build(deps-dev): bump oxfmt from 0.58.0 to 0.61.0 - #150
Conversation
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Holding off on this one: oxfmt is patched locally ( |
Bumps [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) from 0.58.0 to 0.61.0. - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.61.0/npm/oxfmt) --- updated-dependencies: - dependency-name: oxfmt dependency-version: 0.61.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
6da5108 to
f5d31bf
Compare
📝 WalkthroughWalkthroughThe ChangesFormatter dependency update
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Line 49: Synchronize the lockfile with the oxfmt dependency declared in
package.json: regenerate bun.lock so it resolves oxfmt ^0.61.0 instead of
0.58.0, and update or remove the existing version-specific patch depending on
whether 0.61.0 already includes that behavior. Ensure frozen Bun installs no
longer detect dependency drift.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| "husky": "^9.1.7", | ||
| "katex": "^0.18.1", | ||
| "oxfmt": "^0.58.0", | ||
| "oxfmt": "^0.61.0", |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
jq -r '.devDependencies.oxfmt' package.json
rg -n -C2 '"oxfmt"|patchedDependencies' bun.lock
fd -i 'oxfmt.*patch' patchesRepository: haydenbleasel/blume
Length of output: 3989
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- package.json ---'
cat -n package.json | sed -n '40,55p'
printf '%s\n' '--- bun.lock metadata and oxfmt entries ---'
cat -n bun.lock | sed -n '1,45p;170,190p;2128,2145p'
printf '%s\n' '--- patch ---'
cat -n patches/oxfmt@0.58.0.patch
printf '%s\n' '--- repository change summary ---'
git diff --stat
git diff -- package.json bun.lock 'patches/oxfmt@0.58.0.patch'Repository: haydenbleasel/blume
Length of output: 12236
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
import json
import urllib.request
url = "https://registry.npmjs.org/oxfmt"
with urllib.request.urlopen(url, timeout=20) as response:
data = json.load(response)
for version in ("0.58.0", "0.61.0"):
entry = data["versions"].get(version)
if entry is None:
print(f"{version}: not published")
continue
print(f"{version}: tarball={entry['dist']['tarball']}")
print(f"{version}: integrity={entry['dist'].get('integrity')}")
PY
for version in 0.58.0 0.61.0; do
url="https://registry.npmjs.org/oxfmt/-/oxfmt-${version}.tgz"
printf '%s\n' "--- oxfmt ${version} markdown bundle matches ---"
curl -fsSL "$url" |
tar -xzOf - "package/dist/markdown-"*.js 2>/dev/null |
rg -n -m3 'Preserve line breaks|oxfmtPrevIsTitledFence|case "whitespace"|proseWrap' || true
doneRepository: haydenbleasel/blume
Length of output: 2443
🌐 Web query:
Bun lockfile frozen install behavior package.json bun.lock dependency spec mismatch patchedDependencies
💡 Result:
In Bun, the --frozen-lockfile flag is intended to enforce reproducible installs by ensuring that bun install exits with an error if the package.json and bun.lock file are out of sync [1]. Behavioral Summary and Known Issues: 1. Consistency Enforcement: When --frozen-lockfile is used, Bun installs exact versions recorded in the lockfile [1]. Historically, there have been identified cases where the check failed to detect certain types of drift—such as when adding new direct dependencies or divergence in workspace dependency maps—but recent updates (notably up to mid-2026) have improved this to ensure any divergence in package.json dependency maps results in a non-zero exit code [2][3]. 2. Error Scenarios: If Bun detects that the lockfile would need to be updated to match package.json, it exits with an error message: "error: lockfile had changes, but lockfile is frozen" [4][3]. This is designed to prevent CI/CD pipelines from silently proceeding with outdated dependencies [5][1]. 3. Patched Dependencies: - Behavior: Bun uses the patchedDependencies field in the root package.json to manage and apply .patch files to dependencies in node_modules [6]. - Scope: By design, Bun expects patchedDependencies to be defined at the install root [7]. If workspace members contain their own patchedDependencies, it can cause issues or errors during installation because Bun may try to resolve those paths relative to the root rather than the member's directory [7][8]. - Missing Patches: If a declared patch file is missing, the installation will fail [9]. This is particularly common in pruned monorepo environments (e.g., using turbo prune), where patch files might be omitted from the output [9]. Fixes have been implemented to allow skipping missing patch files if the corresponding package is not part of the active dependency graph [9]. 4. Troubleshooting Drift: If you encounter the "lockfile had changes" error when you believe your state is consistent, it often points to: - Transitive resolution differences or inconsistencies in overrides/self-referencing overrides [10]. - Differences in how workspaces resolve dependencies versus the root lockfile [2]. - Temporary caching or migration issues (e.g., transitioning from binary bun.lockb to text-based bun.lock) [11][4]. For CI/CD environments, it is recommended to use bun ci, which is explicitly optimized for reproducible builds and enforces the frozen lockfile check by default [1].
Citations:
- 1: https://bun.com/docs/pm/cli/install
- 2: install: fail --frozen-lockfile on manifest drift and fix the spurious lockfile re-saves behind it oven-sh/bun#33632
- 3: bun install --frozen-lockfile does not exit with error when it should oven-sh/bun#13823
- 4:
--frozen-lockfileis saying changes to lockfile whenbun installsays there is not oven-sh/bun#20913 - 5: bun install --frozen-lockfile does not fail when lockfile is out of sync oven-sh/bun#24223
- 6: https://bun.sh/docs/pm/cli/patch
- 7: fix(install): ignore patchedDependencies from workspace members oven-sh/bun#27895
- 8: Nested workspace package patchedDependencies break root install oven-sh/bun#27894
- 9:
bun installfails whenpatchedDependenciesfile is missing in pruned monorepo contexts oven-sh/bun#26969 - 10: bun update writes a bun.lock that fails the very next bun install --frozen-lockfile oven-sh/bun#31748
- 11: https://bun.com/docs/pm/lockfile
Synchronize bun.lock with the oxfmt upgrade.
package.json declares ^0.61.0, but bun.lock still resolves oxfmt@0.58.0 and its version-specific patch. Bun frozen installs reject this drift. Regenerate bun.lock and port the patch to 0.61.0, or remove it if the new version includes the required behavior.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` at line 49, Synchronize the lockfile with the oxfmt dependency
declared in package.json: regenerate bun.lock so it resolves oxfmt ^0.61.0
instead of 0.58.0, and update or remove the existing version-specific patch
depending on whether 0.61.0 already includes that behavior. Ensure frozen Bun
installs no longer detect dependency drift.
|
Looks like oxfmt is up-to-date now, so this is no longer needed. |
1 participant
Bumps oxfmt from 0.58.0 to 0.61.0.
Commits
65fe65drelease(apps): oxlint v1.76.0 && oxfmt v0.61.0 (#24976)83abe3brelease(apps): oxlint v1.75.0 && oxfmt v0.60.0 (#24713)e2e0f94chore(docs): update sponsor section (#24588)2d4e8d2release(apps): oxlint v1.74.0 && oxfmt v0.59.0 (#24454)415fe1efix(oxfmt): error on ignorePatterns that cannot match files outside the confi...Summary by CodeRabbit