fix(install): lifecycle script changes #8943
Conversation
|
❌ @dylan-conway 1 files with test failures on bun-darwin-aarch64: |
|
❌ @dylan-conway 1 files with test failures on linux-x64: |
|
❌ @dylan-conway 1 files with test failures on linux-x64-baseline: |
|
❌ @dylan-conway 2 files with test failures on bun-darwin-x64:
|
❌🪟 @dylan-conway, there are 12 test regressions on Windows x86_64
|
src/js_ast.zig
Outdated
| @@ -1458,6 +1458,23 @@ pub const E = struct { | |||
|
|
|||
| return array; | |||
| } | |||
|
|
|||
| /// debug.assert the array only contains strings before calling | |||
There was a problem hiding this comment.
can you make this an actual debug assert for this function. or uh, i see you do a runtime check for that... so is it an assertion or? i'd like osmething better than this comment
There was a problem hiding this comment.
Moved the debug assert inside this function. Also did the same for alphabetizeProperties. Originally I had the runtime check for extra safety
src/install/lockfile.zig
Outdated
| // 0 - package from old lockfile, needs update | ||
| // 1 - does not have install scripts | ||
| // 2 - has install scripts | ||
| __has_install_script: u8, |
There was a problem hiding this comment.
instead of a magic number, can this be an enum(u8). it would also be nice to add this into the comment on line 4709 when we bump the lockfile version, we should reorder this to:
also proper documentation comments are /// but that is less relevant.
|
|
||
| await rm(join(packageDir, "node_modules", "electron", "preinstall.txt"), { force: true }); | ||
|
|
||
| // lockfile should save evenn though there are no changes to trustedDependencies due to |
There was a problem hiding this comment.
| // lockfile should save evenn though there are no changes to trustedDependencies due to | |
| // lockfile should save even though there are no changes to trustedDependencies due to |
| else => return, | ||
| else => { | ||
| if (comptime Environment.allow_assert) { | ||
| @panic("bad"); |
Co-authored-by: Jarred Sumner <[email protected]>
What does this PR do?
Breaking change: if
trustedDependenciesexists in package.json, bun install will no longer pull from the default list and will only run scripts from thetrustedDependencieslist. If the list is empty, then no scripts will run. The default trusted dependencies list is only used whentrustedDependenciesdoes not exist in package.json.--trust. This flags tellsbun addto automatically trust the dependency and all it's dependencies, running their lifecycle scripts and adding totrustedDependenciesin package.json.warning for skipped lifecycle scripts
file:.path inpackage.jsondependencies #8899Also included in this pr is
bun pm trusted. This command without any args will print the current trusted and untrusted dependencies with scripts:If you provide package names, they will be added to
trustedDependenciesand their scripts will run. In the example above, runningbun pm trust es5-extwill add this to your package.json:You can also pass
--allto trust all available untrusted dependencies, and--defaultto list the default trusted dependencies list.The breaking changes in this pr will be disabled until
v1.1.0.How did you verify your code works?
new and existing tests