Fix Bun patch compatibility and annotations - #245
Mikola Lysenko (mikolalysenko) wants to merge 3 commits into
Conversation
Support Bun text lock version 0 and reject workspace layouts whose tarball paths cannot survive native reinstalls. Refuse incompatible vendored downloads before recording manifest patch intent. Add native release/configuration checks for hosted, vendored and detached installs, patched bytes, integrity and rollback. Assisted-by: Codex:gpt-6-astra
Use the regular-file reader for Bun preflight and vendoring. Verify FIFO inputs refuse promptly, and snapshot the CLI for native runs so concurrent builds cannot change the binary under test. Assisted-by: Codex:gpt-6-astra
Apply Bun compatibility preflight to get by UUID as well as search. Exercise both entry points across the native release matrix. Assisted-by: Codex:gpt-6-astra
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit d475268. Configure here.
| })); | ||
| if !params.json && !params.silent { | ||
| eprintln!(" [error] {}: {detail}", search_result.purl); | ||
| } |
There was a problem hiding this comment.
Silent mode hides Bun refusal errors
Medium Severity
The new Bun vendor preflight refusals gate stderr on both --json and --silent. --silent is only supposed to suppress progress, so scan --mode vendored --silent and get --mode vendored --silent exit 1 with no diagnostic when the lock is unsupported. Nearby download failures in the same function already print on stderr whenever output is not JSON.
Additional Locations (1)
Triggered by learned rule: Workspace/user-writable file reads must use open_regular_file guard, not bare fs::read
Reviewed by Cursor Bugbot for commit d475268. Configure here.
1 participant
LLM Description written by Codex:gpt-6-astra
Bun patches must survive fresh installs and describe what the project actually consumes. This supports Bun's version-0 text locks and prevents incompatible vendored operations from leaving misleading patch records in
.socket/manifest.json.scan,getby PURL andgetby UUID before writing patch intent. Preserve existing explicit manifest entries and use the nonblocking regular-file reader.Validation:
The paired SBOM implementation is SocketDev/depscan#26450, stacked on SocketDev/depscan#26400, and pins this branch. The tests and fixtures are split into SocketDev/depscan#26453, stacked on the implementation PR, and reuse the existing real metadata/publication/SBOM validation framework.
See
docs/testing/bun-compatibility.mdfor reproduction commands and explicit boundaries: binary-only vendoring, old workspace layouts and absent native tarball digest enforcement in tested Bun releases before 1.3.14.