feat(turborepo-lockfiles): Update bun.lock support to match Bun's current implementation #10729

robobun · 2025-08-04T00:32:04Z

Description

Updates Turborepo's bun.lock parser to better align with Bun's current lockfile format implementation. This addresses version detection issues, adds support for new lockfile fields, and implements v1 optimizations.

Testing Instructions

# Unit tests
cargo test -p turborepo-lockfiles

# Specific Bun tests
cargo test -p turborepo-lockfiles bun

# Run with coverage (requires llvm-tools-preview)
cargo coverage

Test Results

✅ All 238 lockfile tests pass
✅ 72 Bun-specific tests (43 newly added)
✅ No regressions in existing functionality

Background

While investigating Turborepo's bun.lock support against Bun's implementation (src/install/lockfile/bun.lock.zig), I identified several gaps:

Critical: global_change() only detected package manager changes, not lockfile version changes
Missing features: Several fields were not parsed (catalogs, overrides, trusted dependencies)
Performance: V1 workspace optimizations were not implemented
Compatibility: Platform-specific constraints (os/cpu) were ignored

Changes

Core Fixes

Version Detection
- Added LockfileVersion enum for v0/v1 handling
- Fixed global_change() to detect version changes (prevents incorrect cache hits)
- Added bun_global_change() for API consistency with other package managers

New Field Support

pub struct BunLockfileData {
    lockfile_version: i32,
    workspaces: Map<String, WorkspaceEntry>,
    packages: Map<String, PackageEntry>,
    patched_dependencies: Map<String, String>,
    trusted_dependencies: Vec<String>,      // NEW
    overrides: Map<String, String>,         // NEW
    catalog: Map<String, String>,           // NEW
    catalogs: Map<String, Map<String, String>>, // NEW
}

Platform Constraints

pub enum Negatable {
    None,                    // No constraint
    Single(String),          // "darwin"
    Multiple(Vec<String>),   // ["x64", "arm64"]
    Not(Vec<String>),        // ["\!win32", "\!freebsd"]
}

Feature Implementations

Feature	Implementation	Tests Added
Catalog Resolution	`resolve_catalog_version()` method	11
Overrides	`apply_overrides()` method	3
V1 Workspaces	Direct resolution from workspaces section	10
Platform Constraints	`Negatable` type with serde support	6
Subgraph Filtering	Smart metadata filtering	2
Integration Tests	Combined feature scenarios	11

Resolution Order

The implementation follows this precedence: catalog → override → patch

Areas of Uncertainty

I want to be transparent about areas where I'm less confident or made assumptions:

V1 Behavior Beyond Workspaces: While I implemented the workspace optimization mentioned in Bun's source, there may be other v1-specific behaviors I'm not aware of.
Trusted Dependencies: I parse and filter these, but I'm unsure if Turborepo needs to actually use this information for any security/installation decisions.
Platform Constraint Application: The Negatable::allows() method is implemented but unused. I'm not sure where in Turborepo's architecture platform filtering should actually occur.
Catalog Precedence: I assumed catalogs should be resolved before overrides based on the code structure, but this precedence isn't explicitly documented.
Error Handling: Some edge cases (like circular workspace dependencies or conflicting overrides) may not be handled optimally.

Potential Issues

Performance: The catalog resolution adds an extra lookup step during package resolution. For large monorepos with many catalog references, this could impact performance.
Backward Compatibility: While I've maintained compatibility with existing lockfiles, the changes to global_change() will cause cache invalidation for projects upgrading Turborepo.
Incomplete Platform Support: The platform constraints are parsed but not actively used for filtering during dependency resolution.

Questions for Reviewers

Should platform constraints actually filter dependencies during resolution, or is parsing/preserving them sufficient?
Is the catalog resolution precedence (catalog → override → patch) correct?
Should trusted dependencies affect any Turborepo behavior?
Are there other v1-specific optimizations beyond workspace handling that should be implemented?
Should the UnsupportedVersion error be recoverable or fatal?

Known Limitations

Trusted dependencies are parsed but don't affect installation behavior
Platform constraints are parsed but not used for dependency filtering (would need higher-level changes)
libc field is not implemented (marked TODO in Bun source)
The Negatable::allows() method for platform matching is unused (added for completeness)

Additional Context

This is a draft PR as I would appreciate feedback on the implementation approach, particularly in areas where I made assumptions about intended behavior.

