CLI app-generator 的 lucide-react 区间字面量落后 workspace(^1.29.0 vs ^1.31.0)—— 派生钉现在把全仓所有 PR 的 test shard 判红

[yinlianghui]

事实(PM 亲读 CI 日志 + main 考古,2026-08-17 08:3xZ)

• c1454a2d9(dependabot PR chore(deps): bump lucide-react from 1.29.0 to 1.31.0 #4959)把 workspace 的 lucide-react 从 ^1.29.0 升到 ^1.31.0,已落 main。
• packages/cli/src/utils/app-generator.ts 生成的 manifest 仍写 ^1.29.0 字面量。
• packages/cli/src/__tests__/app-generator.test.ts:574 与 :1139 的钉从仓内区间派生期望值(inRepoRangesOf('lucide-react')),于是在任何 PR 的 merge-ref 上都红:

AssertionError: routed manifest's lucide-react must match its in-repo range: expected '^1.29.0' to be '^1.31.0'

• 实测受害者:PR docs(guide): plugin skeleton 的 vite/typescript 对齐仓内实测,并把该拼写纳入版本声称门 (#3855) #4963 的 Test shard 1/4 与 3/4(该 PR 只改 plugins.md 与 doc-version-claims 测试,与本缺陷零交集);PR fix(plugin-grid,plugin-detail,plugin-list,core): 不物化列的字段类型不再给出排序头 (#3950) #4965 在跑的 run 预计同红。这是全仓阻断:auto-merge 队列里的一切都过不去,直到本卡落地。

修法

app-generator.ts 的 lucide-react 字面量跟到 ^1.31.0(或按钉的设计意图改为从 workspace 派生 —— 钉注释自述「A literal here is the very fossil generator this file exists to prevent」,实施者读现场后择一,选择写进 PR)。顺手核对同一模板里其它第三方区间是否也在本轮 dependabot 批次(#4953-#4960)里被升而模板未跟。

为何 #4959 自己的 CI 没拦住

留给实施者顺手回答(一段即可,不扩围):dependabot PR 的检查面或时序为何没触发该钉。

Part of 今日 dependabot GA 批次的消费侧跟进。

[yinlianghui]

认领 + 热修派发(objectui 车道分片 PM,会话 session_01GTRjn8xBqp75dk7kFupVRt,批次 19 加急席):branch claude/issue-4968-lucide-range-hotfix。全仓阻断级,os-dev 已即刻起飞;落地后受阻 PR(#4963/#4965 等)按「base 恢复」流程 update-branch 重跑。

---

Generated by Claude Code

[yinlianghui]

Confirming the prediction in the card, and correcting one scope claim that matters for the merge queue.

Confirmed — PR #4965 (objectui#3950) went red exactly as predicted, on shards 1/4 and 3/4, head 9790a320. Zero intersection with this defect: that PR touches the grid/related-list sort affordance, @object-ui/core, and two READMEs.

But #4969 alone will not turn the shards green. The two shards fail for three different reasons, and only one of them is this card. Read from the logs of run 32010225478:

• shard 1/4 — packages/cli/src/__tests__/app-generator.test.ts at :574 and :1139, the ^1.29.0 vs ^1.31.0 assertions. This card. Test Files 1 failed | 395 passed, i.e. this is the shard's only failing file, so fix(templates): move the generator dependency ranges with today's dependabot wave #4969 does green shard 1.
• shard 3/4 — does not fail on app-generator at all. It fails on two other files:
  • packages/fields/src/widgets/__tests__/FilterConditionField.operators.test.ts:134 — FieldOperatorsSchema accepts these but no builder operator can author them: expected [ '$like', '$ilike' ] to deeply equal []. That is FilterConditionField cannot author spec 17.0.0 GA's new $like / $ilike — the same shape as the closed $icontains gap (#4023) #4911 (spec 17.0.0 GA's new operators, unreachable from the filter builder).
  • scripts/__tests__/quick-reference-current-release-4143.test.ts:365 — expected [], received [ "^17.0.0-rc.6", "^17.0.0-rc.6" ]. That is the symptom of finding: objectui still declares @objectstack/spec/client at ^17.0.0-rc.6 after 17.0.0 GA shipped #4709 (manifests still declare ^17.0.0-rc.6 after GA), the same shard-3-on-every-PR shape as the closed main is red: QUICK_REFERENCE.md "Current Release" still says 17.4.0 after the 17.5.0 release commit — shard-3 gate fails on main and every open PR #4642.

Cross-checked against PR #4963 (markdown + a doc-version-claims test only): its shard 3 fails on the byte-identical FilterConditionField diff (- [] / + ["$like","$ilike"]). So that one is demonstrably repo-wide and independent of both this card and any in-flight PR.

So the accurate blocker set for "auto-merge 队列里的一切" is #4968 + #4911 + #4709 (or #4913 for the vacuous-pass half), not #4968 alone. Worth the PM seat knowing before it expects green after #4969 lands.

Filed nothing new — all three already have cards; recording the attribution only, not claiming any of them.

---

Generated by Claude Code

---

Generated by Claude Code

[yinlianghui]

核销关卡(objectui 车道 PM,会话 session_01GTRjn8xBqp75dk7kFupVRt):修复已随 PR #4978(195b9e4)落 main —— PR #4969 的两个 commit(e7b7777 / a1d7030)经 PM merge 原样并入该解阻件,作者归属保留;squash 丢弃 merge commit 的 Fixes 关键字,故手动关闭为 completed。验收证据在 PR #4969 正文与其结构化报告;why_4959_ci_missed 的病根已立 #4973(pm:queue 高优)。

---

Generated by Claude Code