From 7f62155831547f36c717ae94c1ce0a813ff9a97b Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 13 Apr 2026 22:02:25 -0700
Subject: [PATCH] test: read process.versions expected hashes from
 scripts/build/deps

The process.versions test hardcoded the expected commit for each
vendored dependency, so every dep bump (including the automated
update-*.yml workflows) required a matching edit here.

Read the pinned commit out of scripts/build/deps/<name>.ts at test
time instead. This keeps a single source of truth and still verifies
the build correctly propagated each commit through
depVersionsHeader.ts -> bun_dependency_versions.h -> process.versions.
---
 test/js/node/process/process.test.js | 41 +++++++++++++++++-----------
 1 file changed, 25 insertions(+), 16 deletions(-)

diff --git a/test/js/node/process/process.test.js b/test/js/node/process/process.test.js
index 58ef76494d1a..aaa2117df72c 100644
--- a/test/js/node/process/process.test.js
+++ b/test/js/node/process/process.test.js
@@ -268,24 +268,33 @@ it("process.umask()", () => {
   expect(process.umask()).toBe(orig);
 });
 
-it("process.versions", () => {
-  // Expected dependency versions — must match scripts/build/deps/*.ts commits.
-  // These are the ACTUAL commits built into bun (not derived values, so
-  // bumping a dep requires updating this test too).
-  const expectedVersions = {
-    boringssl: "4f4f5ef8ebc6e23cbf393428f0ab1b526773f7ac",
-    libarchive: "ded82291ab41d5e355831b96b0e1ff49e24d8939",
-    mimalloc: "9a5e1f52cdf4662f9590b69de104a4469140796f",
-    picohttpparser: "066d2b1e9ab820703db0837a7255d92d30f0c9f5",
-    zlib: "886098f3f339617b4243b286f5ed364b9989e245",
-    tinycc: "12882eee073cfe5c7621bcfadf679e1372d4537b",
-    lolhtml: "77127cd2b8545998756e8d64e36ee2313c4bb312",
-    ares: "3ac47ee46edd8ea40370222f91613fc16c434853",
-    libdeflate: "c8c56a20f8f621e6a966b716b31f1dedab6a41e3",
-    zstd: "f8745da6ff1ad1e7bab384bd1f9d742439278e99",
-    lshpack: "8905c024b6d052f083a3d11d0a169b3c2735c8a1",
+it("process.versions", async () => {
+  // Verifies process.versions reports the same commits pinned in
+  // scripts/build/deps/*.ts. Reading the source files at test time keeps a
+  // single source of truth so dep bumps don't require touching this test.
+  const depsDir = resolve(import.meta.dir, "../../../../scripts/build/deps");
+  const deps = {
+    boringssl: "boringssl",
+    libarchive: "libarchive",
+    mimalloc: "mimalloc",
+    picohttpparser: "picohttpparser",
+    zlib: "zlib",
+    tinycc: "tinycc",
+    lolhtml: "lolhtml",
+    ares: "cares",
+    libdeflate: "libdeflate",
+    zstd: "zstd",
+    lshpack: "lshpack",
   };
 
+  const expectedVersions = {};
+  for (const [key, file] of Object.entries(deps)) {
+    const src = await Bun.file(join(depsDir, `${file}.ts`)).text();
+    const match = src.match(/^const [A-Z_]+_COMMIT = "([0-9a-f]{40})";$/m);
+    expect(match, `failed to extract commit from ${file}.ts`).not.toBeNull();
+    expectedVersions[key] = match[1];
+  }
+
   for (const [name, expectedHash] of Object.entries(expectedVersions)) {
     expect(process.versions).toHaveProperty(name);
     expect(process.versions[name]).toBe(expectedHash);