Skip to content

Commit c9127b1

Browse files
authored
fix: restore bun as the only package manager (#153)
e10e7c8 ("landing page bump") ran yarn in the repo root alongside its intended change, which committed a 5959-line yarn.lock and stamped `packageManager: yarn@1.22.22` into package.json. Nothing in the repo uses yarn: CI installs with `bun install --frozen-lockfile`, the tracked lockfile is bun.lock, and that field was the only reference to yarn anywhere outside the stray lockfile itself. Beyond the two lockfiles drifting apart on their own, this broke Dependabot. Declaring yarn meant it could not resolve bun.lock, so every bun PR edited package.json without regenerating the lockfile and died at install in eight seconds with "lockfile had changes, but lockfile is frozen". The same missing resolution disabled the semver-major ignore: dependabot-core's `update_type_for_dependency` returns nil unless both `previous_version` and `version` are present, and without a resolved lockfile version there is nothing to classify, so `version-update:semver-major` matched nothing. That is why six majors came through the bun entry while all 38 Cargo PRs, which resolve against Cargo.lock normally, classified correctly and leaked none. Removes the field rather than setting `bun@1.3.14`, restoring the state that worked before e10e7c8 instead of introducing an unverified value. `@testing-library/dom`, the legitimate part of e10e7c8, is untouched.
1 parent 816d831 commit c9127b1

2 files changed

Lines changed: 1 addition & 5961 deletions

File tree

package.json

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,5 @@
135135
"overrides": {
136136
"@codemirror/state": "^6.6.0",
137137
"@codemirror/view": "^6.43.0"
138-
},
139-
"packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
138+
}
140139
}

0 commit comments

Comments
 (0)