chore(deps): bun update --latest - #1854
Conversation
|
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
📝 WalkthroughWalkthroughThis PR pins all ChangesDependency Version Management
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates numerous dependencies in package.json and converts them from caret-based ranges to pinned versions. A critical version mismatch was identified between the ccusage core package and its scoped extensions, which could lead to runtime errors.
| "agent-browser": "0.27.0", | ||
| "agentcash": "0.14.4", | ||
| "btca": "2.0.5", | ||
| "ccusage": "20.0.4", |
There was a problem hiding this comment.
The ccusage package has been updated to version 20.0.4, but the related scoped packages in the same suite (@ccusage/amp, @ccusage/codex, @ccusage/opencode, and @ccusage/pi) remain on version 19.0.0 (lines 17-21). This version mismatch between the core package and its plugins/extensions is highly likely to cause compatibility issues or runtime errors. Please ensure the entire ccusage suite is updated to compatible versions.
![indent-zero[bot]](https://avatars.githubusercontent.com/in/1426746?s=60&v=4){kind=small}
| "@fission-ai/openspec": "1.3.1", | ||
| "@getgrit/cli": "0.1.0-alpha.1743007075", | ||
| "@github/copilot": "1.0.54", | ||
| "@google/gemini-cli": "0.43.0", |
There was a problem hiding this comment.
Major-version bumps mixed into a lockfile-maintenance PR. bun update --latest doesn't respect the major/non-major split that renovate.json enforces (packageRules at lines 97-108 vs 146-156). Inside this single PR:
@kaitranntt/ccs^7.79.1→8.1.0@upstash/context7-mcp^2.2.5→3.0.0ccusage^19.0.3→20.0.4chrome-devtools-mcp^0.26.0→1.0.1
These are exactly the cases that should land via the All Major Dependencies group so the release notes get a look. Consider reverting them in this PR and letting renovate raise them separately.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
| "vite": "^8.0.13", | ||
| "vite-plus": "^0.1.21", | ||
| "xcodebuildmcp": "^2.5.2", | ||
| "@anthropic-ai/claude-code": "2.1.150", |
There was a problem hiding this comment.
Lockfile workspace deps drifted from package.json. Commit abae972 re-added the ^ prefix to every entry in package.json but left the workspace dependencies map in bun.lock (lines 7-72) at the exact pins from the prior commit (e.g. "@anthropic-ai/claude-code": "2.1.150" here vs "^2.1.150" in package.json). On main this block mirrored the manifest with carets, and the next bun install will rewrite it to re-add them. Please run bun install and commit the refreshed bun.lock so the two files stay in sync (and any future --frozen-lockfile CI step doesn't fail on a manifest/lockfile mismatch).
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Around line 14-77: The installer is not passing the desired version when
installing globals, so Bun can resolve a newer drifted version; update
home-manager/modules/npm-globals/install-npm-globals.sh to use the extracted
version spec when calling bun (use bun add --global "${dep}@${wanted}" or
equivalent) and ensure the script still correctly extracts the wanted variable
from package.json (the dep and wanted variables referenced in the diff);
alternatively, if you prefer strict reproducibility, change package.json entries
to exact versions (remove caret ranges) and keep the installer call as-is.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 9371ccd7-ea4c-47ce-9784-9d86989f8789
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (1)
package.json
