Repository navigation

install: fold the open bun install / pm / pack+publish PRs into one branch (171 PRs) - #39403

Closed

Jarred-Sumner wants to merge 259 commits into

mainfrom

claude/install-mega

Closed

install: fold the open bun install / pm / pack+publish PRs into one branch (171 PRs)#39403
Jarred-Sumner wants to merge 259 commits into
mainfrom
claude/install-mega

This pull request is big! We're only showing the most recent 250 commits

Commits on Aug 17, 2026
- install: print the update row for catalog entries moved by bun update (#38763)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  5ff49e0
- install: keep workspace and other non-registry entries as written on bun update <name> (#38847)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  28bd7ed
- Report package.json sync in the bun update summary instead of (no changes) (#38918)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  d551e67
- install: ignore leading whitespace in dist-tag, bare folder and local tarball versions (#38331)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  027facc
- install: apply both "overrides" and "resolutions" when package.json has both (#38811)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  ca65078
- Fix package-lock.json migration for scope registries configured without a trailing slash (#38698)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  e0ebdb4
- install: record package.json trustedDependencies when migrating a lockfile (#38773)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  3792fb1
- install: keep the pnpm block in package.json when migrating from pnpm (#38775)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  d18e84c
- install: fix default-trusted lifecycle scripts being blocked after yarn.lock migration (#38795)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  50c0b93
- install: migrate the whole pnpm-workspace.yaml catalog into bun.lock (#38829)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  de8bd47
- install: migrate a package's own file: directories from package-lock.json relative to the package (#38990)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  aa8ac26
- install: fail the isolated install when a link: dependency's target is missing (#38045)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  a0c28d1
- install: read the package.json of a file: dependency declared by a local file: package (#38814)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  b1ebbec
- install: keep file: folder paths declared by git and tarball packages relative to the package (#38816)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  66fd8c1
- install: drop the query string and fragment from a tarball URL's extraction folder name (#39011)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  ceec1c9
- install: cache file: tarballs under the integrity the lockfile pins (#39016)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  f5dc5bc
- install: reject tarball, folder and git packages whose package.json name is invalid (#38633)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  3050b80
- install: read git+git:// resolutions back from bun.lock (#38798)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  2e280b9
- install: stop aborting on link: specifiers and patch paths longer than the path buffers (#38359)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  c4681f4
- cli: stop aborting on --cwd and --tsconfig-override values longer than the path join buffer (#38368)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  aae3b85
- install: stop panicking when the cache directory setting does not fit the path buffer (#38390)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  8ecb292
- install: stop panicking when a progress bar name is longer than its buffer (#38558)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  c3c6e24
- install: stop aborting on linked package names that do not fit the symlink buffers (#38571)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  2f450e5
- install: fail verification instead of panicking when <alias>/package.json does not fit the path buffer (#38575)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  900279d
- pm ls --all: stop panicking on resolutions longer than 512 bytes (#38616)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  a4d081c
- pack/publish: stop panicking on package.json bin and files entries longer than the path buffer (#38784)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  f6055e8
- install: stop panicking on bin values longer than the path buffer (#38954)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  2feba6e
- pm view: escape control characters coming from the registry (#38536)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  6be3885
- install: redact secrets in the URLs printed for failed manifest and tarball downloads (#38817)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  5acc84e
- install: redact the registry URL in the manifest/tarball URL errors and keep namedRegistries credentials out of bun.lock (#38997)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  d4308e4
- install: keep registry credentials across redirects to the same hostname (#38001)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  058682f
- install: read NPM_CONFIG_USERCONFIG as the user-level .npmrc path (#38047)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  d8148a0
- publish, pm whoami: route registry requests through http_proxy (#38075)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  0648a52
- install: make BUN_CONFIG_NO_VERIFY disable integrity verification when set (#38310)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  1595a78
- install: honor BUN_CONFIG_MAX_HTTP_REQUESTS (#38744)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  a6f3a86
- url: emit a single slash in href_without_auth() for root-path registry URLs (#38812)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  aa52210
- url: parse the host of a protocol-relative URL instead of leaving the authority in the path (#39000)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  dc0e10c
- install: say --network-concurrency defaults to 64 in help and docs (#38759)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  efff492
- http: report a refused HTTP client thread as an error instead of a crash (#38766)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  3d96a1d
- bun why: print a package's dependents once, mark repeats as *deduped (#37922)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  878f8c2
- pm pkg: support arrays in set and delete (#38025)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  1ed8550
- install: format versions with the string buffer they were parsed from (bun outdated table, minimum-release-age messages) (#38649)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  3ad2bcf
- audit: list --production, --omit, --dry-run and --cwd in bun audit --help (#38836)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  0da2a66
- install: say --ignore-scripts also skips trusted dependencies' scripts in --help (#38893)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  943d87a
- pm: polish dedupe, prune, pm ls and pm licenses output (#38952)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  6e9b4b6
- prune: add --check, a CI gate that exits 1 when anything would be removed (#39216)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  5f82df2
- audit fix: never downgrade a package out of its installed release line (#39317)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  c046da3
- run: set npm_package_name/version/json and npm_config_local_prefix per run (#38071)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  090ab60
- publish: resolve a relative tarball path against the invoking directory (#38704)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  b26ca3c
- pack, publish: include entries on filesystems whose readdir reports DT_UNKNOWN (#38716)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  a65c1eb
- pack: build the tarball in memory and write it out only once it is complete (#38721)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  a0e4a6b
- publish: accept basic auth credentials from .npmrc and bunfig.toml (#38776)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  69a7f28
- install(hoisted): track replaced folders instead of deferring and re-verifying nested skips (#38303)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  1673399
- Resolve dangling node_modules symlinks as missing modules; isolated installs unlink failed optional dependencies (#38756)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  e67f81c
- install: link packages into a staging directory and rename them into place (#38783)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  094347b
- bunx: resolve directories.bin relative to the package (#39096)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  0f8652c
- install: drop the duplicated warn: label from the verbose tarball retry notice (#38648)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  c208fe4
- install: fix node-gyp shim PATH entry after tempdir falls back to cache/.tmp (#38098)
  
