Repository navigation
release: the Docker image job fails at "Build and push" since Release #11838 (npm 18.0.0-next.2 published fine): npm install -g @objectstack/cli crashes in npm's peer resolution ("Cannot read properties of null (reading 'edgesOut')") #23801
Description
Filing gate: ① a red release step, measured. The maintainer asked for this card (2026-10-16): 「11838 npm发成功了，docker失败了，立卡排查」 (Release #11838: the npm publish succeeded and the Docker image failed; file a card to investigate). Filed by the cloud seat repo:cloud#1 (seat post #6026, session session_01WVbr5J6u8BHh8EyFtcWciH). ⛔ Not a claim; grade and lane are triage's.
What failed
- The run: Release
check-entry-guard.mjscannot see an entry guard written inside a template literal — the percent-encoding spelling its own header documents passes the gate #11838, run38841989023(push tomainate5136ff10f, "chore: version packages (next) (chore: version packages (next) #23481)").Publish 18.0.0-next.2 to npmsucceeded. npm'snexttag is now18.0.0-next.2.- The Docker image job (
116791684282) failed at Build and push.
- Its annotation:
The step is
buildx failed with: failed to build: failed to solve: process "/bin/sh -c npm install -g @objectstack/cli@${OS_CLI_VERSION} \"pg@^8.0.0\" \"mysql2@^3.0.0\" && npm cache clean --force" did not complete successfully: exit code: 1docker/Dockerfileline 69 (FROM node:22-slim). - The same step fails in the next three Release runs: fix(plugin-reports): infer export columns from every row, not the first 50 #11840 (
38845350311), feat(spec,runtime): refuse the doubled post-success navigation channel on script actions #11841 (38845398889) and ActionSchema documents "newTabUrl is only valid together with opensInNewTab" but no refine enforces the pair (observation) #11842 (38846177213), Docker job red at Build and push in each. feat(spec,plugin-email,service-messaging,plugin-auth): widen SendEmailInput with optional organizationId, threaded from org-holding producers #11839's Docker job was skipped. The step's full log could not be read from this session (the log host is blocked by the egress proxy).
Reproduced outside CI (Node v22.22.0, npm 10.9.4, the Dockerfile's command into a scratch prefix)
| Command | Result |
|---|---|
npm install -g @objectstack/cli@18.0.0-next.2 "pg@^8.0.0" "mysql2@^3.0.0" |
exit 1: npm error Cannot read properties of null (reading 'edgesOut') |
the same with @objectstack/cli@18.0.0-next.1 |
exit 1, same error |
the same with @objectstack/cli@17.7.0 (npm latest) |
exit 1, same error |
the next.2 command plus --legacy-peer-deps |
exit 0: 526 packages, os / objectstack bins present |
The crash site (npm debug log):
TypeError: Cannot read properties of null (reading 'edgesOut')
at #loadPeerSet (@npmcli/arborist/lib/arborist/build-ideal-tree.js:1289:38)
at async #loadPeerSet (build-ideal-tree.js:1297:11)
at async #buildDepStep (build-ideal-tree.js:904:11)
- Just before the crash, npm was fetching the peer set of
vitest(@vitest/coverage-*,@vitest/browser,@vitest/ui,happy-dom,jsdom,canvas,puppeteer-core). - The only
vitestedge among the CLI's 50@objectstack/*dependencies is@objectstack/metadata-core's optional peervitest: ^4.0.0(peerDependenciesMeta.vitest.optional: true). It is present in 17.7.0, next.1 and next.2. - What the reproduction implies:
- Every version fails today, including ones whose images built before.
- So the trigger is probably a newer third-party release inside that peer graph meeting npm 10.9's arborist, not anything in next.2 itself. NOT MEASURED: which package and which version.
- All published images are affected only for rebuilds. Already-pushed tags are not.
- Every
@objectstack/*dependency of the CLI at next.2 exists on npm (checked one by one), so this is not a missing publish.
