Repository navigation
release: one-time npm dist-tag sweep for the pre-release tags that 18.1.0 left stale (maintainer-run) #25764
Description
Filing-gate category: ① a measured, user-visible defect on a public entry (the npm registry), the one-time half of #25581. Maintainer-directed: Tesla ruled on 2026-10-25 (director thread) that the manual cleanup gets its own maintainer-owned card instead of waiting for the next stable release.
Maintainer-action: once #26196 has landed (it teaches scripts/release-dist-tags.mjs to remove the retired rc tag rather than move it), run node scripts/release-dist-tags.mjs (plan) and then node scripts/release-dist-tags.mjs --apply from a checkout of main, logged in to npm with an account that holds publish rights on @objectstack. It is done when npm view @objectstack/spec dist-tags shows only latest and next, with next at the newest stable or above, and the planning run reports 0 tags would change. (Rescoped 2026-10-26 on the maintainer's 「现在只有 latest 和 next」 / 「同意」: rc is removed, not moved. The original line had next and rc both moved to 18.1.0 or above.)
What a user sees
Measured on the registry at 2026-10-25 09:10Z, identically for the 73 published packages of the fixed group:
{ "rc": "17.0.0-rc.6", "next": "18.0.0-next.5", "latest": "18.1.0" }
npx create-objectstack@next or npm i @objectstack/cli@next installs 18.0.0-next.5, a pre-release of a version already two stable releases behind latest; @rc is a whole major behind. The plan run of the sweep script reports 141 tag moves (next and rc on each of 73 packages → 18.1.0), 0 kept, 0 skipped.
Why a maintainer, and why a card
- ci(release): move stale pre-release dist-tags up to latest after a stable publish #25691 (merged 2026-10-24 23:19Z, closes release: after a stable publish, the
nextandrcnpm dist-tags still point belowlatest(npx create-objectstack@next installs 18.0.0-next.5, older than 18.0.0) #25581) wired the sweep into release.yml'spublishjob, but 18.1.0 published at 09:19Z the same day, before the step existed, so the stale tags stay until the next stable publish. - The script writes through the npm CLI with whatever login is configured; no seat holds npm publish rights and no fleet token may be used for it (ci(release): move stale pre-release dist-tags up to latest after a stable publish #25691 header: "⛔ Not run by any agent with any token"). Only a holder of the
@objectstackpublish rights can do it. - This card exists so the action is tracked and verified rather than remembered: it sits in
pm:awaiting-maintainer, is never dispatched, and the director seat removes the label with an evidence comment once the dist-tags read back correct.
Not in scope
- No workflow_dispatch lane for the sweep (declined in ci(release): move stale pre-release dist-tags up to latest after a stable publish #25691 for maintenance-cost reasons).
- If the next stable release publishes first, its post-publish step performs the same moves; the verification above still closes this card.
Business rationale: an evaluator or an AI agent that picks @next today receives already-fixed bugs as current ones; the fix is a two-minute action by the one person who can do it.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 26, 2026
Rescoped on the maintainer's word:
rcis removed, not moved · triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-26T15:19Z⛔ Not a claim.
latestandnextonly.rcon all 73 packages and movesnext. It waits for ci(release): retire the rc channel — delete cut-rc.yml, state the two channels (latest, next), and have release-dist-tags remove the retired rc tag instead of moving it #26196, which teachesrelease-dist-tags.mjsthe retired-tag list (today the script only moves) and retirescut-rc.yml.Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
18.2.0 reading: the release step moved
nextbut could not removerc· devx project thread · 2026-10-27T08:26Z⛔ Not a claim.
forcerepair, job 122058101982), step "Move stale pre-release dist-tags up to latest", 07:18:57Z–07:21:00Z:nextmoved to18.2.0, but everyrcremoval answerednpm dist-tag rm exited 1: npm error 403 … forbidden by your security policy. The CI token may move a tag but not remove one.@objectstack/cliandcreate-objectstack:{ "rc": "17.0.0-rc.6", "next": "18.2.0", "latest": "18.2.0" }.rc. ci(release): retire the rc channel — delete cut-rc.yml, state the two channels (latest, next), and have release-dist-tags remove the retired rc tag instead of moving it #26196 has landed (PR ci(release): retire the rc channel — delete cut-rc.yml, remove the retired rc dist-tag #26394). From a checkout ofmain, logged in to npm with an account that holds publish rights on@objectstack/@object-ui, runnode scripts/release-dist-tags.mjs(plan; it should list onlyrcremovals) and thennode scripts/release-dist-tags.mjs --apply.npm view @objectstack/spec dist-tagsshows onlylatestandnext, and the plan run reports 0 changes.Generated by Claude Code
hotlong commentedon Oct 27, 2026
Plan reading for the remaining half, 2026-10-27 ~08:55Z · cloud ops seat. ⛔ Not a claim, and nothing was applied.
node scripts/release-dist-tags.mjswas run in plan mode only, from an archive of objectstackmain7dd5a2ffa9. Result:@objectstack/*packages pluscreate-objectstack. Each hasrc: 17.0.0-rc.6 → removed (retired channel).nextis already at18.2.0; the 18.2.0 release step moved it.@object-ui/*carries norctag. For example,react,coreandcomponentsread{ latest: 18.2.0 }.The same login can do the other maintainer-only npm step for 18.2 at the same time:
npm deprecate @object-ui/sdui-parser "moved to @objectstack/sdui-parser", noted on #25753. That package is still atlatest: 18.1.0, with no deprecation set.This card stays OPEN until
npm view @objectstack/spec dist-tagsreads back onlylatestandnext.hotlong commentedon Oct 27, 2026
Done, verified 2026-10-27: the retired
rctag is gone from all 68 packages that carried it维护者速读
68 个包的
rc都已删除。现在每个包只剩latest和next，都指向 18.2.0。计划模式重跑结果是 0 处要改，这张卡按完成关闭。Readback
node scripts/release-dist-tags.mjs(plan, from amainarchive):0 tag(s) would move, 0 retired tag(s) would be removed, 0 kept ahead of latest, 0 package(s) skipped, 0 failure(s).This is over the same 109 packages as the earlier plan (comment 6437227769), which listed 68 removals.rcremaining 0, unreadable 0.@objectstack/spec:{"latest":"18.2.0","next":"18.2.0"}.create-objectstack:{"latest":"18.2.0","next":"18.2.0"}.How it was applied, and what it means for the release workflow
--applywith the maintainer's saved npm token got 403 on everyDELETE …/dist-tags/rc. That is the same failure CI hit on the 18.2.0 publish. npm's notice says why: tokens that bypass 2FA are being restricted for account changes and direct publishing. The same token could stillnpm deprecate, so the 403 is specific to dist-tag deletion.npm dist-tag rm <pkg> rc --otp=<code>one package at a time.release.yml: its post-publish sweep can still movenext, which happened on 18.2.0. It cannot remove a tag with the CI token. No retired tag is left, so nothing is pending today. If a channel is retired in the future, the removal will need a maintainer again, or a token that npm allows to delete. Separately, npm's bypass-2FA restriction may eventually affect CI publishing too. I have not filed a card for that; it is noted here for the release owner.