Fix dependency manager update prompts and filesystem actions #2226

jribbink · 2025-12-16T20:03:56Z

Closes #2224
Closes #2225

Description

Adds support for the SkipUpdatePrompts flag, and add support for dependency filesystem changes during deferred dependency prompts. Additionally adds support for the Update flag.

This is comparable to a y/n/prompt state, where:

Update => y
SkipUpdatePrompts => n
default => prompt

Test cases:

First install, up-to-date hashes => no prompt, install, no hash change
First install, outdated hashes => prompt, YES => install, hash change || NO => no install, no hash change
Already installed, up-to-date hashes => no-prompt, install, no hash change
Already installed, outdated hashes => prompt, YES => install, hash change || NO => no install, no hash change (IF NOT MATCHING => show error SECURITY -- we cannot fetch old hash yet, if MATCHING allow unchanged dep)
Edge case, prompts disabled, first install

Additionally - hash integrity validation (such that local file matches the flow.json hash) has been added to prevent these files from going out of sync.

For contributor use:

Targeted PR against master branch
Linked to Github issue with discussion and accepted design OR link to spec that describes this work
Code follows the standards mentioned here
Updated relevant documentation
Re-reviewed Files changed in the Github PR explorer
Added appropriate labels

github-actions · 2025-12-16T20:04:06Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

codecov-commenter · 2025-12-16T20:10:32Z

Codecov Report

❌ Patch coverage is 75.75758% with 24 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/dependencymanager/dependencyinstaller.go	75.75%	19 Missing and 5 partials ⚠️

📢 Thoughts on this report? Let us know!

jribbink · 2025-12-19T18:25:57Z

internal/dependencymanager/dependencyinstaller.go

+				// File exists - keep it at current version
+				msg := util.MessageWithEmojiPrefix("⏸️", fmt.Sprintf("%s kept at current version", pending.contractName))
+				di.logs.stateUpdates = append(di.logs.stateUpdates, msg)


This is not correct. We have no guarantee that the stored file hash matches the flow.json hash at this point.

However, files are stored in a processed state, and flow.json hashes are stored in the pre-processed state, so validation becomes tricky.

I think I got it 6c775c7

But this required changing the hashing function to consume the processed imports. Because of the fact that further dependencies are processed/handled independently anyways, and the contracts are only every used by DM in their processed representation, it seems safe to make this change.

NOTE: This will require a migration step, all devs on teams sharing projects will need to update their CLI to prevent the hash from constantly changing back and forth.

cc @chasefleming

jribbink · 2025-12-19T20:49:26Z

internal/cadence/linter.go

 )

-var analyzers = maps.Values(cdclint.Analyzers)
+// getAnalyzers returns analyzers in deterministic order (sorted by name)


Had flakey tests due to non-determinism here, was introduced in prior PR just never saw it yet. Might as well fix it now.

turbolent

Thank you for improving this!

internal/cadence/linter.go

Copilot

Pull request overview

This PR implements support for dependency update management through two new flags (--update and --skip-update-prompts) that control how the CLI handles outdated dependency hashes. The implementation adds validation to detect hash mismatches between local files and on-chain contracts, ensuring dependency integrity when users decline updates or skip prompts. Additionally, it includes a fix to ensure deterministic ordering of linters by sorting analyzer keys.

Key Changes

Added mutually exclusive flags --update (auto-accept updates) and --skip-update-prompts (auto-decline updates) with validation
Enhanced dependency installation to detect and handle hash mismatches with appropriate error messages and file system operations
Fixed non-deterministic linter behavior by sorting analyzer keys before execution

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
internal/dependencymanager/dependencyinstaller_test.go	Adds comprehensive test coverage for dependency installation scenarios including fresh clones, outdated hashes, and flag behaviors
internal/dependencymanager/dependencyinstaller.go	Implements update flag logic, hash validation, file integrity checks, and deferred prompt handling with filesystem operations
internal/cadence/linter.go	Replaces non-deterministic map iteration with sorted key ordering for consistent linter results

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-19T21:25:03Z

internal/dependencymanager/dependencyinstaller_test.go

+		modifiedContractCode := []byte(`access(all) contract Hello { access(all) fun sayHello(): String { return "Hello, Modified!" } }`)
+		newContractCode := []byte(`access(all) contract Hello { access(all) fun sayHello(): String { return "Hello, World! v2" } }`)
+
+		// Calculate the old hash (of the converted contract)


Corrected spelling of 'converted' to 'committed'.