🤖 Generated with Claude Code

Co-Authored-By: Claude noreply@anthropic.com

vercel · 2025-08-04T00:32:15Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
examples-basic-web	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Aug 4, 2025 0:45am
examples-designsystem-docs	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Aug 4, 2025 0:45am
examples-tailwind-web	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Aug 4, 2025 0:45am
examples-vite-web	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Aug 4, 2025 0:45am

vercel · 2025-08-04T00:32:16Z

Someone is attempting to deploy a commit to the Vercel Team on Vercel.

A member of the Team first needs to authorize it.

Jarred-Sumner · 2025-08-04T00:36:46Z

crates/turborepo-lockfiles/src/bun/mod.rs

+        // Workspace dependencies are referenced by their relative path
+        // e.g., "@repo/ui": "packages/ui"
+        // We need to check if this path exists in our workspaces
+        if !version.contains('/') || version.starts_with('^') || version.starts_with('~') || version.starts_with('=') {


workspace package paths are allowed to not have a / in them though it is uncommon

Jarred-Sumner · 2025-08-04T00:37:14Z

crates/turborepo-lockfiles/src/bun/mod.rs

+            .iter()
+            .map(|ident| {
+                // Extract package name from ident (e.g., "foo@1.0.0" -> "foo")
+                ident.split('@').next().unwrap_or(ident).to_string()


this does not correctly handle scoped package names

…rent implementation Updates Turborepo's bun.lock parser to support features from Bun's latest lockfile format, addressing compatibility gaps and adding missing functionality. ## What? - Add LockfileVersion enum for v0/v1 format handling - Fix global_change() to detect version changes (was only checking package manager) - Add support for new lockfile fields: trustedDependencies, overrides, catalog/catalogs - Implement platform-specific constraints (os/cpu fields) - Add v1 workspace optimizations (reduces redundant package entries) - Add bun_global_change() standalone function for API consistency ## Why? The existing implementation had several gaps: - Cache invalidation could fail when lockfile versions changed - New Bun lockfile fields were silently ignored - V1 optimizations were not implemented - Platform constraints were not parsed ## How? - Catalog resolution via resolve_catalog_version() method - Override support via apply_overrides() method - Negatable enum for platform constraints - Version-aware workspace resolution - Comprehensive subgraph filtering ## Testing Ran tests with: ```bash cargo test -p turborepo-lockfiles ``` - Added 43 new tests (72 total Bun tests, up from 29) - All 238 package manager tests pass - Test coverage includes: version detection, catalogs, overrides, v1 workspaces, platform constraints, integration scenarios ## Notes - Based on Bun's src/install/lockfile/bun.lock.zig - Follows existing patterns from npm/pnpm/yarn implementations - Some features (trusted deps, platform filtering) are parsed but not actively used 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

Firgrep · 2025-08-25T09:06:32Z

@Jarred-Sumner Any updates or timelines on this? Seems like turborepo with bun catalogs just triggers fan-out tasks whenever there is a change to the lock file (e.g. adding any package, local workspace or external).

turbo-orchestrator bot added the needs: triage label Aug 4, 2025

Jarred-Sumner reviewed Aug 4, 2025

View reviewed changes

robobun force-pushed the main branch from 4f0944d to a85036a Compare August 4, 2025 00:44

anthonyshew removed the needs: triage label Aug 22, 2025

turbo-orchestrator bot added the needs: triage label Aug 22, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(turborepo-lockfiles): Update bun.lock support to match Bun's current implementation #10729

feat(turborepo-lockfiles): Update bun.lock support to match Bun's current implementation #10729

robobun commented Aug 4, 2025 •

edited

Loading

Uh oh!

vercel bot commented Aug 4, 2025 •

edited

Loading

Uh oh!

vercel bot commented Aug 4, 2025

Uh oh!

Jarred-Sumner Aug 4, 2025

Uh oh!

Jarred-Sumner Aug 4, 2025

Uh oh!

Firgrep commented Aug 25, 2025

Uh oh!

Uh oh!

feat(turborepo-lockfiles): Update bun.lock support to match Bun's current implementation #10729

Are you sure you want to change the base?

feat(turborepo-lockfiles): Update bun.lock support to match Bun's current implementation #10729

Conversation

robobun commented Aug 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Testing Instructions

Test Results

Background

Changes

Core Fixes

Feature Implementations

Resolution Order

Areas of Uncertainty

Potential Issues

Questions for Reviewers

Known Limitations

Additional Context

Uh oh!

vercel bot commented Aug 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vercel bot commented Aug 4, 2025

Uh oh!

Jarred-Sumner Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

Jarred-Sumner Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

Firgrep commented Aug 25, 2025

Uh oh!

Uh oh!

robobun commented Aug 4, 2025 •

edited

Loading

vercel bot commented Aug 4, 2025 •

edited

Loading