Evidence record / deepseek-harness
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-13-deepseek-harness-a-cli-version-pin-does-not-freeze-ranged-dependencies-in-deepseek-s-vendored-cordis-stack
A CLI version pin does not freeze ranged dependencies in DeepSeek’s vendored Cordis stack. The 0.2 CLI requests its internal components at exact versions while intentionally permitting selected vendor patch updates. Pinning the CLI version does not freeze dependencies expressed as ranges. Commit a reviewed lockfile; the current rc still permits vendor patch updates. DeepSeek source-vendors, modifies and publishes Cordis from the harness repository. The alpha pi-ai range permits compatible later versions; that is not an observed installation result.
Channel: preview-or-beta; package manifests and registry history. Half: both. Date: 2026-09-22 (vendor releases and 0.1.5-rc.3).
Operator consequence: Replace the prior version-string-only advice with a reviewed lockfile and reproducible install procedure. Record resolved Cordis and pi-ai versions in evaluation baselines. Review DeepSeek’s vendor changes when a plugin-lifecycle defect appears; its framework patch train can change a fresh install without a new harness tag. Do not claim exact package totals, duplicate copies or hoisting from manifests alone.
Receipt
- https://github.com/deepseek-ai/deepseek-harness/commit/943af81a185ea4d70eda2b36598938857b1f851b
- https://github.com/deepseek-ai/deepseek-harness/blob/639ed015397290b3745d163aafe02ffee4aa3f84/vendor/README.md#L5-L40
- https://registry.npmjs.org/@deepseek-ai%2Fdsh/0.1.5-rc.2
- https://registry.npmjs.org/@deepseek-ai%2Fdsh/0.2.0-rc.2
- https://registry.npmjs.org/@earendil-works%2Fpi-ai
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-deepseek-harness-a-cli-version-pin-does-not-freeze-ranged-dependencies-in-deepseek-s-vendored-cordis-stack
Profile citations
- deepseek-harness / claim / ranged-vendor-dependencies
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-13-deepseek-harness-a-cli-version-pin-does-not-freeze-ranged-dependencies-in-deepseek-s-vendored-cordis-stackgithub.com/deepseek-ai/deepseek-harness/commit/943af81a185ea4d70eda2b36598938857b1f851btagged commit file2026-10-13-deepseek-harness-a-cli-version-pin-does-not-freeze-ranged-dependencies-in-deepseek-s-vendored-cordis-stackdeepseek-ai/deepseek-harness / vendor/README.md#L5-L40package registry2026-10-13-deepseek-harness-a-cli-version-pin-does-not-freeze-ranged-dependencies-in-deepseek-s-vendored-cordis-stackregistry.npmjs.org/@deepseek-ai%2Fdsh/0.1.5-rc.2package registry2026-10-13-deepseek-harness-a-cli-version-pin-does-not-freeze-ranged-dependencies-in-deepseek-s-vendored-cordis-stackregistry.npmjs.org/@deepseek-ai%2Fdsh/0.2.0-rc.2package registry2026-10-13-deepseek-harness-a-cli-version-pin-does-not-freeze-ranged-dependencies-in-deepseek-s-vendored-cordis-stackregistry.npmjs.org/@earendil-works%2Fpi-ai
Versioned source: run artifact