chore(analytics): bump js-yaml, googleapis, qs, and pnpm by jasonhnd · Pull Request #661 · jasonhnd/jobs

jasonhnd · 2026-09-24T16:06:19Z

Closes #648

Part of #635, order 12. Base is preview (43d1e3b8 at branch time). Predecessor #647 was not on this preview; the parallel-lane ruling says not to wait, and this change does not touch package.json / bun.lock.

Steps

Branch chore/analytics-deps from origin/preview.
analytics/package.json: googleapis ^173 → ^181, js-yaml ^5 → ^5.4.2, packageManager pnpm@11.9.0 → pnpm@12.6.0. engines.node stays >=20.
analytics/pnpm-workspace.yaml: qs: ^6.15.3 → qs: ^6.16.0. Comment block kept.
Lockfile regenerated with pnpm 12.6.0. Resolved versions match the dry-run table: googleapis@181.0.0, googleapis-common@9.1.0, google-auth-library@11.1.0, js-yaml@5.4.2, qs@6.16.0. Lockfile stat for the three analytics files is +213 / −42, the same as the 2026-09-24 dry run. The new lockfile keeps lockfileVersion: '9.0' and adds the pnpm 12 packageManagerDependencies document (pnpm@12.6.0 plus the @pnpm/exe.* entries).
setup-ga4.mjs --dry-run (timestamps stripped): identical, 58 lines both sides. No live GA4 command was run.
Every pnpm@11.9.0 under analytics/ and docs/ is now pnpm@12.6.0. Text only in setup-ga4.mjs (comments) and oauth-init.mjs (log strings). docs/TOOLCHAIN.md §10.1 bun run audit row updated in the first commit.
Root chain below. git diff --exit-code is 0 on the committed tree. Playwright / test:e2e / scripts/e2e-server.cjs were not run: another agent is using port 4321. The rendered-output suite is left to this PR's CI quality run.
CHANGELOG.md ### Security has the Issue's sentence (first commit). Follow-up d7f1d814 marks §11 order 12 — done (#661).

origin/preview moved to 95ac84d6 (#659, Playwright 1.63.0) after this branch was cut. git merge-tree --write-tree HEAD origin/preview exits 0, so the CHANGELOG and §11 edits merge with that commit. This branch was not rebased and was not force-pushed. §11 on this branch therefore does not yet show order 10's done (#659) line; that line is already on preview and stays there.

Count note

The Issue said 24 pnpm@11.9.0 hits on preview 9b4e7197. This preview (43d1e3b8) has 28 (1 in package.json, 27 in the step-6 files: README 15, geo-citation 3, geo-observation 3, oauth-init 3, setup-ga4 2, TOOLCHAIN §10.1 1). All 28 were replaced. Acceptance grep is empty. No other file was edited to chase the old count.

Environment notes (not repo changes)

This shell has CI=true. pnpm 12 then treats a bare pnpm install as frozen, so the first attempt failed with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH before the lockfile could update. The update install was re-run with CI unset, which is the non-CI command the dry run used. The explicit --frozen-lockfile reinstall was run with CI left set.
This shell also sets both NO_COLOR and FORCE_COLOR, so Node prints a pid-specific warning on stderr. Those two variables were unset only for the two --dry-run processes, so 2>&1 compared the script's own lines. Both outputs are 58 lines and diff prints identical.
Local bun is 1.4.0 (34cbb9a40). The Issue does not ask for a private Bun install. bun audit reported no vulnerabilities. Global Bun was not upgraded.
googleapis@181.0.0 declares engines.node >=22. analytics/package.json stays >=20, as the Issue requires. The commands ran on Node v24.20.0.
§2 has no analytics pin row. Step 8 names §11 (and §10.1 is the step-6 string). No §2 row was added.

