Commit c9127b1
authored
fix: restore bun as the only package manager (#153)
e10e7c8 ("landing page bump") ran yarn in the repo root alongside its
intended change, which committed a 5959-line yarn.lock and stamped
`packageManager: yarn@1.22.22` into package.json. Nothing in the repo
uses yarn: CI installs with `bun install --frozen-lockfile`, the tracked
lockfile is bun.lock, and that field was the only reference to yarn
anywhere outside the stray lockfile itself.
Beyond the two lockfiles drifting apart on their own, this broke
Dependabot. Declaring yarn meant it could not resolve bun.lock, so every
bun PR edited package.json without regenerating the lockfile and died at
install in eight seconds with "lockfile had changes, but lockfile is
frozen". The same missing resolution disabled the semver-major ignore:
dependabot-core's `update_type_for_dependency` returns nil unless both
`previous_version` and `version` are present, and without a resolved
lockfile version there is nothing to classify, so
`version-update:semver-major` matched nothing. That is why six majors
came through the bun entry while all 38 Cargo PRs, which resolve against
Cargo.lock normally, classified correctly and leaked none.
Removes the field rather than setting `bun@1.3.14`, restoring the state
that worked before e10e7c8 instead of introducing an unverified value.
`@testing-library/dom`, the legitimate part of e10e7c8, is untouched.1 parent 816d831 commit c9127b1
2 files changed
Lines changed: 1 addition & 5961 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
135 | 135 | | |
136 | 136 | | |
137 | 137 | | |
138 | | - | |
139 | | - | |
| 138 | + | |
140 | 139 | | |
0 commit comments