test(opencode): guard patched dependency versions - #46673
Merged
Conversation
The dependency moved to 0.9.4 in #31583 but the patch stayed keyed to 0.9.3, so bun has not applied it since; only 0.9.4 is in the lockfile. Remove the dead entry.
bun applies a patch only to the exact name@version in patchedDependencies. A bump without regenerating the patch does not fail install; the patch just stops applying. Assert that for packages/opencode and packages/core the installed version of every patched dependency matches its patch key.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Bun applies a
patchedDependenciespatch only to the exactname@versionin its key. If the dependency is bumped and the patch isn't regenerated,bun installdoes not fail; the patch silently stops applying and whatever it fixed is gone at runtime.This isn't hypothetical.
@ff-labs/fff-bunwas bumped to 0.9.4 in #31583 (June) while its patch stayed keyed to 0.9.3, so it has been a no-op since;bun.lockdoesn't even list it. #46653 nearly hit the same thing whendevbumped@ai-sdk/amazon-bedrockunder it, which is what prompted this.What
Remove the dead
fff-bun@0.9.3patch entry. No runtime change: 0.9.3 isn't installed anywhere.Add
test/patched-dependencies.test.ts. For every key in rootpatchedDependencies, assert the patch file exists and that the version resolved underpackages/opencode/node_modulesandpackages/core/node_modules(the packages that ship in the CLI) equals the key's version. One test per patch so the failure names the offender:Pure filesystem reads against
package.jsonfiles; no network, no timers, nothing to flake.Patches for transitive-only deps (
pacote,gcp-metadata,@npmcli/agent, …) aren't linked into those two workspaces and so are only checked for the patch file existing.