From 232ef3c983b7b2aad14783fca606ec68ffa2a1c3 Mon Sep 17 00:00:00 2001 From: Tony Giorgio Date: Wed, 20 May 2026 11:26:40 -0500 Subject: [PATCH 1/2] Harden Bun dependency installs --- .github/workflows/android-build.yml | 4 ++-- .github/workflows/claude.yml | 5 ++--- .github/workflows/desktop-build.yml | 4 ++-- .github/workflows/frontend-tests.yml | 4 ++-- .github/workflows/mobile-build.yml | 2 +- .github/workflows/release.yml | 6 +++--- .github/workflows/testflight-on-comment.yml | 2 +- frontend/bunfig.toml | 6 +++++- frontend/package.json | 3 ++- 9 files changed, 20 insertions(+), 16 deletions(-) diff --git a/.github/workflows/android-build.yml b/.github/workflows/android-build.yml index 4b16c5a61..2dbe758d3 100644 --- a/.github/workflows/android-build.yml +++ b/.github/workflows/android-build.yml @@ -35,7 +35,7 @@ jobs: path: | ~/.bun/install/cache frontend/node_modules - key: ${{ runner.os }}-bun-${{ hashFiles('frontend/bun.lockb') }} + key: ${{ runner.os }}-bun-${{ hashFiles('frontend/bun.lock') }} restore-keys: | ${{ runner.os }}-bun- @@ -96,7 +96,7 @@ jobs: - name: Install frontend dependencies working-directory: ./frontend - run: bun install + run: bun install --frozen-lockfile --ignore-scripts - name: Install Tauri CLI run: | diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 229eda5d1..50f855f3f 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -61,7 +61,7 @@ jobs: path: | ~/.bun/install/cache frontend/node_modules - key: ${{ runner.os }}-bun-${{ hashFiles('frontend/bun.lockb') }} + key: ${{ runner.os }}-bun-${{ hashFiles('frontend/bun.lock') }} restore-keys: | ${{ runner.os }}-bun- @@ -99,7 +99,7 @@ jobs: - name: Install frontend dependencies working-directory: ./frontend - run: bun install + run: bun install --frozen-lockfile --ignore-scripts - name: Cache Cargo bin (Tauri CLI) uses: actions/cache@v4 @@ -136,4 +136,3 @@ jobs: --allowedTools "Bash,Edit,Replace,NotebookEditCell,MultiEdit,Write,Read,Grep,Glob,LS,WebSearch,WebFetch,Task,TodoWrite,BashOutput,KillBash" --max-turns 100 --model claude-sonnet-4-5-20250929 - diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml index 4e98b7095..198aa42fe 100644 --- a/.github/workflows/desktop-build.yml +++ b/.github/workflows/desktop-build.yml @@ -56,7 +56,7 @@ jobs: - name: Install frontend dependencies working-directory: ./frontend - run: bun install + run: bun install --frozen-lockfile --ignore-scripts - name: Configure sccache run: | @@ -173,7 +173,7 @@ jobs: - name: Install frontend dependencies working-directory: ./frontend - run: bun install + run: bun install --frozen-lockfile --ignore-scripts - name: Install Tauri CLI run: | diff --git a/.github/workflows/frontend-tests.yml b/.github/workflows/frontend-tests.yml index e1e3a6804..1a61ab7a6 100644 --- a/.github/workflows/frontend-tests.yml +++ b/.github/workflows/frontend-tests.yml @@ -26,13 +26,13 @@ jobs: path: | ~/.bun/install/cache frontend/node_modules - key: ${{ runner.os }}-bun-${{ hashFiles('frontend/bun.lockb') }} + key: ${{ runner.os }}-bun-${{ hashFiles('frontend/bun.lock') }} restore-keys: | ${{ runner.os }}-bun- - name: Install dependencies working-directory: ./frontend - run: bun install + run: bun install --frozen-lockfile --ignore-scripts - name: Format check working-directory: ./frontend diff --git a/.github/workflows/mobile-build.yml b/.github/workflows/mobile-build.yml index b12602864..2c46b8b1f 100644 --- a/.github/workflows/mobile-build.yml +++ b/.github/workflows/mobile-build.yml @@ -54,7 +54,7 @@ jobs: - name: Install frontend dependencies working-directory: ./frontend - run: bun install + run: bun install --frozen-lockfile --ignore-scripts - name: Cache ONNX Runtime iOS build uses: actions/cache@v4 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1e700fb0d..18ccd38e7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -104,7 +104,7 @@ jobs: - name: Install frontend dependencies working-directory: ./frontend - run: bun install + run: bun install --frozen-lockfile --ignore-scripts - name: Configure sccache run: | @@ -165,7 +165,7 @@ jobs: path: | ~/.bun/install/cache frontend/node_modules - key: ${{ runner.os }}-bun-${{ hashFiles('frontend/bun.lockb') }} + key: ${{ runner.os }}-bun-${{ hashFiles('frontend/bun.lock') }} restore-keys: | ${{ runner.os }}-bun- @@ -226,7 +226,7 @@ jobs: - name: Install frontend dependencies working-directory: ./frontend - run: bun install + run: bun install --frozen-lockfile --ignore-scripts - name: Install Tauri CLI run: | diff --git a/.github/workflows/testflight-on-comment.yml b/.github/workflows/testflight-on-comment.yml index e2123d862..dac9f39fa 100644 --- a/.github/workflows/testflight-on-comment.yml +++ b/.github/workflows/testflight-on-comment.yml @@ -109,7 +109,7 @@ jobs: - name: Install frontend dependencies working-directory: ./frontend - run: bun install + run: bun install --frozen-lockfile --ignore-scripts - name: Cache ONNX Runtime iOS build uses: actions/cache@v4 diff --git a/frontend/bunfig.toml b/frontend/bunfig.toml index dda14d101..bcedeee40 100644 --- a/frontend/bunfig.toml +++ b/frontend/bunfig.toml @@ -1,3 +1,7 @@ +[install] +frozenLockfile = true +minimumReleaseAge = 604800 + [test] preload = ["src/lib/test/preload.ts", "src/lib/test/der-loader.ts"] -root = "./src" \ No newline at end of file +root = "./src" diff --git a/frontend/package.json b/frontend/package.json index 217bb59ff..24901489c 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -3,6 +3,7 @@ "private": true, "version": "3.0.1", "type": "module", + "trustedDependencies": [], "scripts": { "dev": "vite", "build": "tsc -b && vite build", @@ -12,7 +13,7 @@ "test": "bun test", "test:coverage": "bun test --coverage", "preview": "vite preview", - "add": "bunx shadcn-ui@latest add", + "add": "echo \"Disabled: use a reviewed, pinned shadcn CLI version explicitly\" && exit 1", "format": "prettier --write \"src/**/*.{ts,tsx,js,jsx,json,css,md}\"", "format:check": "prettier --check \"src/**/*.{ts,tsx,js,jsx,json,css,md}\"" }, From b44cb636cae30220bddce4e1f3adc6610c2bd3bb Mon Sep 17 00:00:00 2001 From: Tony Giorgio Date: Wed, 20 May 2026 11:30:18 -0500 Subject: [PATCH 2/2] Pin Bun to 1.3.5 in CI --- .github/workflows/android-build.yml | 2 +- .github/workflows/claude.yml | 2 +- .github/workflows/desktop-build.yml | 4 ++-- .github/workflows/frontend-tests.yml | 2 +- .github/workflows/mobile-build.yml | 2 +- .github/workflows/release.yml | 6 +++--- .github/workflows/testflight-on-comment.yml | 2 +- CLAUDE.md | 2 +- frontend/package.json | 1 + 9 files changed, 12 insertions(+), 11 deletions(-) diff --git a/.github/workflows/android-build.yml b/.github/workflows/android-build.yml index 2dbe758d3..209682db7 100644 --- a/.github/workflows/android-build.yml +++ b/.github/workflows/android-build.yml @@ -27,7 +27,7 @@ jobs: - name: Setup Bun uses: oven-sh/setup-bun@v1 with: - bun-version: 1.2.2 + bun-version: 1.3.5 - name: Cache Bun dependencies uses: actions/cache@v4 diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 50f855f3f..dba810115 