Dashboard › spotlight › Distillation
05f2dd29-8c63-4e0d-a841-bb5e1c5d2f7f["4c24bd2cc08d112b98e80f24f6bac54a","b3ee297206b99999c02789d6cd2c5a60","17d16be3cbb3501dffd07d5d2cdc7a92","b973c9be6803e7545b3465220c5d7151","061edac6d998db0eb8ed110df02d9aee","27eb9b702d028051b226c9d270486cf7","2caa6794736b67bdd359df54b35cd2c2","9923fc6355d31b0193c70282e90d1332","deae742305de40145a7ea8b624214714","cd3ef55dbd5987585a0cfe887f2af5b5","5e53cdb151227e2f84278fe581ea9a2b","f02479bdbd546ad43dd19246efc0d36e","effaec82417d0a604641f4f185a382a6","8a2a2b38ca320f5fac6ff6a629b1a806","e75bc2c9e85f0c84981ca5aea8c7bc93","d0433c5746d7f28633cebf1f782b52a7","e43fd5079298bf46c86e902665ffb12d","6759098dc8f446af5a2933f0760ef32a","b6ade467dbfe26ff3f645085d5502a33","b28f86c1c1ca06c7fff1712b08a1aa59","ae4de0f5addaa7432201bb23d559e597","1084ce24995661bf10c64aa1882b3777","295e258a9bf507982f25e51a64df94ac","4181f0a639142b49cde4522e5c38366f","4ee0479d708ede0cd53fc2d91ea01625","5407f6ad05d7c3ce06e44eb6fd8c2da6","4caef63c0c93b39590f00cf7389bddcb","88f150a1af5efcd3e1e12fdda0af6f74","a2e8b136127602bf947dc4c59a91a648","4c5991cf256416947a4635ad99b01148","9bc0e9f7127c45d23dac501c155dd0c7","777e403988cbba7dad12b5116991653e","3ebaadeb2915e0aac3b5c8564f3f8b6a","fd63f0cedbcec614fde65af710180f36","468a3087ba5f160bf696bc98560d5556","201acfcf308339fb77ecec82b2d7d308","b3ec5238d27b426b5aa65738b753dc6a","a6b49d168c25cc724983952cf1ce14f9"]
Date: July 21, 2026
expand (dist/commonjs/index.js:4), brace-expansion@2.1.2 exports only default expandTop (index.js:3); minimatch@10.2.5 calls (0, brace_expansion_1.expand)(...) (dist/commonjs/index.js:4,157). Old blanket override forcing 2.x caused the exact reported TypeError.^0.8.8 — 0.9.10 was never a natural resolution, the override forced it. On pr-1337 it resolves to 0.8.13, matching plist's actual requirement. Mechanism confirmed in source: xmldom@0.9.10 lib/dom-parser.js:220-222 throws the exact reported TypeError for missing mimeType; 0.8.13's parseFromString does not enforce it. All high-severity xmldom advisories (GHSA-2v35, -f6ww, -x6wf, -j759, -wh4c) are patched at 0.8.13, so no security regression.pnpm install --frozen-lockfile --lockfile-only in a throwaway /tmp/opencode worktree exited 0 with no mismatch; non-frozen re-resolve produced unchanged pnpm-lock.yaml sha256 and zero git diff — no latent drift, overrides stable and complete.>=3.0.0 <4.0.0 and >=4.0.0 override branches are too loose against GHSA-3jxr-9vmj-r5cp — "the 3.x/4.x lines were never patched; the fix jumped to 5." — currently inert since nothing in the tree resolves to brace-expansion 3.x/4.x. Nitpick: the <2.0.0: >=1.1.12 floor technically allows vulnerable 1.1.12-1.1.15 but actual resolution lands on patched 1.1.16.pnpm build not build:mac and would have missed this regression class."brace-expansion": ">=2.1.0 <3", line 56 "@xmldom/xmldom": ">=0.8.13"; lockfile shows @xmldom/xmldom@0.9.10 resolved.build = "vite build --config vite.node.config.ts && vite build --config vite.ui.config.ts && npm run build:sea && npm run build:electron" (line 20); build:sea = "fossilize -m dist/ui/manifest.json -o spotlight dist/run.js" (line 21); build:electron = "vite build --config vite.electron.config.ts" (line 23); build:mac = "./electron-builder.cjs" (line 24). Confirms build:mac (electron-builder packaging) is a separate step from build, explaining why the prior pnpm build-only verification for PR #1335 missed the mac regression.pty_read loops to check completion for this session." — completion signal is the <pty_exited> message; pty_read should be used only for live output on explicit request or to investigate a non-zero exit.pnpm --filter=@spotlightjs/spotlight build on main (workdir /home/byk/Code/getsentry/spotlight, PID 548126, timeout 400s) to produce build artifacts before reproducing the build:mac failure.pnpm --filter=@spotlightjs/spotlight build:mac on main (PID 549371) to reproduce the regression described in PR #1337.TypeError: (0, brace_expansion_1.expand) is not a function at braceExpand in minimatch@10.2.5, triggered from app-builder-lib@26.15.7's fileMatcher.ts — exactly matching PR #1337's Claim 1. Confirms PR #1335 (electron-builder 24→26 bump) broke the mac build, and confirms the prior pnpm build-only verification for #1335 missed it (failure occurs only in the electron-builder packaging step).<2.0.0→>=1.1.12 <2, >=2.0.0 <3.0.0→>=2.1.2 <3, >=3.0.0 <4.0.0→>=3.0.1 <4, >=4.0.0→>=4.0.1), line 59 "@xmldom/xmldom": ">=0.8.13 <0.9"; lockfile confirmed resolving @xmldom/xmldom@0.8.13 (lines 2976, 10227).pnpm install --frozen-lockfile on pr-1337 (PID 550403) — succeeded, exit code 0.pnpm --filter=@spotlightjs/spotlight build:mac on pr-1337 (PID 551253) to verify the fix.building target=snap/building target=AppImage stages. New failure was Linux-specific: AppImage build errored executableName contains characters that cannot be safely used in file paths: @spotlightjsspotlight (app-builder-lib appImageUtil.ts:158), followed by an mksquashfs failure ("Could not create destination file: No such file or directory").@spotlightjs/spotlight package name used as executableName), unrelated to PR #1337; on macOS CI the mac/DMG target path is used instead and doesn't hit this code path. Both dependency regressions (brace-expansion, xmldom) the PR fixes were confirmed cleared.--mac dir flag to isolate the CI-equivalent build path on pr-1337 branch; the flag had no effect because electron-builder.cjs hardcodes its config and calls builder.build({config:{mac}}) directly, ignoring CLI target overrides — build still attempted Linux targets and hit the same AppImage/mksquashfs failure.mac/DMG target build cannot be verified on this Linux host (requires macOS for signing/DMG), but the critical evidence is conclusive — on main, build:mac dies immediately at fileMatcher/minimatch with the brace-expansion TypeError, never reaching target-building; on pr-1337, build:mac sails past fileMatcher/minimatch entirely with no brace-expansion or xmldom errors, reaching the actual packaging/target-building stage. Both regressions the PR targets are verifiably fixed. Plan: restore repo to clean main state next.