  autofix-ci[bot]
  authored and
  Jarred-Sumner
  committed
  888eb0d
- install: set npm_config_local_prefix and npm_package_config_* for lifecycle scripts (#38110)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  1182bbf
- install: install a git dependency's devDependencies before running its prepare scripts (#38810)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  3bd93d0
- install: skip root lifecycle scripts and the yarn.lock write under --dry-run (#38830)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  3d9f186
- install: remove the same-filesystem probe from $TMPDIR when the rename into the cache fails (#38859)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  378e014
- install: print version before package name in the minimum-release-age error (#37895)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  b66aeba
- install: support name@version entries in minimumReleaseAgeExcludes (#37909)
  
  alii
  authored and
  Jarred-Sumner
  committed
  40a5909
- install: do not resolve an exact version from an abbreviated manifest under minimum-release-age (#38659)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  8e43989
- semver: print the build tag from the printed version's buffer in the colored version diff (#38688)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  4dbbd3b
- test(install): serve URL tarball dependencies locally in bun-install.test.ts (#37919)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  0e7bc38
- test(install): keep bun-update-security-provider on the dummy registry, assert the update, run concurrently (#38185)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  d9e8908
- test(install): give each long-label bun patch test its own install cache (#38255)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  b0cbf87
- test(bunx): install fixture packages from a local registry instead of real ones (#38467)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  4a95e9e
- test(install): don't require the refetched manifest to be cached before install exits (#38580)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  9154925
- test(install): normalize the registry URL, not the bare port, in the lockb print snapshot (#38627)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  606fa28
- test(harness): let verdaccio pick its own port and fail start() when it exits early (#38891)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  c993618
- test(install): run overrides.test.ts against the local registry (#39022)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  abb11b0
- test(install): serve GitHub tarball fixtures locally in the GHSA-pfwx-36v6-832x and lifecycle script tests (#39115)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  7bd4bbf
- test: add a harness isRoot and skip the chmod-based ls and Bun.file cases as root (#39232)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  f5a2381
- install: schedule the Windows hardlink task through the allocation's own pointer (#37865)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  67ebfdb
- install.ps1: make the "another bun.exe is already in PATH" check work (#38567)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  ecbcc87
- install: don't issue openat2/fchmodat2 on Android (seccomp SIGSYS) (#39084)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  6dd1b74
- bunx: serialize concurrent installs into the shared cache dir with a file lock (#37851)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  ebaa3ab
- install: resolve deferred `*` peers after their siblings, not on arrival order (#37713)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  e71ecab
- install: rebind ranged peers whose target the saved tree drops (#38768)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  d07fe12
- install: resolve a range onto an existing version only when every install has it (#38832)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  c322e02
- install: keep a bundle's dependency out of a slot the bundling package resolves through (#38848)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  a28a204
- test(install): pin both no-deps versions instead of racing a range against a pin (#38858)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  286db7b
- install: resolve file: dependencies loaded from the lockfile relative to the top-level dir (#38850)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  45bc543
- install: link file: dependencies of registry packages from inside the package with the isolated linker (#38856)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  0782bd8
- install: bound isolated store entry names; tarball URL credentials; file: tarballs relative to their folder package (#38867)
  Jarred-Sumner
  committed
  2a25218
- install: refuse local tarball dependencies declared by packages installed from the cache (#38986)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  8615ba7
- install(hoisted): link a file: override applied to a dependency of an installed package (#38994)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  f6f08d8
- install: refuse link: paths with .. or an absolute path declared by packages installed from the cache (#39023)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  ba53b82
- install: report ENAMETOOLONG for a --cwd value that does not fit the path buffer (#38375)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  7c5f7be
- install: escape control characters in the bun pm untrusted/trust script listing (#38525)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  a000fd0
- install: reject dependency names containing control characters (#38615)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  311d13a
- http: escape control characters in the verbose request/response trace (#38673)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  d769b50
- pm licenses: escape control characters in text output, including the name@version column (#39358)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  96939c3
- install: send credentials embedded in a registry URL that comes from an env var (#38834)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  4208268
- install: send Basic auth for a registry URL with a username but no password (#39063)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  3819c86
- pm view: match the requested range against the buffer it was parsed from (#38671)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  07d5691
- install: remove the node_modules links of a renamed or removed workspace (#38511)
  
