Skip to content

build(deps): replace ora with yocto-spinner - #214

Open
claude[bot] wants to merge 2 commits into
mainfrom
deps/replace-ora
Open

claude[bot] wants to merge 2 commits into
mainfrom
deps/replace-ora

Conversation

@claude

@claude claude Bot commented Oct 12, 2026 •

Copy link
Copy Markdown
Contributor

Requested by David Babenko-Sanders · Slack thread

This replaces ora with yocto-spinner. It has a single tiny dependency (yoctocolors, which has none of its own) and handles non-interactive output itself, so bin.ts maps directly onto its API. The lockfile drops ora and its 16 transitive packages and adds two, a net removal of 15 entries. In an interactive terminal the CLI output is visually unchanged: the same messages, colors, ✔ and ✖ symbols, exit codes and stderr output. When piped or in CI there are a few small differences. The first line now shows the spinner frame instead of a dash, the "Generating API" step gets its own line (ora skipped it), and the frame and symbol can carry color codes when the environment advertises color support.

🤖 Generated with Claude Code

https://claude.ai/code/session_01R1iLgtNj9JZPkuSQCZbGfR

picospinner has no runtime dependencies, so this drops ora and its 16
transitive packages from the dependency tree. picospinner does not detect
non-interactive output itself, so bin.ts only animates when stderr is an
interactive terminal and otherwise prints the start and final lines,
matching ora's previous behaviour in CI and when piped.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R1iLgtNj9JZPkuSQCZbGfR
@socket-security

socket-security Bot commented Oct 12, 2026 •

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedyocto-spinner@​1.2.26710010055100

View full report

yocto-spinner handles non-interactive output itself, so the custom
fallback helper in bin.ts is no longer needed and the port maps directly
onto ora's API. Its only dependency is yoctocolors, which has no
dependencies of its own.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R1iLgtNj9JZPkuSQCZbGfR
@claude claude Bot changed the title build(deps): replace ora with picospinner build(deps): replace ora with yocto-spinner Oct 12, 2026
@dsanders11
dsanders11 marked this pull request as ready for review October 12, 2026 18:41
@dsanders11
dsanders11 requested a review from a team as a code owner October 12, 2026 18:41

@claude claude Bot left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — straightforward dependency swap.

What was reviewed: the ora -> yocto-spinner substitution in src/bin.ts (import, construction via yoctoSpinner({ text }).start(), and the fail/succeed -> error/success method renames) against yocto-spinner's actual API; package.json's dependency entry swap; and yarn.lock, where the new entry only adds yocto-spinner + its single dependency yoctocolors, consistent with the described net removal of ora's transitive packages.

Extended reasoning...

Three-file diff: package.json swaps the ora dep for yocto-spinner, src/bin.ts updates the import/construction and renames two spinner methods (fail->error, succeed->success) to match the new library's API, and yarn.lock is regenerated accordingly with only yocto-spinner and its one dependency (yoctocolors) added. No security-sensitive surface (no auth, crypto, injection, or data exposure involved) — this only affects CLI progress-spinner output. The mapping from ora's API to yocto-spinner's is mechanical and 1:1, the lockfile change is consistent with the claimed dependency-tree shrink, and the PR already has a human APPROVED review with no outstanding objections.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants