install: fold the open bun install / pm / pack+publish PRs into one branch (172 PRs) - #39403
Draft
Jarred-Sumner wants to merge 176 commits into
Draft
install: fold the open bun install / pm / pack+publish PRs into one branch (172 PRs)#39403Jarred-Sumner wants to merge 176 commits into
Jarred-Sumner wants to merge 176 commits into
Conversation
…ackage.json parses them (#38869)
… when an install re-resolves (#39002)
… prints the binding (#39347)
…catalogs change (#38849)
…bun update <name> (#38847)
… tarball versions (#38331)
…ut a trailing slash (#38698)
…rn.lock migration (#38795)
…json relative to the package (#38990)
…cal file: package (#38814)
… relative to the package (#38816)
…action folder name (#39011)
…n the path buffers (#38359)
…n the path join buffer (#38368)
… the path buffer (#38390)
…mes and registry error text (#38631)
…tions and specifiers (#38977)
…adme through a symlink (#38707)
…ling slash from directories.bin (#38720)
…voking directory (#38739)
…json files, not bun.lock (#38813)
… the isolated linker (#37757)
…ckage dir is on another drive (#38018)
…h the bun exec hop (#38182)
…destination buffer (#38687)
…ten its assertions (#38504)
… failing on a one-shot probe (#39243)
…Excludes, OwnedURL proxy, is_candidate, publishConfig scope helpers, pnpm optional lockfile)
Collaborator
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Folds the open
bun install/bun pm/ pack+publish PRs from Aug 12–17 into one branch so they can be reviewed and landed together. Each original PR is one squashed commit here (<title> (#N)), in dependency order, so the branch stays bisectable; conflict resolutions between overlapping PRs live in the later PR's commit, and cross-PR API reconciliation is in themega-merge fixup:commits at the end.172 PRs folded, 2 excluded, 1 pending (see below).
cargo check --workspaceandcargo clippy --workspaceare clean; test status is tracked in the checklist at the bottom.Not folded
bun audit fixaudit_command.rs; needs a hand re-port (in progress)Security screen
Every folded diff was reviewed for regressions (path traversal, credential leakage, TLS/integrity weakening, lifecycle-script trust widening, terminal injection, new
unsafeon untrusted input). One PR was dropped for it (#38777 above). Items a reviewer may still want to eyeball — none were judged exploitable regressions:.bun-tag) no longer apply to any lockfile created after this lands. The reduction is defence-in-depth only: the checks are keyed on a digit the lockfile tamperer also controls, main already stamps v1 whenever bun's own output would trip them, a tamperer can supply a matching integrity for their own tarball anyway, and the git tag is re-validated at checkout/extract time (repository.rs:923, extract_tarball.rs:484; github tags stay checked at every version).?after#leak the fragment into the request path, though no attacker-chosen tarball results.bun install --ignore-scripts --no-savein the checkout first. Lifecycle trust is not widened (only reached via has_trusted_dependency, nested install ignores scripts, git deps are never default-trusted), but the nested install fetches and then (via prepare) executes third-party devDependencies chosen by the git repo's ranges without the project's bunfig protections, notably install.minimumReleaseAge / overrides / scoped registries, and it forwards the default-registry token into a child process whose cwd is attacker-authored.file:targets inside a registry/tarball/git package are now migrated as package-relative folder rows without normalising the sub-path, so a hand-edited key with..is no longer skipped at migration time and containment relies on the installer (hoisted linker checks it, with an overrides-name exemption; isolated linker does not).Product-behaviour changes worth a deliberate look: #38741 (new
bun.lockfiles are stampedlockfileVersion: 1again), #38797 (libcrecorded in bun.lock / bun.lockb meta), #38804 (a migrated lockfile and its package.json edits are only written when the command saves a lockfile), #38923 (bun pm lslists what is installed and exits 1 without node_modules), #38813 (pack/publish resolveworkspace:/catalog:from package.json files, not bun.lock).Conflict resolutions that changed a PR's code (not just context)
*peers after their siblings, not on arrival order #37713 × install: resolve a range onto an existing version only when every install has it #38832: kept install: resolve deferred*peers after their siblings, not on arrival order #37713's rule that a deferred peer never range-matches on sight (no*exemption); install: resolve a range onto an existing version only when every install has it #38832'sAppendedFor/settled_package_countmodel replaces theexact_pinnedguard, with install: keep transitive rows on the copy a direct dependency resolves to #38770's direct-dependency clause folded into the reusable predicate.resolve_peer_dep_version_based_amongkeeps install: rebind ranged peers whose target the saved tree drops #38768's candidate filter but drops the highest-candidate fallback install: keep a peer nothing in bun.lock satisfies where the file records it #38892 removed.collect_bundled_depsrefactor: took install: keep bundleDependencies from every dependency group when parsing a registry manifest #38857's per-versionbundled_dependencieslist.pnpm.rs: oneupdate_package_json_after_migration(lockfile: Option<&mut Lockfile>, …); everything is reported as “copied … in package.json” (pnpm keeps reading its own block), the write is deferred to lockfile save (install: write a migrated lockfile and its package.json edits only when the command saves a lockfile #38804), andbun pm migrateon a read-only package.json reports the failed write but keeps the migrated bun.lock (install: only open package.json for writing in the commands that rewrite it #38745's intent).url_authmodel instead of adding a second.npmrccredential table;--registrygoes through the sameset_default_registrypath unless the URL itself carries credentials (install: send credentials embedded in a registry URL that comes from an env var #38834).EscapeControlChars(redacted(…))(redact inside, escape outside); oneEscapeControlCharsimplementation (the multiline-capable one from pm view: escape control characters coming from the registry #38536) is kept.symlink_dependenciesreturnsResult<bool, TaskError>soLinkPathTooLongstill names the package.ScriptArgv::install_dependencies()builds the nestedbun install --ignore-scripts --no-saveargv.fail_fnremoved as in the PR; the invalid-name path from install: reject dependency names containing control characters #38615 now logs like the other root-resolution errors.packageDirnow callsetupTest().Folded PRs
Peer binding, hoisting, bun.lock load/round-trip, resolver dedupe (21)
*peers after their siblings, not on arrival order #37713 install: resolve deferred*peers after their siblings, not on arrival orderbun update / bun add package.json edits, overrides (7)
Lockfile migration (yarn / pnpm / npm) (17)
file: / link: / tarball / git local dependencies (16)
Path-buffer overflows: panic → error (15)
Terminal control-character escaping and credential redaction (9)
Registry auth, .npmrc, proxies, URL parsing (16)
bun pm subcommands, audit, help text (14)
bun pm pack / bun publish (13)
Linkers, bins, node_modules layout (9)
Lifecycle scripts, env, minimum-release-age, semver, auto-install (17)
Test-only changes (13)
Platform-specific (5)
Verification
cargo check --workspacecargo clippy --workspace --no-depstest/cli/install/**locally