ci(audit): restore strict Bun advisory policy - #9773

Draft

BridgeAR wants to merge 95 commits into

BridgeAR/2026-05-09-remove-yarnfrom

BridgeAR/2026-08-11-strict-bun-audit

Commits on Aug 11, 2026

ci: move root install paths off yarn to bun
BridgeAR
committed
576bb0e
ci: replace yarn services chain with bun isolated install
BridgeAR
committed
7012e25
ci: drop yarn run from workflows and the license check
BridgeAR
committed
ff78048
ci(docs): build TypeDoc docs with bun
BridgeAR
committed
19590cc
chore: remove dead yarn machinery and guard the migration
BridgeAR
committed
e210e3b
fix(ci): skip lifecycle scripts in package-size-report bun install
BridgeAR
committed
cc9d4ef
fix(test): switch versions/ workspace to bun's hoisted linker
BridgeAR
committed
58177e4
fix(test): restore moleculer bluebird transitive
BridgeAR
committed
2105e17
fix(test): revert versions/ workspace to bun's isolated linker
BridgeAR
committed
c7b4031
fix(test): inject @grpc/grpc-js into pubsub sandboxes
BridgeAR
committed
ab11322
fix(langchain): pin @langchain/openai at the versions/ workspace root
BridgeAR
committed
1d1472a
fix(test): drop yarn references from new plugin-fix comments
BridgeAR
committed
31d77c1
fix(test): adapt versions/ sandboxes to bun isolated linker
BridgeAR
committed
1808849
ci(licenses): skip dd-license-attribution regen on bun.lock
BridgeAR
committed
c50d558
fix(test): rebuild versions/ native bindings on Node ABI change
BridgeAR
committed
f48a206
ci(licenses): drop yarn references from skip-comment
BridgeAR
committed
3e07ce0
fix(test): drop yarn from Node-ABI cache-bust comment
BridgeAR
committed
935d02f
fix(test): match yarn classic resolution under bun isolated linker
BridgeAR
committed
d6e3464
ci(bench): install bun for the GitLab microbenchmarks
BridgeAR
committed
834ed1e
chore(codeowners): own the install-smoke workflow
BridgeAR
committed
77c53e7
ci(licenses): regenerate the CSV from bun.lock and auto-commit via octo-sts
BridgeAR
committed
a212248
ci(install-smoke): push results to Test Optimization via dd-sts
BridgeAR
committed
71f14b6
fix(test): only prune ambiguous bun central symlinks
BridgeAR
committed
11129ee
fix(test): override collections to 5.x for q@2.0.0
BridgeAR
committed
eb5093a
fix(licenses): strip name fields without regex on untrusted input
BridgeAR
committed
59106b1
fix(test): inject google-auth-library into vertex-ai sandboxes
BridgeAR
committed
51ec958
ci(bench): install unzip before bun-curl on the GitLab runner
BridgeAR
committed
750a511
chore(codeowners): own the docs/ TypeDoc workspace
BridgeAR
committed
0ab8a44
fix(test): pin the langchain-openai floor for its core transitive
BridgeAR
committed
6b41f41
fix(test): inject zod into the ai sandbox
BridgeAR
committed
c859c2d
ci: fix workflow regressions surfaced by the yarn-to-bun rebase
BridgeAR
committed
e721e77
build(deps): regenerate bun.lock after the devDependency bumps
BridgeAR
committed
36abfd5
fix(test): scope sandbox dependencies for bun's isolated linker
BridgeAR
committed
47a7038
test(scripts): resolve bun via PATH lookup in the sandbox-install guard
BridgeAR
committed
3432aee
fix(test): pass --ignore-engines to yarn in sandbox specs
BridgeAR
committed
120467b
ci(platform): bound the consumer-install step with a retry
BridgeAR
committed
2e71a0a
test(iast): drop vestigial yarn re-install in sourcemap sandbox
BridgeAR
committed
32a4e8f
ci(install): commit versions/bunfig.toml so the isolated linker is structural
BridgeAR
committed
7ddc613
ci(datadog-ci): pin the action's npm install with a lockfile
BridgeAR
committed
7c017c6
chore(security): cool down npm installs and freeze the dev lockfile
BridgeAR
committed
41bde84
ci: finish yarn-to-bun rebase conflict cleanup
BridgeAR
committed
e2998aa
ci(install): fix remaining bun migration failures
BridgeAR
committed
85bae08
ci(install): handle legacy locks and incomplete registry metadata
BridgeAR
committed
139dd9a
ci(install): normalize legacy GitHub shorthand
BridgeAR
committed
41d8907