Suggested change

// Calculate the old hash (of the converted contract)

// Calculate the old hash (of the committed contract)

Copilot · 2025-12-19T21:25:03Z

internal/dependencymanager/dependencyinstaller.go

+	// Calculate hash of converted contract (what gets written to disk)
+	// This is what we store in flow.json so we can verify file integrity later
+	// Imported contracts are still checked for consistency by traversing the dependency tree.


The comment on line 633 about 'Imported contracts' seems unclear in this context. Consider clarifying how imported contracts relate to the hash calculation being performed here, or remove this line if it's not directly relevant to the hash calculation logic.

Suggested change

// Calculate hash of converted contract (what gets written to disk)

// This is what we store in flow.json so we can verify file integrity later

// Imported contracts are still checked for consistency by traversing the dependency tree.

// Calculate hash of the converted contract source (the code that gets written to disk).

// This hash is stored in flow.json so we can later verify that the on-disk contract

// matches the version that was originally installed. Note that this hash only covers

// the primary contract; any imported contracts are validated separately as part of

// the dependency tree traversal logic elsewhere in the dependency manager.

Copilot · 2025-12-19T21:25:04Z

internal/dependencymanager/dependencyinstaller.go

+				// User chose not to update
+				// If file doesn't exist, we MUST fail - can't guarantee frozen deps (no way to fetch old version)
+				if !di.contractFileExists(pending.contractAddr, pending.contractName) {
+					return fmt.Errorf("dependency %s has changed on-chain but file does not exist locally. Cannot keep at current version because we have no way to fetch the old version from the blockchain. Either accept the update or manually add the contract file", pending.contractName)


This error message is quite long and could be more user-friendly. Consider breaking it into multiple lines or simplifying the explanation to improve readability.

Suggested change

return fmt.Errorf("dependency %s has changed on-chain but file does not exist locally. Cannot keep at current version because we have no way to fetch the old version from the blockchain. Either accept the update or manually add the contract file", pending.contractName)

return fmt.Errorf(

"dependency %s has changed on-chain, but the local contract file does not exist.\n"+

"Cannot keep the current version because the previous on-chain code cannot be fetched.\n"+

"Either accept the update or manually add the contract file.",

pending.contractName,

)

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

internal/dependencymanager/dependencyinstaller.go

Fix dependency manager update prompts and filesystem actions

6c95655

jribbink force-pushed the jribbink/fix-prompts branch from 1f648b3 to 6c95655 Compare December 16, 2025 20:06

fix emoji

209f5bc

jribbink marked this pull request as ready for review December 16, 2025 20:43

jribbink requested review from Kay-Zee, bjartek, chasefleming, janezpodhostnik, mfbz and nvdtf as code owners December 16, 2025 20:43

jribbink marked this pull request as draft December 16, 2025 20:46

jribbink marked this pull request as ready for review December 16, 2025 20:46

jribbink added the Improvement Technical work without new features, refactoring, improving tests label Dec 16, 2025

chasefleming approved these changes Dec 16, 2025

View reviewed changes

jribbink added 2 commits December 16, 2025 14:19

Fix edge cases & add tests

b80d6e9

fix lint

96838db

jribbink marked this pull request as draft December 16, 2025 23:26

jribbink marked this pull request as ready for review December 17, 2025 00:47

jribbink requested review from chasefleming and turbolent December 17, 2025 00:47

