install: fix npm dependencies that share a workspace member's name - #37248
Open
robobun wants to merge 12 commits into
Open
install: fix npm dependencies that share a workspace member's name#37248robobun wants to merge 12 commits into
robobun wants to merge 12 commits into
Claude / Claude Code Review
completed
Aug 9, 2026 in 30m 55s
Code review found 1 important issue
Found 3 candidates, confirmed 2. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 1 |
| 🟡 Nit | 1 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🔴 Important | src/install/lockfile/bun.lock.rs:2939-2942 |
Displaced member's hoisted dep can bind to the npm package's nested dep on reload |
| 🟡 Nit | test/cli/install/bun-workspaces.test.ts:697-705 |
Undrained stdout pipe in duplicate-workspace-keys test |
Annotations
Check failure on line 2942 in src/install/lockfile/bun.lock.rs
claude / Claude Code Review
Displaced member's hoisted dep can bind to the npm package's nested dep on reload
For a displaced member, `workspace_node_modules` = `"<member_name>/<dep>"` probes the *npm package's* nested-dep key space (the root key `<member_name>` now belongs to the npm package). When the member's dep is dedup-hoisted to root (e.g. root also depends on the same version), `nested_res_id` misses, then this probe hits the npm package's nested `<member_name>/<dep>` and binds the wrong version — the correct root `<dep>` is never reached. Fix: when `pkg_id` appears in `member_tree_keys`, skip t
Check warning on line 705 in test/cli/install/bun-workspaces.test.ts
claude / Claude Code Review
Undrained stdout pipe in duplicate-workspace-keys test
This test spawns with `stdout: "pipe"` but only awaits `proc.stderr.text()` and `proc.exited`, leaving stdout undrained — REVIEW.md's subprocess rule requires draining every pipe concurrently to avoid the ~64KB OS-buffer deadlock. Since stdout isn't asserted on, change it to `stdout: "ignore"` (or add `proc.stdout.text()` to the `Promise.all`).
Loading