Verification

Step 4 — first attempt (`CI=true`, lockfile not updated)

Error: ERR_PNPM_LOCKFILE_CONFIG_MISMATCH
  × installing dependencies
  ╰─▶ Cannot proceed with the frozen installation. The current "overrides"
      configuration doesn't match the value found in the lockfile
  help: Update your lockfile using "pnpm install --no-frozen-lockfile"
INSTALL_EXIT:1

grep at that point still showed the old pins (googleapis@173.0.0, js-yaml@5.1.0, qs@6.15.3). corepack pnpm@12.6.0 audit then still reported 5 vulnerabilities (1 high, 4 moderate). node --test was already 3/3 (it does not import these packages).

Step 4 — update install with `CI` unset, then the Issue's frozen reinstall

$ env -u CI corepack pnpm@12.6.0 install
✓ Lockfile passes supply-chain policies (verified 4h ago)
[WARN] 1 deprecated subdependencies found: node-domexception@1.0.0
Packages: +48
dependencies:
+ googleapis 181.0.0
+ js-yaml 5.4.2
Done in 225ms using pnpm v12.6.0
INSTALL_EXIT:0

$ grep -E "^  (googleapis|googleapis-common|js-yaml|qs|google-auth-library)@" pnpm-lock.yaml | sort -u
  google-auth-library@11.1.0:
  googleapis-common@9.1.0:
  googleapis@181.0.0:
  js-yaml@5.4.2:
  qs@6.16.0:

$ rm -rf node_modules && corepack pnpm@12.6.0 install --frozen-lockfile
✓ Lockfile passes supply-chain policies (verified 447ms ago)
Lockfile is up to date, resolution step is skipped
Packages: +48
dependencies:
+ googleapis 181.0.0
+ js-yaml 5.4.2
Done in 138ms using pnpm v12.6.0
FROZEN_EXIT:0

$ corepack pnpm@12.6.0 audit
No known vulnerabilities found
AUDIT_EXIT:0

$ node --test ga4-spec-validation.test.mjs
▶ validateCustomDimensionSpec
  ✔ accepts values exactly at each Admin API length limit (0.533208ms)
  ✔ aggregates description, display-name, and scope-specific parameter errors (0.287708ms)
  ✔ rejects malformed dimension groups and entries (0.61375ms)
✔ validateCustomDimensionSpec (2.027084ms)
ℹ tests 3
ℹ suites 1
ℹ pass 3
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 49.107792
TEST_EXIT:0

Lockfile stat against the three analytics files (matches the dry-run table):

 analytics/package.json        |   6 +-
 analytics/pnpm-lock.yaml      | 247 +++++++++++++++++++++++++++++++++++-------
 analytics/pnpm-workspace.yaml |   2 +-
 3 files changed, 213 insertions(+), 42 deletions(-)

Step 5 — `--dry-run` oracle

git stash, corepack pnpm@11.9.0 install --frozen-lockfile (googleapis 173.0.0, js-yaml 5.1.0), dry-run, git stash pop, corepack pnpm@12.6.0 install --frozen-lockfile (googleapis 181.0.0, js-yaml 5.4.2), dry-run. Timestamps stripped with sed -E 's/^\[[0-9:]+\] //'.

58 /tmp/ga4-old.txt
58 /tmp/ga4-new.txt
diff /tmp/ga4-old.txt /tmp/ga4-new.txt && echo identical
identical
DIFF_EXIT:0

Step 6 — no `pnpm@11.9.0` left

$ grep -rn "pnpm@11\.9\.0" --exclude-dir=node_modules analytics docs
(empty)

Step 7 — root chain

PUBLIC_GA4_MEASUREMENT_ID, PUBLIC_X_PIXEL_ID, and PUBLIC_META_PIXEL_ID were unset.

