ci: Disable yarn age gate when bumping first-party @sentry deps#6513
Open
antonis wants to merge 2 commits into
Open
ci: Disable yarn age gate when bumping first-party @sentry deps#6513antonis wants to merge 2 commits into
antonis wants to merge 2 commits into
Conversation
The dependency updater's `set-version` step runs `yarn up` on the just-published @sentry/* version. Yarn 4's npmMinimalAgeGate (default 1 day, auto-enabled on CI) quarantines the fresh release and fails the install. Since these are all first-party packages with no supply-chain risk, disable the gate for that single command so the updater can adopt the new version immediately instead of waiting a day. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
Semver Impact of This PR⚪ None (no version bump detected) 📋 Changelog PreviewThis is how your changes will appear in the changelog.
🤖 This preview updates automatically when you update the PR. |
Contributor
antonis
marked this pull request as ready for review
July 24, 2026 12:41
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 1de7034. Configure here.
The set-version path is also sourced by update-rn.sh, which bumps the third-party react-native package. Only disable npmMinimalAgeGate when every package being upgraded is @sentry/*, so third-party bumps keep the supply-chain safeguard. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📢 Type of change
📜 Description
The dependency updater's
set-versionstep (scripts/update-package-json.sh, shared by thejavascript,cli,wizard, andbundler-pluginsjobs inupdate-deps.yml) runsyarn upon the just-published@sentry/*version.Yarn 4's
npmMinimalAgeGate(default 1 day, auto-enabled on CI) quarantines any version younger than the threshold and fails the install:This makes the updater fail every time it tries to adopt a freshly published release. This PR sets
YARN_NPM_MINIMAL_AGE_GATE=0for that singleyarn upcommand so the gate is disabled only while upgrading first-party packages.💡 Motivation and Context
The age gate is a supply-chain safeguard against a malicious version being published and quickly yanked. Every package these updaters touch is first-party
@sentry/*from trusted Sentry repos, so there's no such risk here — and the entire purpose of the updater is to pick up the new version immediately rather than waiting a day for the next cron run.This matches existing precedent in the repo, where the same gate is already disabled for the same "just-published SDK" reason:
dev-packages/type-check/run-type-check.shpackages/core/dev-packages/e2e-tests/cli.mjsThe change is scoped inline to the single command, so the gate remains in effect everywhere else.
Failing run: https://github.com/getsentry/sentry-react-native/actions/runs/30092846605/job/89479814118
💚 How did you test it?
CI-only change to the updater script. Verified the env var is scoped to the single
yarn upinvocation and only ever applies to first-party@sentry/*packages.📝 Checklist
sendDefaultPIIis enabled.🔮 Next steps
🤖 Generated with Claude Code