  dylan-conway
  authored and
  Jarred-Sumner
  committed
  bc1fdc0
- Fix bun install through subst drives, cross-drive junctions, and symlinked package.json (#39361)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  1b83d8f
- mega-merge fixup: drop duplicate definitions from add/add merges (get_parent_pkg_of_dependency, is_local_package, EscapeControlChars)
  Jarred-Sumner
  committed
  42790a5
- install: keep bundled peer edges on their own bun.lock entry when loading (#38837)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  9341d22
- install: keep bundleDependencies from every dependency group when parsing a registry manifest (#38857)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  85ddaf3
- Hold a transitive update that would re-fork a deduped package (#38919)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  f718dc6
- install: stop hoisting a dependency cycle forever (#38976)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  e7e9d15
- install: warn when the hoisted tree serves a peer from a root copy outside its range (#39053)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  806c0cc
- install: stamp lockfileVersion 1 on new bun.lock files (#38741)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  9e16aa9
- test(install): establish the warm manifest cache before the unmet peer test re-resolves (#39190)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  4513393
- install: keep the workspace: spelling given to bun add <member>@workspace:<range> (#38866)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  3123ac3
- install: ignore leading whitespace wherever a dependency literal is classified or re-parsed (#38309)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  a61a054
- install: migrate pnpm onlyBuiltDependencies and report blocked scripts under the isolated linker (#38780)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  3069d7a
- install: name folder, tarball and git packages without a package.json name after their source (#38681)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  5974687
- install: reinstall node_modules when switching between the isolated and hoisted linkers (#38779)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  1a2abf9
- resolver: make auto-install use the version range from the project's package.json (#38198)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  4dfe3d0
- install: import pnpm-workspace.yaml even without a migratable pnpm-lock.yaml (#38754)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  e6abb9b
- install: skip workspace members whose package.json has no name (#38781)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  234864f
- install: migrate pnpm importer rows in the shape package.json parsing produces (#38791)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  14d0592
- install: migrate workspace packages from yarn.lock (#38878)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  e381220
- install: fix yarn.lock migration panic on tarball URLs with "/-/" right after the host (#38803)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  f02dbde
- install: name yarn.lock npm: alias packages after the alias spec, not the tarball URL (#38948)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  8149293
- install: migrate yarn.lock registry entries that have no resolved field (#38985)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  c9769ce
- install: skip yarn.lock entries the migration cannot build a resolution for (#39001)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  3eddf99
- install: migrate npm-shrinkwrap.json like package-lock.json (#38861)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  9c8d7f3
- install: write a migrated lockfile and its package.json edits only when the command saves a lockfile (#38804)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  e2cf8c4
- install: resolve file: and link: dependencies on the same directory as separate packages (#38114)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  3448f0a
- install: stop leaking the displaced cache folder when a tarball is re-extracted (#38702)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  1a5d1cf
- install: fail the isolated install with ENAMETOOLONG when a link: target does not fit the path buffer (#38369)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  6c3cec6
- install: do not abort when $XDG_CONFIG_HOME or $HOME is too long for the .npmrc path buffer (#38372)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  c07f07c
- install: stop aborting on -g when $BUN_INSTALL, $XDG_CACHE_HOME or $HOME does not fit the global directory path buffer (#38413)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  e52625c
- install: keep linking the remaining bins when one bin or one dependency's bins fail to link (#38972)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  eac007b
- pack: report an error instead of panicking when --destination does not fit the path buffer (#38749)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  6c1231a
- publish: report ENAMETOOLONG for a tarball path that does not fit the path buffer (#38753)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  9ef4c85
- install: replace an existing manifest cache entry atomically instead of unlinking it first (#38916)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  1c0fcb4
- Make bun pm ls list installed packages instead of lockfile entries (#38923)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  bbb6ec0
- cli: load a package.json and name a lockfile load step from one place (#39165)
  
