1.0.0#8
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request bumps the version of @formo/cli from 0.2.0 to 1.0.0. However, the review identifies critical issues that must be addressed before a stable release: the project is inconsistently maintaining an npm lockfile despite being configured for pnpm, and several specified dependency versions for axios and pnpm are invalid or do not exist on the public registry. It is recommended to switch to pnpm-lock.yaml and correct these versions to ensure the package is installable.
| { | ||
| "name": "@formo/cli", | ||
| "version": "0.2.0", | ||
| "version": "1.0.0", |
There was a problem hiding this comment.
The project is configured to use pnpm as its package manager (as specified in package.json), but this PR updates package-lock.json, which is an npm lockfile. Maintaining an npm lockfile in a pnpm project is inconsistent and can lead to dependency drift. Furthermore, the lockfile references axios@1.16.1 (line 1196), a version that does not exist on the public npm registry, which will cause installation failures. You should use pnpm-lock.yaml and ensure all dependency versions are valid.
| { | ||
| "name": "@formo/cli", | ||
| "version": "0.2.0", | ||
| "version": "1.0.0", |
There was a problem hiding this comment.
Bumping to version 1.0.0 while the project has invalid configuration and dependencies is premature for a stable release. Specifically, axios is set to ^1.15.2 (line 32) and packageManager is set to pnpm@11.1.2 (line 4), neither of which are currently valid stable versions on the public registry. These should be corrected to ensure that the 1.0.0 release is installable and maintainable.
The repo tracked both package-lock.json and pnpm-lock.yaml, but CI uses pnpm exclusively (pnpm install --frozen-lockfile). The npm lockfile was never consumed and only caused manual version-bump churn. Remove it and gitignore npm/yarn lockfiles so pnpm-lock.yaml is the single source of truth. Verified: pnpm install --frozen-lockfile passes with it gone. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 participant
Need help on this PR? Tag
@codesmithwith what you need.