mirror of
https://github.com/astral-sh/ruff.git
synced 2026-10-28 19:00:26 +08:00
zaniebotandzaniebot
dff9c753fc
Pinning `cloudflare/wrangler-action` does not pin the `wrangler@4` package it installs during deployment. Install Wrangler from a dedicated, committed lockfile with lifecycle scripts disabled, then invoke that local executable directly. Require `npm>=11.10.0` with `engines.npm` and `engine-strict` so older clients cannot silently ignore the seven-day `min-release-age` policy, and pin Node.js to `24.19.0` at the install sites. Both playgrounds now use the reviewed dependency tree already recorded for the playground API, and Cloudflare credentials are passed only to the deployment command. Related: astral-sh/ruff#27839 isolates the playground builds from deployment credentials, and astral-sh/ruff#27844 enforces the corresponding `npm` floor in the existing package roots. astral-sh/ruff-vscode#1152 and astral-sh/ty-vscode#526 likewise give credentialed publishers their own locked toolchains. --------- Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>