Skip to content

install: preserve empty trustedDependencies across install + lockfile round-trip#31197

Open
robobun wants to merge 8 commits into
mainfrom
farm/00f0a41e/fix-trusted-dependencies-empty-lockfile-roundtrip
Open

install: preserve empty trustedDependencies across install + lockfile round-trip#31197
robobun wants to merge 8 commits into
mainfrom
farm/00f0a41e/fix-trusted-dependencies-empty-lockfile-roundtrip

test: prove trustedDependencies: [] blocks default-trusted npm postin…

f2f8927
Select commit
Loading
Failed to load commit list.
Claude / Claude Code Review completed May 27, 2026 in 19m 4s

Code review found 1 potential issue

Found 1 candidates, confirmed 1. See review comments for details.

Details

Severity Count
🔴 Important 0
🟡 Nit 1
🟣 Pre-existing 0
Severity File:Line Issue
🟡 Nit test/cli/install/bun-install-lifecycle-scripts.test.ts:3200-3213 Concurrent tests bypass the file-level semaphore

Annotations

Check warning on line 3213 in test/cli/install/bun-install-lifecycle-scripts.test.ts

See this annotation in the file changed.

@claude claude / Claude Code Review

Concurrent tests bypass the file-level semaphore

nit: these two `tempDir`-based tests are declared `test.concurrent` but don't go through `setupTest()` / `acquireSlot()`, so they bypass the file-level `MAX_CONCURRENT=12` semaphore documented at lines 34-39 — the only `test.concurrent` in the file that do (the other two tests added in this PR at lines 3334/3407 correctly use `using ctx = await setupTest()`). Practical impact is negligible (single `file:` dep, no lifecycle scripts, no registry), but for consistency consider wrapping them in `awa