Wanted (the lane picks; candidates, not a ruling)
- A Docker build that installs the CLI deterministically, for example:
--legacy-peer-deps(measured to work; check that no required peer is lost:pgandmysql2are installed explicitly);- or an install from a lockfile;
- or a pinned npm version in the image.
- Or remove the cause in the dependency graph: no
vitestpeer on a runtime package (metadata-core). - A follow-up Release run whose Docker job is green, and
ghcr.io/objectstack-ai/objectstack:18.0.0-next.2pushed. The Release job may need a re-run, or adocker-publishdispatch for that version. - Whatever is chosen, a check that a
node:22-slimglobal install of the published CLI succeeds, so this fails before a publish and not after.
Related: Release runs #11838, #11840–#11842 · docker/Dockerfile · .github/workflows/release.yml / docker-publish.yml.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 16, 2026
First touch: p1 confirmed · lane
domain:cli→domain:devx·pm:queue· triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-16T03:55ZRead in this act: the body in full (0 comments), #23788 and PR #23799, #23805 and #23806.
18.0.0-next.2image, and every rebuild of an older tag fails too. That is release priority (「发版本优先的都p1」).domain:devx.docker/Dockerfile's install line. The domain table names no lane for that path, so it routes by landing point, and the release on-ramp sits with devx.edgesOuton two lockfile-less installs (validate-deps vendor-export resolve, scaffold-e2e); fix on main, never on the generated branch #23788 (domain:devx, p1, in flight) is already measuring: npm 10's arborist crashes onvitest@4.1.12's contradictory peer set (edgesOut).edgesOuton the vendor-export probe and the blank scaffold — the probe installs with a pinned npm 11, the template overrides vitest #23799's override shape.--legacy-peer-depswithpgandmysql2named explicitly. Anoverrides.vitestpin, the shape PR fix(devx): npm 10 crashes withedgesOuton the vendor-export probe and the blank scaffold — the probe installs with a pinned npm 11, the template overrides vitest #23799 measured, is the other route.@vitest/browser-webdriverio@4.1.12. If it has, the crash may be gone without a code change.pm:queue. No dependency on release(next): the Version Packages PR #23481 is red — npm 10 crashes withedgesOuton two lockfile-less installs (validate-deps vendor-export resolve, scaffold-e2e); fix on main, never on the generated branch #23788's PR: the Dockerfile is its own file.os init/os createemit manifests npm 10 cannot install since vitest@4.1.12 (edgesOut); the CLI half of #23788's template override #23805 (os init/os createmanifests,domain:cli, p1) and finding: existing projects cannotnpm install @objectstack/plugin-author@objectstack/metadata-coreon npm 10 since vitest@4.1.12 (edgesOut); metadata-core's own optionalvitestpeer is one path in #23806 (plugin-auth/metadata-coreinstalls,domain:engine, p1).⛔ Not a claim.
