ci: use locked ESM smoke dependencies by jasonsaayman · Pull Request #11128 · axios/axios

jasonsaayman · 2026-08-04T17:06:14Z

Summary

Fixes CI runs

Linked issue

N/A

Changes

N/A

Checklist

Tests added or updated (or N/A with reason)
Docs/types updated if public API changed (index.d.ts and index.d.cts)
No breaking changes (or called out explicitly above)

Summary by cubic

Lock ESM smoke test dependencies and switch CI to use npm ci for deterministic installs on npm 10, reducing flakiness in ESM smoke runs. Updates the tests/smoke/esm lockfile to pin versions and align with newer vite/rolldown.

Description

Summary of changes
- CI: replace npm install with npm ci --ignore-scripts for tests/smoke/esm.
- Update tests/smoke/esm/package-lock.json to lock deps (e.g. [email protected], [email protected], [email protected], [email protected], [email protected]).
- Pin @rolldown/* native bindings to 1.2.2; remove wasm/emnapi optional deps from the lockfile.
Reasoning
- npm ci enforces reproducible installs under npm 10 and prevents drift from upstream minor releases.
- Newer vite/rolldown match current engines and stabilize the ESM smoke build.
Additional context
- Affects only CI and the tests/smoke/esm fixture; no runtime or public API changes.

Docs

Suggest adding a short note in /docs/ (e.g., contributing/CI) that smoke test fixtures should be installed with npm ci --ignore-scripts and keep their lockfiles committed.

Testing

No new tests. ESM smoke tests continue to run in CI with the locked dependencies. Additional tests are not needed for this CI-only change.

Semantic version impact

None. CI/test-only changes with no impact on published packages.

^{Written for commit fd747ca. Summary will update on new commits.}

Copilot

Pull request overview

This PR aims to stabilize CI by making the ESM smoke test dependency installation deterministic, ensuring the ESM smoke suite uses the committed lockfile rather than resolving dependencies at install time.

Changes:

Updated tests/smoke/esm/package-lock.json to lock updated ESM smoke test tooling dependencies (notably vitest).
Switched the ESM smoke workflow step from npm install to npm ci to enforce lockfile-based installs in CI.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
tests/smoke/esm/package-lock.json	Updates locked dependency graph for the ESM smoke test workspace (including `vitest` bump).
.github/workflows/run-ci.yml	Uses `npm ci` for ESM smoke dependency install to ensure reproducible CI runs.

Files not reviewed (1)

tests/smoke/esm/package-lock.json: Generated file

greptile-apps · 2026-08-04T17:13:21Z

Greptile Summary

This change makes ESM smoke-test dependency installation reproducible by using the checked-in lockfile with npm ci and refreshing the locked Vitest dependency graph.

The ESM smoke path was checked by building and packing axios locally, installing the packed tarball in the ESM workspace after npm ci --ignore-scripts, and running the Vitest smoke suite. All 16 test files and 74 tests passed on Node 24. No defects were found.

Confidence Score: 5/5

T-Rex Logs

What T-Rex did

T-Rex built and packed axios locally and installed the package into isolated ESM smoke-test workspaces.
T-Rex ran the parent install path and the npm ci --ignore-scripts path, then executed npm run test:smoke:esm:vitest in each workspace.
T-Rex observed that both runs exited successfully with all 16 ESM smoke files and 74 tests passing.
Artifacts were prepared to support review, including the ESM smoke CI comparison harness and the two workflow logs.

_{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "Merge branch 'v1.x' into fix/esm-smoke-n..." | Re-trigger Greptile}

