From 189dc058119ee6d1284d977d89b2d507675da310 Mon Sep 17 00:00:00 2001 From: enricobuehler Date: Thu, 13 Aug 2026 09:26:06 +0200 Subject: [PATCH] fix(deps): the lockfile still recorded the caret pin 0.1.1 removed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 0.1.1 pinned effect exactly — `4.0.0-beta.102`, no caret — because a caret range on a fast-moving prerelease is what crash-looped this plugin and rom-manager: `^4.0.0-beta.99` resolved beta.106, which had dropped `Schema.TaggedErrorClass`, and the module threw at import before any plugin code ran. bun.lock never caught up. Its `plugin` workspace entry still recorded `"effect": "^4.0.0-beta.102"` and `"version": "0.1.0"`, so the file that `--frozen-lockfile` trusts still described the shape the fix removed, one release after it landed. Nothing was resolving wrongly. The lock's resolution entry pins effect@4.0.0-beta.102, verified in a clean clone — the only effect anywhere in the installed tree is beta.102 — and the published 0.1.1 tarball carries the exact pin, so no user is exposed. `bun install --frozen-lockfile` also passes against the stale file today: bun tolerates workspace-metadata drift rather than failing on it, which is precisely why this sat unnoticed. What it costs is the record. The lockfile is the artifact CI reproduces from and the first thing anyone reads to ask "is the caret hazard still here?" — and it answered yes. Regenerating changes exactly these two lines and no resolution at all, so the install graph is bit-identical before and after. No version bump: bun.lock is not published (the plugin ships `files: ["dist"]`, and the lock is at the workspace root), so 0.1.1 on the registry is unaffected and needs no re-release. --- bun.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bun.lock b/bun.lock index 8d23d1a..c01c768 100644 --- a/bun.lock +++ b/bun.lock @@ -24,14 +24,14 @@ }, "plugin": { "name": "@punktfunk/plugin-virtualhere", - "version": "0.1.0", + "version": "0.1.1", "bin": { "punktfunk-plugin-virtualhere": "./dist/cli.js", }, "dependencies": { "@punktfunk/host": "^0.1.2", "@punktfunk/plugin-kit": "^0.2.0", - "effect": "^4.0.0-beta.102", + "effect": "4.0.0-beta.102", }, "devDependencies": { "@types/bun": "^1.3.0", -- 2.54.0