chore(deps-dev): pi 1.0.2 + 4 patch bumps; make package-lock.json the only lockfile
Supersedes #36.
What
- Dev dependency bumps (the same 5 as #36):
@earendil-works/pi-coding-agentand@earendil-works/pi-tui0.87.1 -> 1.0.2,@biomejs/biome2.5.15,@types/node26.6.4,vitest5.0.3. - Test fake: 7 no-op stubs in
test/helpers/fake-pi.tsfor the members pi 1.0 added toExtensionAPI. - Root-cause fix:
package-lock.jsonbecomes the only lockfile.bun.lockis removed and gitignored; docs, CI and Dependabot config carry a note explaining the rule.
Why #36 failed: two separate causes
1. Stale bun.lock (this is what failed CI)
All 3 failed test jobs on #36 died in "Install dependencies", before any test ran:
bun install --frozen-lockfile
error: lockfile had changes, but lockfile is frozen
Dependabot's npm ecosystem updated package.json and package-lock.json but not bun.lock. The npm-consumer job passed because it installs with npm ci.
This recurs on every grouped bump: #35 needed a hand-pushed "update bun.lock" commit as well.
2. pi 1.0 grew ExtensionAPI (tests only)
With bun.lock regenerated, bun run check failed with tsgo TS2740 at test/helpers/fake-pi.ts:183 and :270. pi 1.0 added 7 required members to ExtensionAPI. I compared the 0.87.1 and 1.0.2 types.d.ts; nothing was removed or renamed.
| Members | Introduced in pi |
|---|---|
registerVirtualModel, unregisterVirtualModel | 540e174 ("Virtual models", #10035) |
registerMcpServer, unregisterMcpServer, getMcpServers | 8562bcf ("codemode and MCP") |
registerToolRenderer | 1144973 |
getSettings | upstream commit not identified |
src/ compiles unchanged. The fake gets no-op stubs.
Why not pi 1.0.4: it also makes hiddenTools required in the system-prompt options type, which breaks fake-pi.ts:17. That is a separate change, left for the next bump.
Why one lockfile, and why package-lock.json
package-lock.jsonhas real consumers. Extension hosts install pi extensions from git withnpm install(README, CONTRIBUTING), and thenpm-consumerjob runsnpm ci. Dependabot'snpmecosystem already maintains it.- Two lockfiles always drift. No single tool updates both. Dependabot's
bunecosystem would only move the drift topackage-lock.json, and running both ecosystems would open two PRs per bump, each failing the other lockfile's check.
Measured with Bun 1.4.2 in a temp dir holding only package.json and package-lock.json:
-
In sync:
bun install --frozen-lockfileinstalls frompackage-lock.jsonwith exit 0 (165 packages). Compared with the lock entries, every installed version matches. The only difference is hoisting, i.e. which copy sits at the top level. For example, the lock hasretry0.13.1 at the root and 0.12.0 nested underproper-lockfile, while Bun hoists 0.12.0 and nests 0.13.1 underp-retry: same versions, same dependents. -
Out of date, the gate still holds:
package.jsonasking forvitest5.0.2 while the lock has 5.0.3:error: lockfile had changes, but lockfile is frozen, exit 1.- a dependency added to
package.jsonbut not to the lock: the same error, exit 1.
So
--frozen-lockfileenforcespackage-lock.json, and thenpm-consumerjob'snpm cienforces it independently.
Verification (local, Bun 1.4.2, Node 26)
All checks ran in a clean checkout of this branch: no node_modules and no bun.lock.
| Command | Result |
|---|---|
bun install --frozen-lockfile | exit 0, reads package-lock.json; the generated bun.lock is ignored (git check-ignore) |
bun run check (tsgo + biome) | clean |
bun run test | 281/281 |
bun run test:integration | 47/47 |
npm ci && npm test (the npm-consumer steps) | 281/281 |
npm pack --dry-run | 24 files |
Summary by cubic
Bumps dev dependencies (pi 1.0.2, biome 2.5.15, @types/node 26.6.4, vitest 5.0.3) and makes package-lock.json the only lockfile so CI no longer fails on a stale bun.lock. pi 1.0 adds seven required ExtensionAPI members, so the test fake gets no-op stubs for them.
Lockfile
- Dependabot's npm updates only touch
package-lock.json; the oldbun.lockdrifted and brokebun install --frozen-lockfile. - Bun 1.4.2 installs from
package-lock.json, and--frozen-lockfilestill detects out-of-date locks, so the single lockfile keeps both ecosystems verified. bun.lockis removed and gitignored; docs, CI comments, and Dependabot config now note the rule.