objectstack-fleet commentedon Oct 16, 2026
Claim: PM loop round 6 (same round as #23788) ·
domain:devxseat 2 · 2026-10-16T04:53Z · triage first touch6207724201(p1,domain:devx); carried by the in-flight PR #23799, so no new dispatchSession:
session_016PVjjuVPte5XEJvaQx1E4tAccount:
os-sales(the seat's linked user asGET /useranswers it; the card's assignee)Branch:
claude/issue-23788-npm10-edgesoutWorktree:
objectstack-issue-23788Domain:
domain:devxSeat:
domain:devx#2File surface:
docker/Dockerfile, plusscripts/check-docs-image-tag.mjsas far as its install-line parse needs. Both are already in PR #23799 at headd19cc58886(#23788's revised claim6207588792). Stop on breach and explain it in the report.Container & model:
M,mode:subagent,model: TIER_DEFAULT(#23788's dev; no new dispatch)Clause-②: no
Responsibility:
the live npm registry: vitest@4.1.12's self-contradicting peer set, reached through optional vitest peers (better-auth; @objectstack/metadata-core), meets npm 10's arborist | none: the runtime image's global install had no pinned installer | every Release run's Docker job since #11838, and anyone building docker/DockerfileThread-read: 6207724201
Serial constraints cleared:
edgesOuton the vendor-export probe and the blank scaffold — the probe installs with a pinned npm 11, the template overrides vitest #23799's patch round (d19cc58886) already changes this exact line,docker/Dockerfile:69.npm install -g @objectstack/cli@${OS_CLI_VERSION} "pg@^8.0.0" "mysql2@^3.0.0"under a pinnednpm@11.21.0, fetched into/tmpand deleted in the same layer.docker buildonnode:22-slim(npm 10.9.9): before, exit 1edgesOutforOS_CLI_VERSION=17.7.0and for18.0.0-next.2; after, exit 0 for both.pg/mysql2,os --versionanddocker-publish.yml's smoke are unchanged against a pre-trigger control.--legacy-peer-deps, this card's first candidate, was measured on the probe to drop REQUIRED peers (better-call), so it was not taken.6208160119; in the merge queue since 2026-10-16T04:44Z. ItsFixesnames release(next): the Version Packages PR #23481 is red — npm 10 crashes withedgesOuton two lockfile-less installs (validate-deps vendor-export resolve, scaffold-e2e); fix on main, never on the generated branch #23788 only, so this card closes by the seat's landing record, not by the keyword.18.0.0-next.2image push, a re-run or adocker-publishdispatch for that version, is a release act and stays the maintainer's.Generated by Claude Code
objectstack-fleet commentedon Oct 16, 2026
Landed: the runtime image builds again, and
18.0.0-next.2is pushed ·domain:devxseat 2 ·session_016PVjjuVPte5XEJvaQx1E4t· 2026-10-16T05:10Zd795719926onorigin/main, merged 2026-10-16T05:02:56Z.docker/Dockerfileblob26ff3696bfequals the PR head (#23788's landing record6208488975)d795719926), conclusionsuccesssuccess(05:04:12Z–05:08:08Z)ghcr.io/objectstack-ai/objectstack:18.0.0-next.2(digestsha256:834b7ccdbf7c…) and ran it:@objectstack/cli/18.0.0-next.2 linux-x64 node-v22.23.3completedin this act, andpm:dispatchedis removed.check-entry-guard.mjscannot see an entry guard written inside a template literal — the percent-encoding spelling its own header documents passes the gate #11838 published npm18.0.0-next.2, and every Release run after it (check-entry-guard.mjscannot see an entry guard written inside a template literal — the percent-encoding spelling its own header documents passes the gate #11838–fix(scripts): admit a single-verb engine double on the contract it declares #11849) failed atdocker/Dockerfile'snpm install -g(npm 10'sedgesOutcrash onvitest@4.1.12's peer set). The first run on the fixedmainbuilt and pushed the18.0.0-next.2image. No re-run ordocker-publishdispatch is owed for that version.node:22-slimglobal install of the published CLI succeeds, so this fails before a publish". It now exists on every PR.scaffold-e2e.yml's "Scaffold with repo dist" buildsdocker/Dockerfilefrom the PR's tree. That is the job that caught this on PR fix(devx): npm 10 crashes withedgesOuton the vendor-export probe and the blank scaffold — the probe installs with a pinned npm 11, the template overrides vitest #23799 before the merge.os init/os createemit manifests npm 10 cannot install since vitest@4.1.12 (edgesOut); the CLI half of #23788's template override #23805 (os init/os create), finding: existing projects cannotnpm install @objectstack/plugin-author@objectstack/metadata-coreon npm 10 since vitest@4.1.12 (edgesOut); metadata-core's own optionalvitestpeer is one path in #23806 (existing projects, plus the self-hosting guide's self-built Dockerfile), ci(spec-shape-gate): once objectui drops its copy, the gate's header text and a retirement entry whose card closed still describe the old state #23782.Generated by Claude Code