$ bun run audit
bun audit v1.4.0 (34cbb9a40)
No vulnerabilities found (checked 438 packages) [246.00ms]
No known vulnerabilities found
AUDIT_EXIT:0

$ bun run typecheck
TYPECHECK_EXIT:0

$ bun run test
bun test v1.4.0 (34cbb9a40)
 1725 pass
 0 fail
Ran 1725 tests across 168 files. [4.71s]
TEST_EXIT:0

$ bun run build
[check-lockfile-sync] OK — 13 deps match between package.json and bun.lock.
[check-analytics-config] OK — 6 script-src origins ok, 11 connect-src origins ok, 0 frame-src origins ok, 5 PUBLIC_* env vars documented.
[check-nested-html-comments] OK — scanned 71 files, no nested HTML comments.
... astro static build ...
[build] ✓ Completed in 7.58s.
BUILD_EXIT:0

$ bun run verify:gates
[OK] projections pass L3 consistency checks
[check-geo-freshness] OK - GPT 6 SOL 2026-09-23, 556 occupations, mean=4.55
[check-model-redirects] OK - 12 bare model slug(s) redirect to their latest run
[check-analytics-spec] OK — 36 events / 46 params match analytics/spec.yaml (5 dynamic emit sites declared).
[check-architecture] ✓ all enforced layer boundaries respected
[check-doc-links] OK — 58 tracked Markdown files, 99 local link/image target(s)
[verify-occupation-routes] 556 occupations own 556 unique, indexable routes
✅ Internal-link integrity passed
✅ JSON-LD validation passed — all 843/844 pages structurally valid.
✅ SEO baseline clean — no drift.
[check-page-class] ✓ Page Class System invariants respected
[check-design-sync] OK
[check-type-scale] OK
[check-heading-rules] OK
[check-surface-coverage] OK
[check-contrast] OK
[check-role-color] OK
[check-color-tokens] OK
[compute-csp-hashes] OK — script-src has 24 inline-script hash(es) and matches dist-astro/.
GATES_EXIT:0

Before the commit, git diff --exit-code exited 1. git status listed only the 10 files in this commit (the build and the gates did not dirty the tree). After the commit:

$ git diff --exit-code
DIFF_EXIT:0

Playwright is not in this local log. CI quality runs the rendered-output suite.

Not done here

Live GA4 (setup, setup:check, discover, oauth-init) was not run.
spec.yaml, ga4-spec-validation.mjs, and GA4 logic were not changed.
Root package.json, root bun.lock, and root CI were not changed.
Not merged. CI quality and Vercel were not waited on; this Issue does not ask for a preview inspect or a curl.

js-yaml 5.4.2, googleapis 181, the qs override ^6.16.0, and pnpm 12.6.0 clear the five analytics audit findings. setup-ga4 --dry-run output is unchanged. Refs #648

vercel · 2026-09-24T16:06:25Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
jobs	Ready	Preview	Sep 24, 2026 4:53pm UTC

§11 order 12 now points at the PR that bumps the analytics pnpm project. Refs #648

Orders 10 and 11 (#659, #660) landed on preview while this branch was open. Keep preview's done (#659) and done (#660) and this branch's done (#661) on §11. CHANGELOG keeps both sides' entries. Refs #648

jasonhnd · 2026-09-24T16:53:15Z

Merged latest preview into this branch (ordinary merge, no rebase).

Preview commit: f286ba2621cb493e0fcabd802e9da2e86d4d5052 (f286ba26, Merge pull request ci: upgrade actions/checkout and actions/setup-node from v4 to v7 #660 from jasonhnd/ci/actions-v7)
Merge commit on this branch: 7cac0b2ca86836607d9bdf73c278ab73116f7eea

Conflict was only in docs/TOOLCHAIN.md §11, the queue rows for orders 10–12. CHANGELOG.md auto-merged; both sides' entries are kept (preview's CI / Playwright lines, and this PR's analytics security line). No other file conflicted.

Resolution keeps all three done marks:

| 10 | code | #646 | `@playwright/test` 1.62.1 → **1.63.0** + dedupe `playwright-core` (CI runs Playwright + axe since design-1.20 `f05ba940`) — done (#659) |
| 11 | code | #647 | `.github/workflows/ci.yml`: `actions/checkout` v4 → **v7**, `actions/setup-node` v4 → **v7** — done (#660) |
| 12 | code | #648 | `analytics/`: `js-yaml` → **5.4.2**, `googleapis` → **181**, `qs` override **^6.16.0**, pnpm 11.9.0 → **12.6.0** — done (#661) |

Orders 0–9 and the rest of the file match preview. analytics/** was not edited in the resolution.