jribbink marked this pull request as draft December 17, 2025 00:52

jribbink marked this pull request as ready for review December 17, 2025 01:04

cleanup tests

d8a7b70

jribbink marked this pull request as draft December 17, 2025 02:34

Switch to fail if hash mismatch unless --update

b01830d

chasefleming approved these changes Dec 17, 2025

View reviewed changes

jribbink marked this pull request as ready for review December 18, 2025 06:40

jribbink commented Dec 19, 2025

View reviewed changes

jribbink added 3 commits December 19, 2025 11:32

Add hash check for preserved dependencies & change hashing function

6c775c7

Merge remote-tracking branch 'origin/master' into jribbink/fix-prompts

f03072e

Deterministic linter order

9858706

jribbink commented Dec 19, 2025

View reviewed changes

chasefleming requested a review from Copilot December 19, 2025 21:24

turbolent reviewed Dec 19, 2025

View reviewed changes

internal/cadence/linter.go Outdated Show resolved Hide resolved

internal/cadence/linter.go Outdated Show resolved Hide resolved

Copilot AI reviewed Dec 19, 2025

View reviewed changes

jribbink added 6 commits December 19, 2025 22:03

remove linter changes

475cfa3

Add additional integrity check

49e771c

reuse integrity check helper

9c28e1f

Tidy integrity checks logic

bcbe97a

remove needless defensive check

8b93bac

Fix repair logic

fb48b32

chasefleming requested a review from Copilot December 23, 2025 00:08

Copilot AI reviewed Dec 23, 2025

View reviewed changes

internal/dependencymanager/dependencyinstaller.go Show resolved Hide resolved

chasefleming reviewed Dec 23, 2025

View reviewed changes

internal/dependencymanager/dependencyinstaller.go Outdated Show resolved Hide resolved

chasefleming reviewed Dec 23, 2025

View reviewed changes

internal/dependencymanager/dependencyinstaller.go Outdated Show resolved Hide resolved

chasefleming reviewed Dec 23, 2025

View reviewed changes

internal/dependencymanager/dependencyinstaller.go Outdated Show resolved Hide resolved

address feedback

51cc6f1

jribbink requested a review from chasefleming December 23, 2025 00:51

Remove duplicative error reporting

4a58bf0

jribbink merged commit e7ae0ce into master Dec 23, 2025
9 checks passed

jribbink deleted the jribbink/fix-prompts branch December 23, 2025 02:18

	// Calculate the old hash (of the converted contract)
	// Calculate the old hash (of the committed contract)

-	// Calculate hash of converted contract (what gets written to disk)
-	// This is what we store in flow.json so we can verify file integrity later
-	// Imported contracts are still checked for consistency by traversing the dependency tree.
+	// Calculate hash of the converted contract source (the code that gets written to disk).
+	// This hash is stored in flow.json so we can later verify that the on-disk contract
+	// matches the version that was originally installed. Note that this hash only covers
+	// the primary contract; any imported contracts are validated separately as part of
+	// the dependency tree traversal logic elsewhere in the dependency manager.

-					return fmt.Errorf("dependency %s has changed on-chain but file does not exist locally. Cannot keep at current version because we have no way to fetch the old version from the blockchain. Either accept the update or manually add the contract file", pending.contractName)
+					return fmt.Errorf(
+						"dependency %s has changed on-chain, but the local contract file does not exist.\n"+
+							"Cannot keep the current version because the previous on-chain code cannot be fetched.\n"+
+							"Either accept the update or manually add the contract file.",
+						pending.contractName,
+					)

Fix dependency manager update prompts and filesystem actions #2226

Fix dependency manager update prompts and filesystem actions #2226

Conversation

jribbink commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Uh oh!

github-actions bot commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Scanned Files

Uh oh!

codecov-commenter commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

jribbink Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

jribbink Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jribbink Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

turbolent left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Key Changes

Reviewed changes

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

jribbink commented Dec 16, 2025 •

edited

Loading

github-actions bot commented Dec 16, 2025 •

edited

Loading

codecov-commenter commented Dec 16, 2025 •

edited

Loading

jribbink Dec 19, 2025 •

edited

Loading

jribbink Dec 19, 2025 •

edited

Loading