dshmarket 1.73.16: Three Fixes Across Compatibility, Verify and Profile (Nov 8, 2026)

One release, and the evenings stay single: per the npm registry (fetched 2026-11-09), 1.73.16 went up at 16:53:59 UTC on November 8 and took over the dist-tag latest — dshmarket 1.73.15: Three Fixes, as Two of 1.73.14’s First-Timers Return (Nov 7, 2026) covered the previous evening. The GitHub release page stamps 16:51:56 UTC, authored by the repo’s github-actions bot, and links the compare range v1.73.15…v1.73.16.

Three fixes, one new name

Per the release notes, the What’s Changed list holds exactly three items, all fixes; the New Contributors section returns after 1.73.15 skipped it, naming @Eapp1e, whose PR #1149 carries the release’s profile fix. The other two authors are 1.73.14’s first-timers on a third straight appearance: per that release’s notes @solquin (PR #1130) and @gongfpp (PR #1126) first contributed there, and per 1.73.15’s notes both authored fixes in 1.73.15 as well.

PR #1143 (fix(compatibility)) — a card’s verdict stops depending on how the author wrote the bound. Per its PR body, parseComparator in src/compatibility.ts accepted only a full X.Y.Z target, so a partial bound — <0.3, ^0.1 — returned null from boundsFor and declaredLines, the card read unknown, and satisfiesRange already refused the same release; the full-version spelling <0.3.0 had given the right verdicts all along. The body’s table walks the flip: with the peer range >=0.1.5 <0.3, host 0.2.4 now reads compatible where it read unknown, and host 0.1.2 reads incompatible. The fix exports expandPartialComparator from check.ts and runs a partial comparator through it before parsing, so both sides agree on where a line ends (<0.3 to <0.3.0-0, ^0.1 to >=0.1.0 <0.2.0-0); a partial caret or tilde keeps its ceiling implicit, and a bare partial like 1.2 stays unparseable, matching satisfiesRange. Per the body, this is a follow-up to #1130, which had listed the case under not in this pr.
PR #1145 (fix(verify)) — the restart reason names the actual patch shape. Per its PR body, the restart verdict treated parseSimplePatch’s null as proof of a single cause and told every non-plain patch it contains config/expression rows; six shapes land on that null and only the config-block row was ever true — the sample in issue #1102, dsh-mnemon’s shipped patch (an id row plus disabled: true), was described with a config block it does not contain. The same verdict also read the package root’s cordis.patch.yml regardless of what the package declares, while the hot mount resolved dsh.bundle.patch through the declared files — a patch declared in ./extensions/dsh/ was judged from no file at all; patchTextOf now reads what the host reads: declared files, the root file as fallback, all-or-nothing. Per the body, every existing restart case still comes out restart — the change is the sentence and which file is read.
PR #1149 (fix(profile)) — an install made from a GitHub Release archive now links to its catalog card. Per issue #1147, a plugin shipped only as a Release tarball — there, Fatfish Notes (dsh-fatfish-notes 0.6.0), not published to npm — installed with no catalog identity: Discover kept offering Install on a plugin that was already installed, and the Installed tab showed the bare package name and URL instead of the catalog card. Per the PR body, with two catalog rows sharing a package name the name lookups fall back to the ambiguous-name rule and claim neither, and repoOfTarget deliberately refuses Release asset URLs because the same asset URL can serve different bytes later; the fix falls back to lookupRepoFromUrl for exactly this display path, while install, rollback, duplicate detection and build-script approval keep reading the helpers that still refuse those URLs.

The notes list nothing beyond the three — no features, no other fixes.

Cadence

Per the same 2026-11-09 registry fetch: seventeen of the eighteen evenings from 10-22 to 11-08 carry at least one dshmarket release, with quiet 10-25 still the only gap; 11-08 counts exactly one version at the fetch (16:53:59 UTC), a second straight single-release evening after 1.73.15. dsh-market keeps its nightly rhythm, and the release page is still authored by the repo’s github-actions bot rather than a human account.

Three fixes, one new name

Cadence

More in this series