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -53,7 +53,7 @@ jobs: - name: Setup Bun uses: oven-sh/setup-bun@v2 with: - bun-version: 1.2.2 + bun-version: 1.3.5 - name: Cache Bun dependencies uses: actions/cache@v4 diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml index 198aa42fe..2a5001f51 100644 --- a/.github/workflows/desktop-build.yml +++ b/.github/workflows/desktop-build.yml @@ -21,7 +21,7 @@ jobs: - name: Setup Bun uses: oven-sh/setup-bun@v1 with: - bun-version: 1.2.2 + bun-version: 1.3.5 - name: Install Rust uses: dtolnay/rust-toolchain@stable @@ -126,7 +126,7 @@ jobs: - name: Setup Bun uses: oven-sh/setup-bun@v1 with: - bun-version: 1.2.2 + bun-version: 1.3.5 - name: Install Rust uses: dtolnay/rust-toolchain@stable diff --git a/.github/workflows/frontend-tests.yml b/.github/workflows/frontend-tests.yml index 1a61ab7a6..f255d4c24 100644 --- a/.github/workflows/frontend-tests.yml +++ b/.github/workflows/frontend-tests.yml @@ -18,7 +18,7 @@ jobs: - name: Setup Bun uses: oven-sh/setup-bun@v1 with: - bun-version: 1.2.2 + bun-version: 1.3.5 - name: Cache Bun dependencies uses: actions/cache@v4 diff --git a/.github/workflows/mobile-build.yml b/.github/workflows/mobile-build.yml index 2c46b8b1f..5a4a3b661 100644 --- a/.github/workflows/mobile-build.yml +++ b/.github/workflows/mobile-build.yml @@ -18,7 +18,7 @@ jobs: - name: Setup Bun uses: oven-sh/setup-bun@v1 with: - bun-version: 1.2.2 + bun-version: 1.3.5 - name: Install Rust uses: dtolnay/rust-toolchain@stable diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 18ccd38e7..a4528e8a8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -18,7 +18,7 @@ jobs: - name: Setup Bun uses: oven-sh/setup-bun@v1 with: - bun-version: 1.2.2 + bun-version: 1.3.5 - name: Get version id: get_version @@ -42,7 +42,7 @@ jobs: - name: Setup Bun uses: oven-sh/setup-bun@v1 with: - bun-version: 1.2.2 + bun-version: 1.3.5 - name: Install Rust uses: dtolnay/rust-toolchain@stable @@ -157,7 +157,7 @@ jobs: - name: Setup Bun uses: oven-sh/setup-bun@v1 with: - bun-version: 1.2.2 + bun-version: 1.3.5 - name: Cache Bun dependencies uses: actions/cache@v4 diff --git a/.github/workflows/testflight-on-comment.yml b/.github/workflows/testflight-on-comment.yml index dac9f39fa..f878fe4c0 100644 --- a/.github/workflows/testflight-on-comment.yml +++ b/.github/workflows/testflight-on-comment.yml @@ -73,7 +73,7 @@ jobs: - name: Setup Bun uses: oven-sh/setup-bun@v1 with: - bun-version: 1.2.2 + bun-version: 1.3.5 - name: Install Rust uses: dtolnay/rust-toolchain@stable diff --git a/CLAUDE.md b/CLAUDE.md index ce11e2273..6304af68e 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -27,7 +27,7 @@ Maple is a **Tauri-based AI chat application** that runs on desktop (macOS, Linu - **Frontend**: TypeScript + React (Vite), Tailwind CSS, shadcn/ui components - **Backend**: Rust (Tauri 2.x) with proxy and PDF extraction features - **Auth**: OpenSecret (`@opensecret/react`) -- **Package Manager**: Bun (v1.2.2+) +- **Package Manager**: Bun (v1.3.5) ## Environment The user typically runs `nix develop` (using `flake.nix`) before starting Claude. This means you're usually in a Nix shell with all required tools (bun, cargo, rustc, etc.) already available. diff --git a/frontend/package.json b/frontend/package.json index 24901489c..bef8cd956 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -3,6 +3,7 @@ "private": true, "version": "3.0.1", "type": "module", + "packageManager": "bun@1.3.5", "trustedDependencies": [], "scripts": { "dev": "vite",