  alii
  authored and
  Jarred-Sumner
  committed
  151394c
- install: warn when a registry manifest advertises an integrity hash bun cannot use (#38484)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  59d0465
- install: describe the real --save default in bun link and bun unlink --help (#38915)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  cfc2fbd
- audit fix: report and rewrite the overrides rule that holds a vulnerable version (#38785)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  1cb7329
- publish, pm whoami, audit: honor NODE_TLS_REJECT_UNAUTHORIZED=0 like bun install (#38093)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  c5a0cac
- install: escape control characters in resolutions, specifiers, bin names and registry error text (#38631)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  b4ff8be
- install: redact credentials in tarball and git URLs printed as resolutions and specifiers (#38977)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  7fd4f9f
- Normalize http_proxy/https_proxy env values through the WHATWG parser (#38043)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  e1e85d6
- install: resolve .npmrc //host/ credentials by request URL (#38800)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  a55d541
- Add --why to bun dedupe to show one level of dependents under each row (#39217)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  4940a4f
- publish: honor publishConfig.registry and publishConfig["@scope:registry"] (#38322)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  fb80e2d
- pack: skip bins reached through symlinks; publish: do not read the readme through a symlink (#38707)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  66ea950
- pack: store tarball entry names byte for byte (#38715)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  8badee9
- pack: pack a file listed under several bin names once, strip the trailing slash from directories.bin (#38720)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  1795b12
- pm pack: resolve relative --destination and --filename against the invoking directory (#38739)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  c25f95a
- pack/publish: resolve workspace: and catalog: specs from the package.json files, not bun.lock (#38813)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  336133a
- pack: publish workspace: directory dependencies as the workspace's version (#38835)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  9cd2ed6
- pack: publish workspace: aliases as npm: aliases (#38788)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  4447340
- install: link over an empty directory left at node_modules/<pkg> with the isolated linker (#37757)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  93fa66e
- install(windows): store an absolute target in .bunx shims when the package dir is on another drive (#38018)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  05f0c62
- run, install: honor --no-env-file / --env-file for scripts run through the bun exec hop (#38182)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  b7c8a29
- install: warn instead of failing when minimum-release-age blocks a peer dependency (#38995)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  a8f1780
- semver: record cloned prerelease/build tag offsets against the whole destination buffer (#38687)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  65321d0
- auto-install: report why a root dependency could not be resolved (#38180)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  007e7c5
- install: only open package.json for writing in the commands that rewrite it (#38745)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  8d9e760
- install: filter optionalDependencies by libc and record it in the lockfile (#38797)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  875a8f1
- test(install): speed up bun-install.test.ts and tighten its assertions (#38464)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  74e4d91
- test(install): run bun-install-registry.test.ts concurrently and tighten its assertions (#38504)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  cf01325
- test/docker: wait for the docker daemon in the coordinator instead of failing on a one-shot probe (#39243)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  297ed01
- mega-merge fixup: cargo fmt + prettier after conflict resolution
  Jarred-Sumner
  committed
  394b889
- mega-merge fixup: reconcile APIs across folded PRs (MinimumReleaseAgeExcludes, OwnedURL proxy, is_candidate, publishConfig scope helpers, pnpm optional lockfile)
  Jarred-Sumner
  committed
  0adcafa
- mega-merge fixup: clippy
  Jarred-Sumner
  committed
  2381dc6
- audit: fail closed on malformed registry responses and escape control characters in the report (#38557)
  
