Bump oxc-parser to >=0.90.0: 0.76.0 bindings lack build provenance

Open Beginner friendly
#347 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
javascript
Domain
build-system

Research direction

Start by locating the oxc-parser dependency declaration in ComponentizeJS and inspect how its version is constrained. Verify the dependency update with an install configuration that enforces build provenance; done means componentize-js and its downstream jco installation no longer requires per-package provenance exceptions.

Written by the indexing model from the issue text.

Description

Would you consider bumping the oxc-parser dependency to >=0.90.0? At 0.76.0 its platform bindings publish without build provenance, which makes anything depending on componentize-js uninstallable under an installer that enforces provenance.

Filed here at the jco maintainers' suggestion — this started as bytecodealliance/jco#1841, and the reply was that the dependency needs updating here first.

The chain is jco@1.27.0 → @bytecodealliance/componentize-js@^0.22.0 → oxc-parser@^0.76.0. All 15 @oxc-parser/binding-* packages at 0.76.0 are missing build provenance attestations, while oxc-parser and @oxc-project/types at the same version have them.

It looks like a gap in one range rather than the norm: @oxc-parser/binding-darwin-arm64 has attestations at 0.13.3, none at 0.76.0, and has them again from 0.90.0 through the current 0.143.0. npm registry signatures are present throughout — build provenance specifically is what is missing.

Installers that enforce provenance and treat a loss of attestation as a downgrade refuse the install outright. It is not host-specific either: the resolver walks every optional binding, so all 15 have to be excluded individually to get past it, including the 13 for platforms a given project will never run.

Bumping to >=0.90.0 would let componentize-js and jco install cleanly under those policies with no per-package exceptions.

Dominant language
Rust
Stars
392
Forks
54
Avg merge
3d 5h
Merged PRs (30d)
1

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from bytecodealliance/ComponentizeJS

All issues in bytecodealliance/ComponentizeJS

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.