Commands after the resolution (working tree stayed clean; git diff --exit-code exited 0 both after install and after the tests):

$ bun install --frozen-lockfile
bun install v1.4.0 (34cbb9a40)

+ @axe-core/playwright@4.13.0
+ @playwright/test@1.63.0
+ @types/node@24.13.6
+ @types/react@19.3.0
+ exceljs@4.4.0
+ fontkitten@1.0.3
+ subset-font@2.9.0
+ typescript@7.0.2
+ @vercel/functions@3.9.9
+ @vercel/og@1.0.1
+ astro@7.3.5
+ react@19.3.0
+ zod@4.6.5

338 packages installed [306.00ms]

$ bun run check:docs-links
$ bun scripts/check-doc-links.cjs
[check-doc-links] OK — 58 tracked Markdown files, 99 local link/image target(s)

$ bun run typecheck
$ node node_modules/typescript/bin/tsc --noEmit

typecheck printed nothing and exited 0.

$ bun run test

bun run test is bun run build:data && bun test src scripts analytics/ga4-spec-validation.test.mjs. It exited 0. Closing lines:

 1725 pass
 0 fail
Ran 1725 tests across 168 files. [4.83s]

chore(analytics): bump js-yaml, googleapis, qs, and pnpm

89038d5

js-yaml 5.4.2, googleapis 181, the qs override ^6.16.0, and pnpm 12.6.0 clear the five analytics audit findings. setup-ga4 --dry-run output is unchanged. Refs #648

jasonhnd added 2 commits September 25, 2026 01:07

docs(toolchain): mark #635 order 12 done in #661

d7f1d81

§11 order 12 now points at the PR that bumps the analytics pnpm project. Refs #648

merge preview into chore/analytics-deps

7cac0b2

Orders 10 and 11 (#659, #660) landed on preview while this branch was open. Keep preview's done (#659) and done (#660) and this branch's done (#661) on §11. CHANGELOG keeps both sides' entries. Refs #648

vercel Bot deployed to Preview September 24, 2026 16:53 View deployment

jasonhnd merged commit 66ec643 into preview Sep 24, 2026
3 checks passed

jasonhnd deleted the chore/analytics-deps branch September 24, 2026 16:56

This was referenced Sep 24, 2026

chore(analytics): js-yaml 5.4.2, googleapis 181, qs override ^6.16.0, pnpm 12.6.0 (clears 5 audit findings) #648

Closed

[UPGRADE] 2026-09 toolchain series (Astro 7.3, security overrides, Bun 1.4.2, TypeScript 7, CI actions v7) #635

Closed

Navigation Menu

chore(analytics): bump js-yaml, googleapis, qs, and pnpm - #661

chore(analytics): bump js-yaml, googleapis, qs, and pnpm#661
jasonhnd merged 3 commits into
previewfrom
chore/analytics-deps

jasonhnd commented Sep 24, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Sep 24, 2026 •

edited

Loading

Uh oh!

jasonhnd commented Sep 24, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

jasonhnd commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Steps

Count note

Environment notes (not repo changes)

Verification

Step 4 — first attempt (CI=true, lockfile not updated)

Step 4 — update install with CI unset, then the Issue's frozen reinstall

Step 5 — --dry-run oracle

Step 6 — no pnpm@11.9.0 left

Step 7 — root chain

Not done here

Uh oh!

vercel Bot commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jasonhnd commented Sep 24, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jasonhnd commented Sep 24, 2026 •

edited

Loading

Step 4 — first attempt (`CI=true`, lockfile not updated)

Step 4 — update install with `CI` unset, then the Issue's frozen reinstall

Step 5 — `--dry-run` oracle

Step 6 — no `pnpm@11.9.0` left

vercel Bot commented Sep 24, 2026 •

edited

Loading