| "@anthropic-ai/claude-code": "2.1.150", | ||
| "@augmentcode/auggie": "0.28.0", | ||
| "@biomejs/biome": "2.4.15", | ||
| "@ccusage/amp": "19.0.0", | ||
| "@ccusage/codex": "19.0.0", | ||
| "@ccusage/mcp": "18.0.11", | ||
| "@ccusage/opencode": "19.0.0", | ||
| "@ccusage/pi": "19.0.0", | ||
| "@fission-ai/openspec": "1.3.1", | ||
| "@getgrit/cli": "0.1.0-alpha.1743007075", | ||
| "@github/copilot": "1.0.54", | ||
| "@google/gemini-cli": "0.43.0", | ||
| "@google/jules": "0.1.42", | ||
| "@googleworkspace/cli": "0.22.5", | ||
| "@kaitranntt/ccs": "8.1.0", | ||
| "@mariozechner/pi-coding-agent": "0.73.1", | ||
| "@nanocollective/nanocoder": "1.26.1", | ||
| "@oh-my-pi/pi-coding-agent": "15.2.4", | ||
| "@oh-my-pi/pi-natives": "15.2.4", | ||
| "@oh-my-pi/swarm-extension": "13.17.0", | ||
| "@openai/codex": "0.133.0", | ||
| "@pencil.dev/cli": "0.2.6", | ||
| "@pkieltyka/gitgenie": "0.1.2", | ||
| "@pulumi/pulumi": "3.243.0", | ||
| "@redwoodjs/agent-ci": "0.16.2", | ||
| "@schpet/linear-cli": "2.0.0", | ||
| "@sourcegraph/amp": "0.0.1779686836-g4ef406", | ||
| "@steipete/bird": "0.8.0", | ||
| "@tobilu/qmd": "2.5.2", | ||
| "@traces-sh/traces": "0.5.9", | ||
| "@typescript/native-preview": "7.0.0-dev.20260525.1", | ||
| "@upstash/context7-mcp": "3.0.0", | ||
| "@vibe-kit/grok-cli": "0.0.34", | ||
| "acpx": "0.10.0", | ||
| "agent-browser": "0.27.0", | ||
| "agentcash": "0.14.4", | ||
| "btca": "2.0.5", | ||
| "ccusage": "20.0.4", | ||
| "chrome-devtools-axi": "0.1.23", | ||
| "chrome-devtools-mcp": "1.0.1", | ||
| "clawdhub": "0.3.0", | ||
| "cline": "3.0.13", | ||
| "deepsec": "2.0.10", | ||
| "droid": "0.132.1", | ||
| "get-shit-done-cc": "1.42.3", | ||
| "gh-axi": "0.1.19", | ||
| "mcp-remote": "0.1.38", | ||
| "mcporter": "0.11.3", | ||
| "obsidian-headless": "0.0.8", | ||
| "open-composer": "0.8.23", | ||
| "openclaw": "2026.5.22", | ||
| "oxfmt": "0.51.0", | ||
| "oxlint": "1.66.0", | ||
| "paperclipai": "2026.517.0", | ||
| "playwright-chromium": "1.60.0", | ||
| "portless": "0.13.0", | ||
| "ralph-tui": "0.12.0", | ||
| "takt": "0.42.0", | ||
| "tokscale": "2.1.3", | ||
| "turbo": "2.9.14", | ||
| "typescript": "6.0.3", | ||
| "vite": "8.0.14", | ||
| "vite-plus": "0.1.22", | ||
| "xcodebuildmcp": "2.5.2" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify package.json has exact versions in dependencies
echo "== Checking for exact dependency specs in package.json =="
jq -r '.dependencies | to_entries[] | "\(.key)=\(.value)"' package.json \
| awk -F= '
$2 !~ /^[0-9A-Za-z.+-]+$/ { print "non-exact or ranged:", $0; bad=1 }
END { if (!bad) print "all dependency specs appear exact/pinned" }
'
# Verify installer command does not include @<version>
echo
echo "== Inspecting npm globals installer install command =="
fd -a 'install-npm-globals.sh' \
| while read -r f; do
echo "-- $f"
rg -n 'bun add --global' "$f"
rg -n 'MISSING\+\=' "$f"
done
echo
echo "Expected confirmation:"
echo "1) package.json dependencies are pinned"
echo "2) installer uses dep name only (no `@version`), so pins are not enforced during global install"Repository: shunkakinoki/dotfiles
Length of output: 3283
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Locate the installer script and inspect how it builds `$dep`
f="$(fd -a 'install-npm-globals\.sh$' . | head -n 1 || true)"
if [[ -z "${f}" ]]; then
echo "install-npm-globals.sh not found"
exit 1
fi
echo "== Found: $f =="
echo
echo "== Line count =="
wc -l "$f"
echo
echo "== Relevant section (where dep/wanted_ver are built) =="
