|
react
|
|
react-aria
|
|
react-aria-components
|
|
react-dom
|
|
react-stately
|
|
scheduler
|
|
use-sync-external-store
|