Skip to content

build(deps-dev): bump oxfmt from 0.58.0 to 0.61.0 #150

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

build(deps-dev): bump oxfmt from 0.58.0 to 0.61.0 #150

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@
"flexsearch": "^0.8.0",
"husky": "^9.1.7",
"katex": "^0.18.1",
"oxfmt": "^0.58.0",
"oxfmt": "^0.61.0",

@coderabbitai coderabbitai Bot Aug 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

jq -r '.devDependencies.oxfmt' package.json
rg -n -C2 '"oxfmt"|patchedDependencies' bun.lock
fd -i 'oxfmt.*patch' patches

Repository: haydenbleasel/blume

Length of output: 3989

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- package.json ---'
cat -n package.json | sed -n '40,55p'

printf '%s\n' '--- bun.lock metadata and oxfmt entries ---'
cat -n bun.lock | sed -n '1,45p;170,190p;2128,2145p'

printf '%s\n' '--- patch ---'
cat -n patches/oxfmt@0.58.0.patch

printf '%s\n' '--- repository change summary ---'
git diff --stat
git diff -- package.json bun.lock 'patches/oxfmt@0.58.0.patch'

Repository: haydenbleasel/blume

Length of output: 12236

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

python3 - <<'PY'
import json
import urllib.request

url = "https://registry.npmjs.org/oxfmt"
with urllib.request.urlopen(url, timeout=20) as response:
    data = json.load(response)

for version in ("0.58.0", "0.61.0"):
    entry = data["versions"].get(version)
    if entry is None:
        print(f"{version}: not published")
        continue
    print(f"{version}: tarball={entry['dist']['tarball']}")
    print(f"{version}: integrity={entry['dist'].get('integrity')}")
PY

for version in 0.58.0 0.61.0; do
  url="https://registry.npmjs.org/oxfmt/-/oxfmt-${version}.tgz"
  printf '%s\n' "--- oxfmt ${version} markdown bundle matches ---"
  curl -fsSL "$url" |
    tar -xzOf - "package/dist/markdown-"*.js 2>/dev/null |
    rg -n -m3 'Preserve line breaks|oxfmtPrevIsTitledFence|case "whitespace"|proseWrap' || true
done

Repository: haydenbleasel/blume

Length of output: 2443

🌐 Web query:

Bun lockfile frozen install behavior package.json bun.lock dependency spec mismatch patchedDependencies

💡 Result:

In Bun, the --frozen-lockfile flag is intended to enforce reproducible installs by ensuring that bun install exits with an error if the package.json and bun.lock file are out of sync [1]. Behavioral Summary and Known Issues: 1. Consistency Enforcement: When --frozen-lockfile is used, Bun installs exact versions recorded in the lockfile [1]. Historically, there have been identified cases where the check failed to detect certain types of drift—such as when adding new direct dependencies or divergence in workspace dependency maps—but recent updates (notably up to mid-2026) have improved this to ensure any divergence in package.json dependency maps results in a non-zero exit code [2][3]. 2. Error Scenarios: If Bun detects that the lockfile would need to be updated to match package.json, it exits with an error message: "error: lockfile had changes, but lockfile is frozen" [4][3]. This is designed to prevent CI/CD pipelines from silently proceeding with outdated dependencies [5][1]. 3. Patched Dependencies: - Behavior: Bun uses the patchedDependencies field in the root package.json to manage and apply .patch files to dependencies in node_modules [6]. - Scope: By design, Bun expects patchedDependencies to be defined at the install root [7]. If workspace members contain their own patchedDependencies, it can cause issues or errors during installation because Bun may try to resolve those paths relative to the root rather than the member's directory [7][8]. - Missing Patches: If a declared patch file is missing, the installation will fail [9]. This is particularly common in pruned monorepo environments (e.g., using turbo prune), where patch files might be omitted from the output [9]. Fixes have been implemented to allow skipping missing patch files if the corresponding package is not part of the active dependency graph [9]. 4. Troubleshooting Drift: If you encounter the "lockfile had changes" error when you believe your state is consistent, it often points to: - Transitive resolution differences or inconsistencies in overrides/self-referencing overrides [10]. - Differences in how workspaces resolve dependencies versus the root lockfile [2]. - Temporary caching or migration issues (e.g., transitioning from binary bun.lockb to text-based bun.lock) [11][4]. For CI/CD environments, it is recommended to use bun ci, which is explicitly optimized for reproducible builds and enforces the frozen lockfile check by default [1].

Citations:

Synchronize bun.lock with the oxfmt upgrade.

package.json declares ^0.61.0, but bun.lock still resolves oxfmt@0.58.0 and its version-specific patch. Bun frozen installs reject this drift. Regenerate bun.lock and port the patch to 0.61.0, or remove it if the new version includes the required behavior.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 49, Synchronize the lockfile with the oxfmt dependency
declared in package.json: regenerate bun.lock so it resolves oxfmt ^0.61.0
instead of 0.58.0, and update or remove the existing version-specific patch
depending on whether 0.61.0 already includes that behavior. Ensure frozen Bun
installs no longer detect dependency drift.

"oxlint": "^1.73.0",
"react": "^19.0.0",
"react-dom": "^19.0.0",
Expand Down
Loading