  robobun
  authored and
  Jarred-Sumner
  committed
  b56be59
- mega-merge fixup: test expectations + isolated link:/blocked-scripts paths after folding
  Jarred-Sumner
  committed
  0ac90d6
- Revert "install: install a git dependency's devDependencies before running its prepare scripts (#38810)"
  Jarred-Sumner
  committed
  aa6cb64
- mega-merge fixup: isolated link: targets are joined with .. resolution; userinfo split matches the URL parser; test expectations
  Jarred-Sumner
  committed
  e4a0624
- mega-merge fixup: dedupe --why rows carry the (removed)/(downgrade) markers; audit header moved to stdout
  Jarred-Sumner
  committed
  1d7592c
- mega-merge fixup: registry test helpers take their test's dir; expectations for combined output
  Jarred-Sumner
  committed
  60834d5
- mega-merge fixup: a workspace member dropped from the glob no longer counts as a direct dependent (#38770 x #38919)
  Jarred-Sumner
  committed
  f37ed31
- mega-merge fixup: remaining registry-test scaffolding; update-row wording in snapshots
  Jarred-Sumner
  committed
  4cd0c85
- mega-merge fixup: yarn migrator composes #38795/#38948/#38985/#39001; expectations for combined behaviour in catalogs, pnpm migration and redacted logs
  Jarred-Sumner
  committed
  a62c1b2
- mega-merge fixup: pnpm block is kept in package.json (#38775) in the #38804/#38780 tests
  Jarred-Sumner
  committed
  6270cbe
- mega-merge fixup: long-bin tests use per-test dirs under describe.concurrent
  Jarred-Sumner
  committed
  3d4477f
- [autofix.ci] apply automated fixes
  autofix-ci[bot]
  authored
  0359cdc
- simplify(s3-linkers): drop PackageInstall::destination_dir_subpath_buf, join subpaths with join_z_spill
  Jarred-Sumner
  committed
  96fd819
- simplify(s3-linkers): Installer path builders share append_store_path_at; hoist error formatters in on_task_fail
  Jarred-Sumner
  committed
  57be4ae
- simplify(s3-linkers): share remove_link, shrink StoreKey resolution cap, trim resolver/extract docs
  Jarred-Sumner
  committed
  fc2f23c
- simplify(s3-linkers): tighten unlink_failed_optional_entries and count_blocked_scripts; use is_local_package
  Jarred-Sumner
  committed
  d997e8c
- simplify(s3-linkers): DependencyBinaries carries (entry, error) tuples; trim comments
  Jarred-Sumner
  committed
  e7f9496
- simplify(s3-linkers): contained_folders returns the two bitsets; empty cache subpath as a match guard
  Jarred-Sumner
  committed
  11761e8
- simplify(s3-linkers): remove_stale_workspace_links builds each path fresh; import/doc nits
  Jarred-Sumner
  committed
  8cc893c
- simplify(s3-linkers): keep link_to_hidden_node_modules as on main; build the hidden link path inline when unlinking failed optional entries
  Jarred-Sumner
  committed
  9af2977
- simplify(s3-linkers): install into StagingPath through a re-targeted PackageInstall instead of threading dest_subpath through every backend
  Jarred-Sumner
  committed
  b220be0
- simplify(s3-linkers): qualify path::SEP so the import is not unused on Windows
  Jarred-Sumner
  committed
  5d7286f
- simplify(s3-linkers): LinkPathTooLong always names the failing entry's own package
  Jarred-Sumner
  committed
  c82f934
- simplify(s2-paths): one checked NUL-terminated join and one normalize spill in resolve_path
  Jarred-Sumner
  committed
  9bface2
- simplify(s2-paths): tighten sys additions (flock, Android gate, DT_UNKNOWN resolution, lchmod fallback)
  Jarred-Sumner
  committed
  4291290
- simplify(s2-paths): bunx install lock as one InstallLock type; trim directories/CLI-args comments
  Jarred-Sumner
  committed
  5a6c48a
- simplify(s2-paths): compact ScriptArgv, pack bin-kind walk and destination handling, trim comments
