Resolve upstream conflict without touching other templates - #3
Merged
Uzair-Ahmed-Dahraj merged 12 commits intoAug 20, 2026
Merged
Conversation
…d Cloudflare Access (cloudflare#1100) Co-authored-by: chythra-w1 <chythra-w1@users.noreply.github.com> Co-authored-by: James Delorey <jdelorey@cloudflare.com>
…ith ctx.access (cloudflare#1125) Co-authored-by: chythra-w1 <chythra-w1@users.noreply.github.com> Co-authored-by: James Delorey <jdelorey@cloudflare.com>
…dflare-template # Conflicts: # pnpm-lock.yaml # templates.json
…with new pin-all-deps CI gate - Resolve pnpm-lock.yaml and templates.json conflicts against upstream main - Comply with new syncpack 'pin all deps' rule (upstream cloudflare#1114): exact-pin all shopify template deps - versionGroups for peer-dep-constrained stack (same mechanism as remix's React 18): * React ^18 (@shopify/app-bridge-react@4 + @shopify/polaris@10 peer-cap at 18) * eslint 8.57.1 + eslint-plugin-react-hooks 4.6.0 (eslint-config-airbnb is eslint-8-only) * hono 4.13.2 (high advisories <=4.12.33: JWT auth-bypass GHSA-r38q-p5jb-mjvw, XSS GHSA-f9qg-mpr5-mhfp) * react-router-dom 7.18.2 (high advisory <=7.17.0: turbo-stream RCE) - Cross-template syncpack alignment (HighestSemverMismatch): bump @typescript-eslint/plugin-react-swc in remix, to-do-list, workflows, x402 - Fix E2E backlink locator: exact match (GitHub link text contains 'devkindhq', broke strict mode) Gates: check:deps/templates/lockfiles/prettier OK; turbo check+cf-typegen 3/3; vitest 21/21; playwright 5/5; npm audit 0 high/0 critical
The pin-all-deps gate (upstream cloudflare#1114) only needed our two mismatched dev tools brought in line with what upstream already uses. Bumping the four other templates up was not required. Reverts remix-starter, to-do-list-kv, workflows-starter and x402-proxy to upstream, and sets ours to @typescript-eslint 8.50.0 and @vitejs/plugin-react-swc 4.0.0. Regenerates templates.json, package-lock.json and pnpm-lock.yaml. Security posture is unchanged: wrangler 4.123.0, @cloudflare/vite-plugin 1.52.1, vitest 4.1.10, hono 4.13.2 and react-router-dom 7.18.2 are all kept, and none of the moved packages is in an advisory chain. npm audit reports 0 high, 4 moderate (drizzle-kit -> esbuild only).
Uzair-Ahmed-Dahraj
merged commit Aug 20, 2026
60cd986
into
add-shopify-on-cloudflare-template
4 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #2. Same conflict resolution, one decision changed.
What this resolves
cloudflare/templates#1075is conflicted onpnpm-lock.yamlandtemplates.json. Both are generated files that collide whenever upstream merges anything. Upstream landed 9 commits on Aug 12-14, including cloudflare#1114 which madesyncpacka required CI gate (check:deps).This branch builds on #2 (keeping its upstream merge, the timing-safe HMAC fix, and the Playwright strict-mode fix) and changes only how the new dep gate is satisfied.
The change
#2 satisfied
check:depsby bumping four unrelated templates up to our versions:remix-starter-template@typescript-eslint/*8.50.0 -> 8.59.4to-do-list-kv-template@typescript-eslint/*8.50.0 -> 8.59.4x402-proxy-template@typescript-eslint/*8.50.0 -> 8.59.4workflows-starter-template@vitejs/plugin-react-swc4.0.0 -> 4.3.1This branch instead aligns our two versions down to what upstream already uses, and reverts those four templates to upstream.
Result: 4 files touched outside our own template, down from 12. Zero other templates modified.
Why this is not forced by CI
check:depshas many valid passing states.fix:depsis an autofixer that resolves upward, but its choice is a convenience, not a requirement. Verified with the four templates reverted and ours aligned:Security posture is unchanged
Upstream main already sits where the security fix landed (
wrangler 4.123.0in 35 templates,@cloudflare/vite-plugin 1.52.1in 11), so there is nothing to downgrade on the undici chain. All kept:wrangler 4.123.0,@cloudflare/vite-plugin 1.52.1,vitest 4.1.10,hono 4.13.2,react-router-dom 7.18.2.Only
@typescript-eslint/*and@vitejs/plugin-react-swcmove. Neither is in an advisory chain.npm audit: 0 high, 4 moderate (onlydrizzle-kit -> @esbuild-kit/esm-loader -> esbuild).Verification
pnpm install --frozen-lockfilecheck:depscheck:templatescheck:lockfilescheck:prettiervalidate-version-private-package-jsonvite build+wrangler deploy --dry-runcf-typegenidempotentpnpm-lock.yamladds only theshopify-on-cloudflare-templateimporter.templates.jsonadds only our entry, hash17513a96..., matching the file's sha1.Known issue, not addressed here
The template's own
npm run lintreports 426 formatting errors (no-tabs206,indent101,quotes65). The monorepo's prettier writes tabs and double quotes; the template's airbnb config wants spaces and single quotes. Pre-existing on both branches and invisible to CI, since turbo only runscheck. Worth a separate fix.