Skip to content

chore(deps): bump structon to ^1.0.7 (#1163) - #1240

Merged
kriszyp merged 1 commit into
mainfrom
kris/bump-structon-1.0.7
Jun 10, 2026
Merged

chore(deps): bump structon to ^1.0.7 (#1163)#1240
kriszyp merged 1 commit into
mainfrom
kris/bump-structon-1.0.7

Conversation

@kriszyp

@kriszyp kriszyp commented Jun 10, 2026

Copy link
Copy Markdown
Member

Summary

Bumps structon ^1.0.6^1.0.7 (lockfile updated to 1.0.7).

structon 1.0.7 = HarperFast/structon#5: on the standalone decode path, typed structures now reload from durable storage when a decode hits a structure id minted after the reader's last load (previously the cache short-circuited and never refreshed — a record that exists came back undecodable, the read half of #1163). The base decoder already did this for classic shared structures; 1.0.7 brings typed structures to parity.

Why this is safe here

On main this is inert: msgpackr ^2.0.4 uses structon's fast path, whose readStruct already reloads on miss, so the new standalone-path branch is never executed. The change is load-bearing only on the standalone (msgpackr v1) path that the v5.0 line / the affected production cluster runs — so the impactful delivery is a v5.0 backport (see below), not this PR.

Note

The structon-level change carried its full review in HarperFast/structon#5 (incl. cross-model review); this is a mechanical dependency bump (package.json range + lockfile only, diff is structon-only). One open item flagged in structon#5: nested-struct misses via _decodeSliceDirect are not yet covered (re-entrancy hazard) — tracked there.

Backport: the v5.0 line is where this actually fixes #1163; that's a separate /patch-pr once this lands.


🤖 Generated by Claude (Opus 4.7).

Picks up HarperFast/structon#5: typed structures now reload from durable
storage on a decode miss (standalone path), bringing them to parity with
classic shared structures. On main this is inert (msgpackr ^2.0.4 uses the
fast path, which already reloads on miss); it is load-bearing on the standalone
(msgpackr v1) path that the v5.0 line runs.
@kriszyp
kriszyp requested a review from cb1kenobi June 10, 2026 23:23
@gemini-code-assist

Copy link
Copy Markdown
Contributor

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedstructon@​1.0.6 ⏵ 1.0.777 +1100100 +193 +1100

View full report

@claude

claude Bot commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

Reviewed; no blockers found.

@kriszyp
kriszyp merged commit 83791ff into main Jun 10, 2026
47 checks passed
@kriszyp
kriszyp deleted the kris/bump-structon-1.0.7 branch June 10, 2026 23:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Stale shared-structures: nodes silently return empty/partial query results without error

2 participants