  Jarred-Sumner
  committed
  1038bdd
- simplify(s2-paths): make_path NotFound guard without splitting arms; compact errno/io helpers and PackageManager comments
  Jarred-Sumner
  committed
  ee5da43
- simplify(s2-paths): inline --cwd and --network-concurrency handling back into the param tables
  Jarred-Sumner
  committed
  7339b54
- simplify(s2-paths): bin.rs candidate loop and rel_buf spill via resolve_path::buf_or_spill
  Jarred-Sumner
  committed
  d4ff1d7
- simplify(s2-paths): compact test-only highway stubs in resolve_path
  Jarred-Sumner
  committed
  466acbf
- simplify(s2-paths): arrays instead of vec! in resolve_path test
  Jarred-Sumner
  committed
  758d7b3
- simplify(s2-paths): compact Windows flock and the keep_existing_destination test
  Jarred-Sumner
  committed
  799a650
- simplify(s2-paths): parse_platform_flag returns the value directly
  Jarred-Sumner
  committed
  68532c3
- simplify(s2-paths): tuple variants for pack Substitution
  Jarred-Sumner
  committed
  bc6fac8
- simplify(s2-paths): keep --save/--no-save in SHARED_TAIL_PARAMS, splice link/unlink wording
  Jarred-Sumner
  committed
  4f9285e
- simplify(s2-paths): publish reads a too-long tarball path through the same error path
  Jarred-Sumner
  committed
  088e2fc
- simplify(s2-paths): clippy (needless borrow, or_fun_call)
  Jarred-Sumner
  committed
  3a3fea3
- simplify(s2-paths): bunx directories.bin path in two lines
  Jarred-Sumner
  committed
  c75cf51
- simplify(s2-paths): note the SHARED_TAIL_PARAMS prefix LINK_SHARED_PARAMS replaces
  Jarred-Sumner
  committed
  83ca65a
- simplify(s5-net-pm): collapse registry/credential helpers, redirect policy, tree dedup bookkeeping
  Jarred-Sumner
  committed
  caab328
- simplify(s5-net-pm): flatten pm pkg Segment, shorter escape sites, trim manifest-map/trust/ini comments
  Jarred-Sumner
  committed
  fcb24ff
- simplify(s5-net-pm): tighter override-rule matching in audit fix edits, comment trims
  Jarred-Sumner
  committed
  161be97
- simplify(s5-net-pm): one entry list for minimumReleaseAgeExcludes, shorter package.json open in pm trust
  Jarred-Sumner
  committed
  eb44523
- simplify(s5-net-pm): one error arm for invalid publishConfig registry values
  Jarred-Sumner
  committed
  5b747d0
- simplify(s1-resolver): one Lockfile::package_satisfying for the name+range scans
  Jarred-Sumner
  committed
  04ee65a
- simplify(s1-resolver): drop Plan/Planned/InstanceEdges/DirectRow scaffolding in update_transitive
  Jarred-Sumner
  committed
  3e713fe
- simplify(s1-resolver): update_transitive direct rows use keep_locked_if_ahead itself
  Jarred-Sumner
  committed
  e0f4a09
- simplify(s1-resolver): share is_named_update_row between should_update and the transitive plan
  Jarred-Sumner
  committed
  69d743e
- simplify(s1-resolver): runTasks manifest-fallback helpers as free fns only, note lookup inline
  Jarred-Sumner
  committed
  ed69d51
- simplify(s1-resolver): Tree.rs comment trims; bind_peer relies on deferred_peer_range's peer check
  Jarred-Sumner
  committed
  e523102
- simplify(s1-resolver): bun.lock.rs: fold FoundAt into RowEvidence, WorkspaceLinks into a closure over map_dep_to_pkg
  Jarred-Sumner
  committed
  e212fd6
- simplify(s1-resolver): bun.lock.rs comment trims
  Jarred-Sumner
  committed
  7e92966
- simplify(s1-resolver): one add_dependency_error for enqueue_dependency_list and the re-resolve loops; iwm comment trims
  Jarred-Sumner
  committed
  cfbf752
- simplify(s1-resolver): Package.rs drops the name check is_safe_lockfile_package_name subsumes; dependency.rs trims
  Jarred-Sumner
  committed
  54bc94a
- simplify(s1-resolver): comment trims across the cluster
  Jarred-Sumner
