Support Bun with bun.lock
#11209
Support Bun with bun.lock
#11209
Conversation
Electroid
force-pushed
the
feat-bun-lock
branch
from
fea8765 to
4c0f1b0
Compare
| # install from npm/cli/lib/pack.js as --ca="contents of ca file" - "ca" is | ||
| # populated automatically by npm when setting "--cafile" and passed through in | ||
| # when spawning the cli to install git dependencies. | ||
| cafile=/usr/local/share/ca-certificates/dbot-ca.crt |
There was a problem hiding this comment.
A note for the reviewers: That CA file does not appear in the dev-shell. While npm and yarn silently ignore its absence, Bun throws an error since it can't be found. Let me know if this is okay to remove, it appears all the tests continue to pass without this.
|
Ready for review! The relevant tests run and are passing! Regarding the CI status, some of the e2e tests unrelated to this PR fail with a transient error: |
|
|
||
| return @bun_lock if @bun_lock || directory == "/" | ||
|
|
||
| # Loop through parent directories looking for a pnpm-lock |
There was a problem hiding this comment.
| # Loop through parent directories looking for a pnpm-lock | |
| # Loop through parent directories looking for a bun.lock |
|
|
||
| version = content["lockfileVersion"] | ||
| raise_invalid!("expected 'lockfileVersion' to be an integer") unless version.is_a?(Integer) | ||
| raise_invalid!("expected 'lockfileVersion' to be >= 0") unless version >= 0 |
There was a problem hiding this comment.
perhaps stick to version 0 only, until newer versions are known to be compatible?
|
Thank you so much @Electroid ! We'll try to expedite the reviews on our end |
|
Thanks for the PR @Electroid 🙇♂️ |
What are you trying to accomplish?
This PR adds support for Bun, which is the most upvoted, open issue for Dependabot:
bun#6528Bun is an
npm-compatible package manager, so it has been added to thenpm_and_yarnsource code, alongside other package managers like yarn and pnpm.Previously, Bun used a binary lockfile,
bun.lockb. In Bun 1.1.39, It was changed to a text-based format and renamed tobun.lock. Support for previous binary lockfile is possible, but it's easier to just support the text-based one, since it's the new default.Here's an example
bun.lockfile.Example
Using the dry-run scripts, here's an example diff from Dependabot with Bun support.
Commands:
Output:
=> bump prettier from 3.0.3 to 3.4.2 ± package.json ~~~ --- /tmp/original20250103-42610-8gx53l 2025-01-03 01:35:22.414182006 +0000 +++ /tmp/updated20250103-42610-jqc6nh 2025-01-03 01:35:22.414182006 +0000 @@ -43,7 +43,7 @@ "@types/react": "^18.3.11", "@types/ws": "^8.5.13", "eslint": "^9.17.0", - "prettier": "3.0.3", + "prettier": "3.4.2", "typescript": "~5.7" } } ~~~ 2 insertions (+), 2 deletions (-) ± bun.lock ~~~ --- /tmp/original20250103-42610-wdnxjr 2025-01-03 01:35:22.415182006 +0000 +++ /tmp/updated20250103-42610-txs2y1 2025-01-03 01:35:22.415182006 +0000 @@ -21,7 +21,7 @@ "@types/react": "^18.3.11", "@types/ws": "^8.5.13", "eslint": "^9.17.0", - "prettier": "3.0.3", + "prettier": "3.4.2", "typescript": "~5.7", }, "peerDependencies": { @@ -422,7 +422,7 @@ "prelude-ls": ["[email protected]", "", {}, "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g=="], - "prettier": ["[email protected]", "", {}, "sha512-L/4pUDMxcNa8R/EthV08Zt42WBO4h1rarVtK0K+QJG0X187OLo7l699jWw0GKuwzkPQ//jMFA/8Xm6Fh3J/DAg=="], + "prettier": ["[email protected]", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-e9MewbtFo+Fevyuxn/4rrcDAaq0IYxPGLvObpQjiZBMAzB9IGmzlnG9RZy3FFas+eBMu2vA0CszMeduow5dIuQ=="], "punycode": ["[email protected]", "", {}, "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg=="], ~~~ 3 insertions (+), 3 deletions (-)Anything you want to highlight for special attention from reviewers?
Of course, tests and fixtures have been added to test Bun! Let me know if I missed anything.
How will you know you've accomplished your goal?
Here is a random sample of repositories using
bun.lockthat you can try with the dry-run scripts:Checklist