chore: bump decentraland-dapps to 29.5.0 - #3466
LautaroPetaccio wants to merge 2 commits into
Conversation
Moves off the commit-tagged prerelease 29.3.1-20260805170817.commit-f4ffa6a and onto the stable release line. That prerelease was the published build of release v29.3.1 (commit f4ffa6a, "return the amount for usd-pegged trade assets"), which is a direct ancestor of 29.5.0, so the pegged-listings fix from #3461 is retained. Picked up on top of it: - 29.4.0: allow loading analytics.js from a custom url - 29.5.0: point ContentfulClient to cms-api.decentraland.org The lockfile change is limited to the decentraland-dapps entry; there is no transitive dependency churn.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Coverage Report for CI Build 32147850432Coverage remained the same at 52.979%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
decentraland-bot
left a comment
decentraland-bot
left a comment
There was a problem hiding this comment.
Reviewed the dependency-only bump from decentraland-dapps ^29.3.1-20260805170817.commit-f4ffa6a to ^29.5.0.
Findings:
- No P0/P1 issues found.
- Dependency declaration and lockfile resolution are consistent; the lockfile churn is limited to the expected
decentraland-dappsentry. - The
^29.5.0range is acceptable under Decentraland dependency guidelines for internal packages in an app, and the committed lockfile pins the installed tarball to29.5.0. - No Builder public API surface changes, so no downstream consumer breakage identified.
- No security issues found in the changed files.
npm audit --omit=devreports existing repository dependency advisories, but this PR does not introduce transitive dependency churn and CI audit is passing.
CI: audit, tests, and Vercel preview are passing; set-rollout is skipped.
Approved.
Reviewed by Jarvis 🤖 · Requested by Lautaro Petaccio (<@U025WCHLMN3>) via Slack
…aland-ui2 decentraland-ui2 dynamically imports @contentful/rich-text-react-renderer in Banner/ContentfulRichText as an optional peer. Vite must still resolve the import() at build time to emit the lazy chunk, so with the package absent the build failed with "Could not resolve @contentful/rich-text-react-renderer". The decentraland-dapps 29.5.0 bump reaches that code path. Installing the peer (^16.0.0) also pulls in @contentful/rich-text-types transitively.
decentraland-bot
left a comment
decentraland-bot
left a comment
There was a problem hiding this comment.
Re-review — dependency bump from decentraland-dapps ^29.3.1-prerelease → ^29.5.0
Findings
[P2] Undocumented new direct dependency — @contentful/rich-text-react-renderer@^16.2.2 is added to package.json as a new direct dependency, but the PR description doesn't mention it. The description also states "package-lock.json changed only the decentraland-dapps entry — no transitive dependency churn", which is inaccurate — the lockfile also adds @contentful/rich-text-react-renderer@16.2.2 and its transitive dep @contentful/rich-text-types@17.2.7. This isn't a blocker, but the description should be corrected for traceability.
What's correct
decentraland-dappsversion range and lockfile resolution are consistent; lockfile pins to29.5.0.- The
^29.5.0range is appropriate for an internal package in an app repo with a committed lockfile. - No source code changes — no Builder public API surface affected, no downstream consumer breakage.
@contentful/rich-text-react-rendereris a well-maintained MIT-licensed Contentful package and builder already uses Contentful (config, sagas, store).- Git conventions followed: title
chore: bump decentraland-dapps to 29.5.0, branchchore/bump-decentraland-dapps-29.5.0.
Security
No security issues found. No secrets in the diff, no new attack surface. CI audit is passing.
CI
All checks passing — audit ✅, tests (1536/1536) ✅, Vercel preview deployed ✅, set-rollout skipped (expected).
Verdict
Approved — no P0/P1 issues. The P2 is a documentation accuracy nit, not a merge blocker.
Reviewed by Jarvis 🤖 · Requested by Gabriel Díaz (<@U03MGHMAJL8>) via Slack
4 participants
What
Bumps
decentraland-dappsfrom^29.3.1-20260805170817.commit-f4ffa6ato^29.5.0, moving off the commit-tagged prerelease and back onto the stable release line.Nothing is lost from the prerelease pin
The old pin's npm
gitHeadisf4ffa6a, which is the commit behind releasev29.3.1—fix: return the amount for usd-pegged trade assets(decentraland/decentraland-dapps#813), the fix #3461 bumped for. There is no plain29.3.1on npm; that release was published as the commit-tagged build, which is why we were pinned to it.29.5.0'sgitHeadisc65ed48, andgit compare f4ffa6a...29.5.0reportsstatus: ahead, ahead_by: 2, behind_by: 0— the old commit is a strict ancestor. Confirmed in the installed tarball too: theUSD_PEGGED_MANAcase indist/lib/trades.jsis present.Picked up on top of it
ContentfulClienttocms-api.decentraland.org(fix: point ContentfulClient to cms-api.decentraland.org decentraland-dapps#815)The
ContentfulClienthost change is the one behavioural change worth a look on QA, since it repoints where CMS content is fetched from.Verification
package-lock.jsonchanged only thedecentraland-dappsentry — no transitive dependency churntsc --noEmit— cleannpm test— 118/118 suites, 1536/1536 tests passing🤖 Generated with Claude Code