# Print the whole file if it's small enough; otherwise print a window around the bun add line.
bun_line="$(rg -n 'bun add --global "\$dep"' "$f" | head -n1 | cut -d: -f1 || true)"
if [[ -z "${bun_line}" ]]; then
echo "Could not find bun add line; dumping first 220 lines:"
nl -ba "$f" | sed -n '1,220p'
else
start=$((bun_line-80))
end=$((bun_line+20))
nl -ba "$f" | sed -n "${start},${end}p"
fi
echo
echo "== Grep for key variables =="
rg -n 'wanted_ver|dep=' "$f" || trueRepository: shunkakinoki/dotfiles
Length of output: 369
🏁 Script executed:
#!/bin/bash
set -euo pipefail
f="$(fd -a 'install-npm-globals\.sh$' . | head -n 1 || true)"
if [[ -z "${f}" ]]; then
echo "install-npm-globals.sh not found"
exit 1
fi
echo "== Found: $f =="
echo
echo "== Line count =="
wc -l "$f"
echo
echo "== Grep for key variables =="
rg -n 'wanted_ver|dep=' "$f" || true
echo
echo "== Grep for bun add line =="
bun_line="$(rg -n 'bun add --global "\$dep"' "$f" | head -n1 || true)"
echo "$bun_line"
line_no="$(echo "$bun_line" | cut -d: -f1)"
if [[ -z "${line_no}" || ! "${line_no}" =~ ^[0-9]+$ ]]; then
echo "Could not parse bun add line; dumping first 220 lines:"
cat -n "$f" | sed -n '1,220p'
else
start=$((line_no-80))
end=$((line_no+25))
echo
echo "== Context around line $line_no (lines $start-$end) =="
cat -n "$f" | sed -n "${start},${end}p"
fi
echo
echo "== Raw excerpt: any line mentioning wanted_ver or dep in the 120-190 range =="
cat -n "$f" | sed -n '120,199p' | rg -n 'wanted_ver|dep=' || trueRepository: shunkakinoki/dotfiles
Length of output: 5882
Pinned dependency versions aren’t enforced during Bun global install
package.json lines 14-77 use caret/range specs (e.g. ^2.1.150), and the installer logic in home-manager/modules/npm-globals/install-npm-globals.sh extracts dep/wanted for comparison but installs/updates via bun add --global "$dep" (no @${wanted}), so the resolved global version can drift instead of matching the intended pinned/reproducible version(s).
- Install should include the version spec from
package.json(e.g.bun add --global "${dep}@${wanted}") and/or updatepackage.jsonto exact versions (no^) to make reproducibility real.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` around lines 14 - 77, The installer is not passing the desired
version when installing globals, so Bun can resolve a newer drifted version;
update home-manager/modules/npm-globals/install-npm-globals.sh to use the
extracted version spec when calling bun (use bun add --global "${dep}@${wanted}"
or equivalent) and ensure the script still correctly extracts the wanted
variable from package.json (the dep and wanted variables referenced in the
diff); alternatively, if you prefer strict reproducibility, change package.json
entries to exact versions (remove caret ranges) and keep the installer call
as-is.
1 participant
Summary by cubic
Updates dependencies across JS/Bun, Rust, and Python. Restores caret ranges, regenerates lockfiles, and defaults Bun to caret installs.
Dependencies
package.json; exact versions are locked inbun.lock.config/bun/bunfig.toml:exact = false).@upstash/context7-mcp@3.0.0,chrome-devtools-mcp@1.0.1,ccusage@20.0.4,@kaitranntt/ccs@8.1.0.vite@8.0.14,@github/copilot@1.0.54,@openai/codex@0.133.0,oxlint@1.66.0,oxfmt@0.51.0.worktrunk0.50.0->0.53.0; refreshedCargo.lock(adds transitiverenamore).nvitopmin version>=1.7.0inpyproject.toml.Migration
bun installafter pulling.cargo buildto fetch updated crates.uv syncif you manage the toolchain.Written for commit bac8d1b. Summary will update on new commits. Review in cubic