chore(deps): bun deps refresh 2026-05-15 - #69
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request primarily involves dependency updates and extensive formatting adjustments across configuration files, scripts, and tests. Key changes include updating devDependencies like @emnapi/core and typescript, and reformatting JSON/YAML structures. Feedback was provided regarding an unused variable, errorOutputs, introduced in wasi-worker-browser.mjs, which should be removed to maintain code cleanliness.
| const errorOutputs = [] | ||
|
|
||
| const handler = new MessageHandler({ |
There was a problem hiding this comment.
The variable errorOutputs is declared but never used within this file. This appears to be dead code or an incomplete implementation. If it is not required for future error tracking logic, it should be removed to maintain code clarity.
const handler = new MessageHandler({![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7fbd5d0223
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "tags": [ | ||
| "web" | ||
| ], | ||
| "tags": ["web"], |
There was a problem hiding this comment.
This checked-in SBOM was not regenerated after the dependency refresh: the Vite component that this changed line belongs to still has bom-ref/purl/version set to vite@8.0.8, while package.json and bun.lock now resolve Vite to 8.0.11. Consumers or provenance checks that rely on provenance/sbom.cdx.json will get a stale dependency inventory for this release unless the provenance artifacts are regenerated with the updated install.
Useful? React with 👍 / 👎.
67f4b73 to
23520a4
Compare
bun update pulled forward 11 packages within their existing semver ranges: @emnapi/core, @emnapi/runtime, @napi-rs/cli, @tybys/wasm-util, @types/node, bun-types, emnapi, fast-check, oxlint, tsdown, vite.
Includes the reformat oxfmt 0.48 applies to the tree (YAML, JSON, JS/TS, Markdown).
Build verified via bun run build:js. Also picks up regenerated napi-rs wasi worker stubs and adds them to oxlint ignore (they are generated artifacts).
tsc --noEmit, lint, tests, and build:js all green on TS 6.
Regenerates `provenance/sbom.cdx.json`, `THIRD-PARTY-NOTICES.txt`, and `report.json` to reflect the dependency versions resolved on this branch (notably vite 8.0.8 -> 8.0.11). The earlier commits left the SBOM pinned to the pre-bump Vite revision.
Mirrors the workaround already applied to release.yml, the napi-ci reusable, and provenance-nightly.yml: avoids the bun integrity-check failure on napi-rs platform sub-packages.
Picks up the cargo PATH fix from stella/.github#32.
1d6edce to
1dde02a
Compare
1 participant
Summary
Test plan
bun run lintbun run testbun run build:js