  committed
  70dcc0a
- simplify(s1-resolver): edges_on_instances walks reachability with lockfile::reachable over snapshot-patched resolutions
  Jarred-Sumner
  committed
  e7a1d30
- simplify(s1-resolver): small tidies (packages_named in verify_data, deferred field)
  Jarred-Sumner
  committed
  1da5488
- simplify(s1-resolver): rebase_folder_dependencies without the field destructuring
  Jarred-Sumner
  committed
  eda2b88
- simplify(s1-resolver): tree_printer print_catalog_entry_updates without the redundant pre-scan
  Jarred-Sumner
  committed
  73f438b
- simplify(s1-resolver): would_revive_leftover walks rows by id
  Jarred-Sumner
  committed
  6400e11
- simplify(s1-resolver): prune HoistedTree memoizes Installed in one vec
  Jarred-Sumner
  committed
  d63b606
- simplify(s1-resolver): Lockfile::declarer_of for the three declarer-locality checks
  Jarred-Sumner
  committed
  70eb8e9
- simplify(s1-resolver): dedupe --why: inline the dependents cap
  Jarred-Sumner
  committed
  7649b37
- simplify(s1-resolver): flatter invalid-name check in enqueue
  Jarred-Sumner
  committed
  e0bb850
- simplify(s1-resolver): Tree.rs out-of-range root peer check via try_npm
  Jarred-Sumner
  committed
  d0b00a6
- simplify(s4-migration): yarn.rs — one dependency-section table, fold git URL parsing, dedupe package.json parsing
  Jarred-Sumner
  committed
  eeff6b2
- simplify(s4-migration): pnpm.rs — merge-based copy_into_root, one workspaces object path, drop redundant trusted fill
  Jarred-Sumner
  committed
  4921339
- simplify(s4-migration): workspace_manifests + WorkspaceMap — reuse folder_relative_to_top_level_dir, drop the Scanned enum
  Jarred-Sumner
  committed
  6c30170
- simplify(s4-migration): CatalogMap/OverrideMap/migration/PackageJSONEditor tightening
  Jarred-Sumner
  committed
  0ca611e
- simplify(s4-migration): yarn/pnpm second pass — Binder becomes a fn, get_or_put_value for ids, tighter helpers
  Jarred-Sumner
  committed
  e48dfc2
- simplify(s4-migration): npm_lock/PackageJSONEditor/pnpm — parse_platform_list takes the optional field, tuple for the folder-in-dependent case, clippy fix
  Jarred-Sumner
  committed
  211a000
- simplify(s4-migration): yarn.rs is_registry_entry alias strip
  Jarred-Sumner
  committed
  ccb8e96
- simplify(s4-migration): shorten two remaining multi-line comments
  Jarred-Sumner
  committed
  648ae0f
- simplify(s4-migration): migration.rs report line
  Jarred-Sumner
  committed
  4f9f3b4
- simplify(s4-migration): apply review findings
  Jarred-Sumner
  committed
  256407b
- mega-merge fixup: CI failures — skip the pthread_create shim under ASAN, root package.json write error wording (#38754 x #38804), bun update keeps a still-covering >= range (#38185)
  Jarred-Sumner
  committed
  98c14ef
- simplify: use fmt::for_terminal at the remaining EscapeControlChars(redacted(..)) sites
  Jarred-Sumner
  committed
  8cb91a3
- audit fix: rewrite a matching rule in resolutions too when package.json has both fields (#38785 x #38811)
  Jarred-Sumner
  committed
  f425845
- prettier
  Jarred-Sumner
  committed
  40ad36d
- review: write the migrated package.json before the lockfile (#38754 contract), bunx lock next to the cache dir with O_NOFOLLOW + owner check, escape names in bun why / pm licenses, userconfig tests…
  Jarred-Sumner
  committed
  9f1c929
- review: pm migrate on a read-only package.json fails before bun.lock too (test), mordant findings (dependency_buf naming, one tag->name helper, prune init without bare bools)
  Jarred-Sumner
  committed
  b99be10
- Merge remote-tracking branch 'origin/main' into claude/install-mega
  Jarred-Sumner
  committed
  65bd4dd

Commits

Commits on Aug 17, 2026