Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Help dependabot team to support bun #7295

Closed
DamienCassou opened this issue Nov 24, 2023 · 9 comments
Closed

Help dependabot team to support bun #7295

DamienCassou opened this issue Nov 24, 2023 · 9 comments
Labels
bun install Something that relates to the npm-compatible client enhancement New feature or request

Comments

@DamienCassou
Copy link

What is the problem this feature would solve?

Many projects use github's dependabot to maintain dependencies up-to-date. It looks like the dependabot team doesn't have enough resources to introduce more package managers or eco-systems: dependabot/dependabot-core#6528 (comment).

What is the feature you are proposing to solve the problem?

If the Bun development team has some resources, it would make sense for the Bun community to get dependabot to support Bun.

What alternatives have you considered?

  • not switching to Bun
  • replace dependabot with renovate
  • keep a yarn.lock around so dependabot can open update PRs and make sure to keep the Bun lock file in sync
@DamienCassou DamienCassou added the enhancement New feature or request label Nov 24, 2023
@lundjrl

This comment has been minimized.

Sign in to view
@Eveeifyeve

This comment has been minimized.

Sign in to view
@markhallen
Copy link

markhallen commented Jan 24, 2025 •
edited by RiskyMH
Loading

Hi from dependabot 👋

We now have a basic flow working with bun 1.1.39 and a bun.lock file: dependabot/dependabot-core#6528 (comment)

I am continuing to work on this and will be focussed on it next week too. The next things I want to do are:

  1. Add support for bun.lockb
  2. Add support for multiple version of bun.
    • Other js ecosystems in dependabot used corepack, but this is not possible for bun.
  3. Move bun into it's own dependabot ecosystem and out of npm.
    • Think - package-ecosystem: "bun"

Any feedback on the current form or suggestions are appreciated.

Right now I need to investigate the best approaches for points 1 and 2 above so any links or suggestions would be happily received.

Thanks

@RiskyMH RiskyMH added the bun install Something that relates to the npm-compatible client label Jan 24, 2025
@markhallen
Copy link

I have some questions about backwards and forwards compatibility of bun versions in comparison to the version the lockfile was generated against.

I see that I can install different versions of bun as follows:

curl -fsSL https://bun.sh/install | bash -s -- bun-v1.1.38

However, I have some questions:

  • What are the restrictions here regarding the current bun version vs the bun version that the was lockfile generated against?
  • Should we always use the latest version of bun?
  • How can we know what version of a bun a lock file was generated with? Does it even matter?
  • Are old versions forward compatible?
  • Are new versions backwards compatible?

Thanks

@dylan-conway
Copy link
Member

@markhallen Thanks for working on bun dependabot support! Some answers:

What are the restrictions here regarding the current bun version vs the bun version that the was lockfile generated against?

  • Versions earlier than v1.1.39 will not be able to read bun.lock.
  • Bun v1.1.39-v1.1.45 will not be able to read bun.lock with "lockfileVersion" > 0.

These are the only restrictions, other than missing out on bug fixes from recent versions.

Should we always use the latest version of bun?

Yes, generally latest bun is best bun.

How can we know what version of a bun a lock file was generated with? Does it even matter?

There isn't a way to know. We don't serialize bun version to the lockfile, but it shouldn't matter which is used unless you have a text lockfile and you're using a version before v1.1.39. I also think it's important to use a version >= v1.1.0 for binary lockfiles because earlier versions had bugs causing "peerDependency" resolutions to save incorrectly. Migrating to a text lockfile with this bug will produce an invalid lockfile. See #15858 (comment)

Are old versions forward compatible?

Older versions of bun are forward compatible with all versions of bun.lockb. The same applies for bun.lock with the exception of versions v1.1.39-v1.1.45 and "lockfileVersion" > 0. This exception was an oversight, it should be to read from the newer version. We don't plan on changing the version of bun.lock from 1.

Are new versions backwards compatible?

New versions of bun are backwards compatible with all versions of bun.lockb and bun.lock.

Let me know if you have more questions, happy to help

Eveeifyeve added a commit to Eveeifyeve/nixpkgs that referenced this issue Jan 25, 2025
@Eveeifyeve
bun: init configHook and fetchDeps; bun 1.1.43 -> 1.2.0; bun: switch …
30e4175 
…to finalAttrs from rec

bun: switch to finalAttrs from rec

Could speed up hydra?

bun: added hook tests and improve passthru for hooks

Co-authored-by: Winter <[email protected]>

fixup: bun: cleaned up bun hook; bun: fix arguments; bun: remove lockfile version specifier; bun: moved fetch-dir hooks to hooks dir; bun: fix test to include unzip in nativebuildinputs for benDeps

Lockfile version is lock unless for bugfixes read here for context:
oven-sh/bun#7295 (comment)

bun: add build test subdir to bundeps
@markhallen
Copy link

markhallen commented Jan 25, 2025 •
edited
Loading

Thanks for the comprehensive response @dylan-conway. That is really helpful.