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [axios](https://axios-http.com) ([source](https://github.com/axios/axios)) | [`1.18.1` → `1.20.0`](https://renovatebot.com/diffs/npm/axios/1.18.1/1.20.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/axios/1.20.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/axios/1.18.1/1.20.0?slim=true) | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/99) for more information. --- ### Release Notes <details> <summary>axios/axios (axios)</summary> ### [`v1.20.0`](https://github.com/axios/axios/releases/tag/v1.20.0) [Compare Source](axios/axios@v1.19.0...v1.20.0) #### v1.20.0 — August 19, 2026 This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation. #### ⚠️ Breaking Changes & Deprecations - HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. ([#11082](axios/axios#11082)) #### 🔒 Security Fixes - Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. ([#11141](axios/axios#11141)) #### 🐛 Bug Fixes - Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. ([#11087](axios/axios#11087), [#11118](axios/axios#11118)) - Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. ([#11109](axios/axios#11109)) - XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. ([#11094](axios/axios#11094), [#11121](axios/axios#11121)) - Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. ([#11091](axios/axios#11091)) - Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. ([#11096](axios/axios#11096)) #### 🔧 Maintenance & Chores - Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. ([#11092](axios/axios#11092), [#11098](axios/axios#11098), [#11099](axios/axios#11099), [#11106](axios/axios#11106), [#11107](axios/axios#11107), [#11122](axios/axios#11122), [#11123](axios/axios#11123), [#11126](axios/axios#11126), [#11127](axios/axios#11127), [#11133](axios/axios#11133), [#11140](axios/axios#11140), [#11143](axios/axios#11143), [#11144](axios/axios#11144)) - Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. ([#11101](axios/axios#11101), [#11113](axios/axios#11113), [#11097](axios/axios#11097), [#11119](axios/axios#11119)) - Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. ([#11124](axios/axios#11124), [#11136](axios/axios#11136), [#11137](axios/axios#11137)) - CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. ([#11128](axios/axios#11128), [#11152](axios/axios#11152)) #### 🌟 New Contributors We are thrilled to welcome our new contributors. Thank you for helping improve axios: - [@yens1](https://github.com/yens1) ([#11109](axios/axios#11109)) - [@Sasireddy001](https://github.com/Sasireddy001) ([#11113](axios/axios#11113)) - [@ari-token-security](https://github.com/ari-token-security) ([#11094](axios/axios#11094)) - [@timothyokooboh](https://github.com/timothyokooboh) ([#11097](axios/axios#11097)) - [@gi9439041-png](https://github.com/gi9439041-png) ([#11119](axios/axios#11119)) - [@Hashim1999164](https://github.com/Hashim1999164) ([#11082](axios/axios#11082)) - [@v-dev-cl](https://github.com/v-dev-cl) ([#11091](axios/axios#11091)) - [@r0h1tb](https://github.com/r0h1tb) ([#11118](axios/axios#11118)) - [@ostapondo](https://github.com/ostapondo) ([#11121](axios/axios#11121)) Full Changelog (<axios/axios@v1.19.0...v1.20.0>) ### [`v1.19.0`](https://github.com/axios/axios/blob/HEAD/CHANGELOG.md#v1190--July-22-2026) [Compare Source](axios/axios@v1.18.1...v1.19.0) This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "before 9am on tuesday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://code.futo.org/harbor/harbor/pulls/1808

ci: use locked ESM smoke dependencies

fd747ca

Copilot AI lite review requested due to automatic review settings August 4, 2026 17:06

jasonsaayman self-assigned this Aug 4, 2026

jasonsaayman added the commit::fix The PR is related to a bugfix label Aug 4, 2026

Copilot started reviewing on behalf of jasonsaayman August 4, 2026 17:06

View session

Merge branch 'v1.x' into fix/esm-smoke-npm10-ci

6756420

Copilot AI reviewed Aug 4, 2026

View reviewed changes

jasonsaayman merged commit ac28131 into v1.x Aug 4, 2026
29 checks passed

jasonsaayman deleted the fix/esm-smoke-npm10-ci branch August 4, 2026 17:18

Navigation Menu

Repository navigation

ci: use locked ESM smoke dependencies - #11128

ci: use locked ESM smoke dependencies#11128
jasonsaayman merged 2 commits into
v1.xfrom
fix/esm-smoke-npm10-ci

jasonsaayman commented Aug 4, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

greptile-apps Bot commented Aug 4, 2026

T-Rex Logs

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

jasonsaayman commented Aug 4, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Linked issue

Changes

Checklist

Summary by cubic

Description

Docs

Testing

Semantic version impact

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

greptile-apps Bot commented Aug 4, 2026

Greptile Summary

Confidence Score: 5/5

T-Rex Logs

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jasonsaayman commented Aug 4, 2026 •

edited by cubic-dev-ai Bot

Loading