ci: guard against the removed Trezor and Reown dependency families - #413
Merged
Conversation
@trezor/* (Trezor Reference Source License, no redistribution) and @reown/* (Reown Community License, fees above 500 monthly active users plus mandatory-gateway and confidentiality clauses) were both removed from this repo. Neither is a direct dependency: Trezor arrives via @creit.tech/stellar-wallets-kit and Reown via @walletconnect/ethereum-provider, which @wagmi/connectors declares as a hard dependency. That is why they went unnoticed originally -- a grep of source code surfaces neither, and a routine dependency bump can reintroduce them silently. The guard checks both the outcome and the mechanism: - No @trezor/*, @reown/* or @walletconnect/* reference may appear in pnpm-lock.yaml. @walletconnect/* is Apache-2.0 on its own, but it is the only route Reown takes into the tree, so it is banned too. - .pnpmfile.cjs must still define *and* call both strip hooks, so deleting one fails loudly rather than waiting for the next resolution to reintroduce the packages. Runs as an early CI step, invoked directly with node rather than through pnpm: it is lockfile-only and needs no node_modules, so it fails fast. `pnpm check-licenses` is wired up for local use. Verified against all three failure modes, not just the happy path: a banned entry in the lockfile fails, deleting a hook call fails, and deleting a hook definition fails. The call check is anchored to line start deliberately -- unanchored, the function declaration itself satisfies it, and an earlier version of this script passed while the hook was uncalled. Mirrors openzeppelin-adapters#76. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
check-versions blocks this PR otherwise. The adapters published again for the AGPL-3.0 licence correction, taking adapter-evm and adapter-stellar to 4.0.0 and adapter-midnight and adapter-solana from 2.2.0 to 4.0.0, so versions.ts went stale within minutes of #414 syncing it to the 3.x line. Ran `pnpm run update-export-versions`: versions.ts plus one export snapshot. Included here rather than as a fourth sync PR because it is the only thing standing between this guard and a green build, and the sync is entirely tool-generated. Verified: `update-export-versions` exits 0 and leaves versions.ts stable against npm, 46 test files and 322 tests pass, the dependency licence guard passes. Note the systemic issue: this is the third time versions.ts drift has blocked an unrelated PR. The job gates every PR on the state of the npm registry, so any publish anywhere in the org turns the next unrelated PR red. Worth reconsidering whether it should gate PRs at all rather than run on a schedule or at release time. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
pasevin
force-pushed
the
chore/ci-license-guard
branch
from
August 21, 2026 00:45
dd17072 to
c10fe89
Compare
pasevin
added a commit
that referenced
this pull request
Aug 21, 2026
The adapters went through two majors while this repo stayed on ^2.x: 3.0.0 removed WalletConnect support, and 4.0.0 corrected the package licences to AGPL-3.0. Caret ranges do not cross a major, so the builder kept resolving adapter 2.x -- code that still registers the walletConnect connector, still asks for a WalletConnect projectId, and still declares MIT. - @openzeppelin/adapter-evm ^2.3.0 -> ^4.0.0 - @openzeppelin/adapter-midnight ^2.0.1 -> ^4.0.0 - @openzeppelin/adapter-polkadot ^2.0.2 -> ^3.0.0 (no AGPL major; already AGPL) - @openzeppelin/adapter-solana ^2.0.0 -> ^4.0.0 - @openzeppelin/adapter-stellar ^2.0.2 -> ^4.0.0 - @openzeppelin/adapters-vite ^2.0.0 -> ^11.0.0 The UI packages had to move with them. adapter-evm@4 peer-requires @openzeppelin/ui-types ^3.5.0, while pnpm-workspace.yaml pinned it to exactly 3.3.0, so the first attempt failed 34 tests with: [@openzeppelin/adapter-evm] Incompatible @openzeppelin/ui-types version. Both the app's ranges and the workspace overrides needed bumping -- the overrides pin exact versions and would otherwise force the app's ranges straight back down: - ui-types 3.3.0 -> 3.5.1, ui-utils 3.3.0 -> 4.0.0, ui-components 3.8.0 -> 3.8.2, ui-react 3.3.0 -> 3.3.1, ui-renderer 3.4.0 -> 3.4.1, ui-storage ^1.2.2 -> ^1.2.4 adapters-vite crosses nine majors and ui-utils one. Both are pre-existing drift rather than something this work introduced; the pins had stopped tracking the packages. versions.ts needed no change: #413 already synced the exported-app pins to the same 4.x line, so the builder's own dependencies and its exported apps now agree. Verified: typecheck clean, 47 test files pass (34 were failing before the UI packages were bumped), production build succeeds, lint and format:check clean, `pnpm install --frozen-lockfile` passes, and the dependency licence guard still reports zero @trezor/*, @reown/* and @walletconnect/* entries. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
@trezor/*(Trezor Reference Source License — reference use only, no redistribution) and@reown/*(Reown Community License — fees above 500 MAU, plus mandatory-gateway and confidentiality clauses) were both removed from this repo.Neither is a direct dependency, which is exactly why they went unnoticed originally:
A grep of source code surfaces neither, and a routine dependency bump can reintroduce them silently. Both are currently held out only by
readPackagehooks in.pnpmfile.cjs— delete a hook, or bump a dependency, and they come straight back with nothing to notice.What this adds
scripts/check-dependency-licenses.cjs, wired as an early CI step. It checks both the outcome and the mechanism:@trezor/*,@reown/*or@walletconnect/*inpnpm-lock.yaml.@walletconnect/*is Apache-2.0 itself, but it is the only route Reown takes into the tree, so it is banned too..pnpmfile.cjsmust still define and call both strip hooks. Without this, deleting a hook passes CI until the next resolution quietly reintroduces the packages.Dependency-free and lockfile-only, so no
node_modulesand no network. Invoked withnodedirectly rather thanpnpm, because the pnpm wrapper triggers a dep-status install and defeats the point of running early.pnpm check-licensesis available locally.Verified against the failure modes
@reown/appkit@1.8.19injected into the lockfileWorth noting: my first version of this script passed while the hook was uncalled — the
calledcheck matchedstripWalletConnectDependencies(pkg, which the function declaration satisfies. It is now anchored to line start so only a statement counts. A guard that cannot fail is worse than no guard, so the anchoring is deliberate.Mirrors OpenZeppelin/openzeppelin-adapters#76.