I would love your thoughts on the following assumptions too please:

  1. bun.lockb is being deprecated, we shouldn't add support for it.
  2. We can now allow lockfileVersion = 1, contrary to the comment here from @glensc.

Thank you.

@markhallen
Copy link

Thanks you all your assistance to support Bun in Dependabot 🙌

Here is the GA announcement: https://github.blog/changelog/2025-02-13-dependabot-version-updates-now-support-the-bun-package-manager-ga/

I have one final ask: do you have an SVG logo? We want to add it so that it appears correctly in the dependabot UI.

Here we will add the logo and correctly label it Bun.

Image

Here is the bundler version.

Image

@dylan-conway
Copy link
Member

@markhallen I think this one will work well https://github.com/oven-sh/bun/blob/main/src/logo.svg

Eveeifyeve added a commit to Eveeifyeve/nixpkgs that referenced this issue Feb 24, 2025
@Eveeifyeve @getchoo
bun: init configHook and fetchDeps; bun: switch to finalAttrs from rec
c136977 
bun: switch to finalAttrs from rec

Could speed up hydra?

bun: added hook tests and improve passthru for hooks

Co-authored-by: Winter <[email protected]>

fixup: bun: cleaned up bun hook; bun: fix arguments; bun: remove
lockfile version specifier; bun: moved fetch-dir hooks to hooks dir;
bun: fix test to include unzip in nativebuildinputs for benDeps

Lockfile version is lock unless for bugfixes read here for context:
oven-sh/bun#7295 (comment)

bun: add build test subdir to bundeps

Apply suggestions from code review

Co-authored-by: Seth Flynn <[email protected]>
Eveeifyeve added a commit to Eveeifyeve/nixpkgs that referenced this issue Feb 24, 2025
@Eveeifyeve @getchoo
bun: init configHook and fetchDeps; bun: switch to finalAttrs from rec
c3cb239 
bun: switch to finalAttrs from rec

Could speed up hydra?

bun: added hook tests and improve passthru for hooks

Co-authored-by: Winter <[email protected]>

fixup: bun: cleaned up bun hook; bun: fix arguments; bun: remove
lockfile version specifier; bun: moved fetch-dir hooks to hooks dir;
bun: fix test to include unzip in nativebuildinputs for benDeps

Lockfile version is lock unless for bugfixes read here for context:
oven-sh/bun#7295 (comment)

bun: add build test subdir to bundeps

Apply suggestions from code review

Co-authored-by: Seth Flynn <[email protected]>
Eveeifyeve added a commit to Eveeifyeve/nixpkgs that referenced this issue Feb 24, 2025
@Eveeifyeve @getchoo
bun: init configHook and fetchDeps; bun: switch to finalAttrs from rec
5cabdaf 
bun: switch to finalAttrs from rec

Could speed up hydra?

bun: added hook tests and improve passthru for hooks

Co-authored-by: Winter <[email protected]>

fixup: bun: cleaned up bun hook; bun: fix arguments; bun: remove
lockfile version specifier; bun: moved fetch-dir hooks to hooks dir;
bun: fix test to include unzip in nativebuildinputs for benDeps

Lockfile version is lock unless for bugfixes read here for context:
oven-sh/bun#7295 (comment)

bun: add build test subdir to bundeps

Apply suggestions from code review

Co-authored-by: Seth Flynn <[email protected]>
Eveeifyeve added a commit to Eveeifyeve/nixpkgs that referenced this issue Feb 24, 2025
@Eveeifyeve @getchoo
bun: init configHook and fetchDeps; bun: switch to finalAttrs from rec
5308102 
bun: switch to finalAttrs from rec

Could speed up hydra?

bun: added hook tests and improve passthru for hooks

Co-authored-by: Winter <[email protected]>

fixup: bun: cleaned up bun hook; bun: fix arguments; bun: remove
lockfile version specifier; bun: moved fetch-dir hooks to hooks dir;
bun: fix test to include unzip in nativebuildinputs for benDeps

Lockfile version is lock unless for bugfixes read here for context:
oven-sh/bun#7295 (comment)

bun: add build test subdir to bundeps

Apply suggestions from code review

Co-authored-by: Seth Flynn <[email protected]>
@dylan-conway
Copy link
Member

Closing this issue as complete now that dependabot support for Bun is GA. Big thanks @markhallen and everyone else who helped work towards this!

If any issues come up please reopen this issue or open a new one.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bun install Something that relates to the npm-compatible client enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@DamienCassou @markhallen @dylan-conway @lundjrl @RiskyMH @Eveeifyeve