bench: preserve baseline package manager in comparisons
BridgeAR
committed
15cd7bd
build(deps): sync bun lock with master
BridgeAR
committed
81101ee
chore(codeowners): own versions bun config
BridgeAR
committed
7c2428f
build(docs): sync bun lock with master
BridgeAR
committed
14f92a9
ci(install): cache plugin sandbox metadata
BridgeAR
committed
29c3f9a
ci(install): close bun migration hardening gaps
BridgeAR
committed
44640da
chore(licenses): merge attribution across locked versions
BridgeAR
committed
e9acb5f
ci(install): tighten migration metadata checks
BridgeAR
committed
42aa8e1
ci(install): handle release-age races in sandboxes
BridgeAR
committed
fb6c050
test(install): cover plugin workspace failure paths
BridgeAR
committed
c96bcc2
ci(lint): stabilize Actions import classification
BridgeAR
committed
d211829
test(install): scope sandbox policy to each plugin
BridgeAR
committed
a2e9dc6
test(install): preserve highest bun workspace versions
BridgeAR
committed
aaa2bb9
test(knex): make sqlite build dependency direct
BridgeAR
committed
405ba98
ci(install): freeze all Bun-managed dependency trees
BridgeAR
committed
9f86000
fix(install): silence Bun prepare output
BridgeAR
committed
f1dfd3f
ci(install): harden Bun artifact packaging
BridgeAR
committed
5f13e3e
test(install): allow Yarn validation fixtures
BridgeAR
committed
8bd25f5
ci(install): bootstrap Bun inside source archives
BridgeAR
committed
56f3379
ci(coverage): isolate patched Bun dependencies
BridgeAR
committed
81440d4
test(install): cover Bun bootstrap branches
BridgeAR
committed
6c6610c
test(install): isolate Bun bootstrap PATH fixtures
BridgeAR
committed
56d1523
ci(dependencies): refresh vulnerable Bun lock entries
BridgeAR
committed
6e2140c
ci: assign vendor lockfile ownership
BridgeAR
committed
9224c7a
ci(dependencies): align Bun lock after rebase
BridgeAR
committed
a07c760
ci: fix Bun rebase integration gaps
BridgeAR
committed
8219451
ci(dependencies): patch brace-expansion and ignore its cross-major advisory
BridgeAR
committed
764f37a
test(install): declare the peer transitives the sandbox specs resolve
BridgeAR
committed
29571b4
test(llmobs): resolve the agents openai client from the loaded package
BridgeAR
committed
84958a0
ci(licenses): quote the GitHub output writes
BridgeAR
committed
d7bb136
ci(install): close Bun migration validation gaps
BridgeAR
committed
0ff7ea6
ci(install): resolve forced transitives from the consuming package's range
BridgeAR
committed
53f2373
fix(scripts): reject a non-JavaScript npm_execpath in the Bun bootstrap
BridgeAR
committed
62454af
fix(vendor): attribute every bundled package's license
BridgeAR
committed
6a2e835
fix(licenses): attribute the peers of production dependencies
BridgeAR
committed
145a942
ci(audit): fail on an accepted advisory that is no longer reported
BridgeAR
committed
865f210
docs(llmobs): name the services script the repo actually has
BridgeAR
committed
ad778e3
fix(licenses): keep copied-source attributions out of the dependency list
BridgeAR
committed
b8f1d11
fix(audit): fail on a severity the wrapper cannot rank
BridgeAR
committed
01c1845
ci(audit): run the audit when its own policy changes
BridgeAR
committed
c5324e3
ci(install): derive the CI Bun install from the pinned version
BridgeAR
committed
39e6055
test(langchain): drop an override Bun silently ignores
BridgeAR
committed
1837c29
ci(codeowners): own the whole .github tree and lint it
BridgeAR
committed
8b2eb5a
ci(bun): fix rebased migration regressions
BridgeAR
committed
535b14e
ci(bun): fix latest master integration
BridgeAR
committed
c641283
ci(bun): fix license and dependency audits
BridgeAR
committed
73ac49a
ci(bun): simplify migration follow-ups
BridgeAR
committed
5961dd4
ci(audit): restore scheduled Bun checks
BridgeAR
committed
661d1d2
test(plugins): remove obsolete Bun dependency workarounds (#9769)
BridgeAR
committed
64e83ee
ci(bun): prevent partial-state success
BridgeAR
committed
e109dd9
ci(audit): restore strict Bun advisory policy
BridgeAR
committed
a88fe65