Repository navigation
Raise stale local/ dependency pins - #799
Merged
Merged
Conversation
Six `local/` pins lagged the versions published from the sibling Spine repositories, so `./config/pull` downgraded them in every consumer that had already moved ahead. The `compiler` repository paid this tax twice, restoring the same six files by hand after each pull (see its commit `cac48c06e2`, "Update local dependency pins"). Raising the pins here removes the cause rather than the symptom. Each version was discovered from the Spine Artifact Registry Maven metadata, as the `dependency-update` skill prescribes, and is the newest published version of the artifact -- not merely a copy of what `compiler` carries: Base 2.0.0-SNAPSHOT.460 -> 2.0.0-SNAPSHOT.461 Logging 2.0.0-SNAPSHOT.425 -> 2.0.0-SNAPSHOT.426 ProtoTap 0.17.2 -> 0.17.3 Reflect 2.0.0-SNAPSHOT.201 -> 2.0.0-SNAPSHOT.202 TestLib 2.0.0-SNAPSHOT.214 -> 2.0.0-SNAPSHOT.215 ToolBase 2.0.0-SNAPSHOT.425 -> 2.0.0-SNAPSHOT.426 `Base.versionForBuildScript` and `ToolBase.dogfoodingVersion` move in lockstep with their `version`, which is how this repository has kept them since `41cdb18e`. Both land on a consumer's root `buildscript` classpath, so both were checked for resolvability first: each target POM is served by the registry, and the `jvm-tool-plugins-all` POM is identical across `.425` and `.426` apart from its own version, leaving the dogfooding plugin's dependency graph unchanged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
No concrete defects were identified, but consumer-build compatibility remains unverified despite the reported dependency-resolution checks.
No open issues 🎉
What changed in this PR
Updates six shared local/ dependency pins so config/pull no longer downgrades consumers already using these versions.
Changes:
- Raises five snapshot pins and the ProtoTap release pin.
- Keeps Base’s buildscript and ToolBase’s dogfooding versions aligned with their library versions.
| File | Description |
|---|---|
buildSrc/src/main/kotlin/io/spine/dependency/local/ToolBase.kt |
Raises library and dogfooding pins to snapshot 426. |
buildSrc/src/main/kotlin/io/spine/dependency/local/TestLib.kt |
Raises pin to snapshot 215. |
buildSrc/src/main/kotlin/io/spine/dependency/local/Reflect.kt |
Raises pin to snapshot 202. |
buildSrc/src/main/kotlin/io/spine/dependency/local/ProtoTap.kt |
Raises release pin to 0.17.3. |
buildSrc/src/main/kotlin/io/spine/dependency/local/Logging.kt |
Raises pin to snapshot 426. |
buildSrc/src/main/kotlin/io/spine/dependency/local/Base.kt |
Raises library and buildscript pins to snapshot 461. |
Review effort: Balanced
armiol
approved these changes
Oct 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Six
local/pins lagged the versions published from the sibling Spinerepositories. Because
./config/pullcopiesbuildSrc/wholesale and cannottell a deliberate local bump from drift, every consumer that had already moved
ahead got downgraded on each pull, then had to restore the files by hand.
This is a standing pattern, not a one-off. The
compilerrepository carriescommit
cac48c06e2, "Update local dependency pins", which re-applied exactlythese six files after an earlier pull — and the same six had to be restored
again while propagating the recent
disableDocumentationTasks()fix. Raisingthe pins here removes the cause instead of the symptom.
What
Each version was discovered from the Spine Artifact Registry Maven metadata, as
the
dependency-updateskill prescribes, and is the newest published version ofthe artifact — not merely a copy of what
compilerhappens to carry:Base.kt2.0.0-SNAPSHOT.4602.0.0-SNAPSHOT.461Logging.kt2.0.0-SNAPSHOT.4252.0.0-SNAPSHOT.426ProtoTap.kt0.17.20.17.3Reflect.kt2.0.0-SNAPSHOT.2012.0.0-SNAPSHOT.202TestLib.kt2.0.0-SNAPSHOT.2142.0.0-SNAPSHOT.215ToolBase.kt2.0.0-SNAPSHOT.4252.0.0-SNAPSHOT.426ProtoTapmoves release → release; the rest move snapshot → snapshot, which thelocal/scope accepts by design.The two companion pins
Base.versionForBuildScriptandToolBase.dogfoodingVersionmove in lockstepwith their
version, which is how this repository has kept them since41cdb18e. Both land on a consumer's rootbuildscriptclasspath, so both werechecked before being raised:
jvm-tool-plugins-allPOM is identical across.425and.426apartfrom its own version, so the dogfooding plugin's dependency graph is unchanged.
Leaving them behind would instead open a skew between the plugin applied to the
build and the libraries it compiles against.
Verification
./gradlew detekt— the command CI gates on — passes. The root project has nobuildtask (buildis ambiguous withbuildDependants/buildEnvironment),and config applies no Dokka plugin, so
dokkaGenerateis not registered.transitively against the Artifact Registry: 147 artifacts, no conflicts and
no missing POMs, with every Spine artifact landing on a self-consistent version.
dependency-audit,spine-code-review, andkotlin-engineerall returnAPPROVE with no Must-fix or Should-fix items.
One thing reviewers should know
./gradlew buildDependants— theConfigTestertask that buildsbase,base-types, andcore-jvmagainst the local config — fails onmasterfor areason unrelated to this PR, so it could not be used as verification here.
config-tester.gradle.ktsdeclaresval tempFolder = File("./tmp"), a relativepath that Gradle resolves against the daemon's working directory. The checkout
therefore lands in
~/.gradle/daemon/9.8.1/./tmp/baseand the child build abortswith "does not contain a Gradle build" — before any dependency is resolved.
Worth fixing separately with
layout.projectDirectory.🤖 Generated with Claude Code