install: resolve a range onto an existing version only when every install has it - #38832
Open
robobun wants to merge 5 commits into
Open
install: resolve a range onto an existing version only when every install has it#38832robobun wants to merge 5 commits into
robobun wants to merge 5 commits into
Claude / Claude Code Review
completed
Aug 15, 2026 in 29m 9s
Code review found 1 important issue
Found 1 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 1 |
| 🟡 Nit | 0 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🔴 Important | src/install/lockfile.rs:1994-2009 |
appended_for.exact is order-dependent for settled transitive packages |
Annotations
Check failure on line 2009 in src/install/lockfile.rs
claude / Claude Code Review
appended_for.exact is order-dependent for settled transitive packages
`appended_for.exact` is set by whichever row happens to append the package, so when two transitive rows share the same best-match version but differ in exactness (e.g. `a→z@1.1.0` and `b→z@^1.0.0`, both resolving to 1.1.0), the stored `exact` bit depends on manifest arrival order. After `mark_settled_packages()`, a peer-subtree row like `p→z@*` (best match 2.0.0) then evaluates `(id < settled) && (exact || 1==2)` and either reuses z@1.1.0 or appends z@2.0.0 depending on which parent's manifest a
Loading