ci: point dependabot at the bun ecosystem, not npm - #329
Merged
Merged
Conversation
The bun migration left this at `package-ecosystem: npm`. Dependabot has
had a separate `bun` ecosystem since 2025-02-13, and the npm updater
only knows package-lock.json and yarn.lock — with neither present it
bumped package.json and never wrote bun.lock, so every version bump
arrived half-finished and CI rejected it:
error: lockfile had changes, but lockfile is frozen
That is #323, #325 and #326. The two that passed (#324, #327) only
widened a range the locked version already satisfied, so the lockfile
genuinely needed no change.
keonik
added
the
skip-changeset
This was referenced Sep 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause of the three red dependabot PRs (#323, #325, #326).
What was wrong
The bun migration never updated
.github/dependabot.yml, which still declared:Dependabot has shipped a separate
bunecosystem since 2025-02-13 (GA changelog).npmruns the npm updater, which looks forpackage-lock.jsonoryarn.lock. This repo has neither — onlybun.lock— so it bumpedpackage.jsonand left the lockfile alone. Every resulting PR failed at the install step:That is all three of #323, #325, #326 — and it would have been every future bump too.
The two that passed (#324, #327) are the tell: both only widen a range (
^11.9.0→^11.16.0) that the already-locked version satisfies, so no lockfile change was needed and nothing was missing.After this
Dependabot will regenerate these PRs with
bun.lockincluded. The two open majors are worth closing and letting it re-raise properly rather than hand-patching the lockfile:@changesets/cli2.x → 3.0.1@biomejs/biome1.9.4 → 2.5.11 (also needs abiome migratefor the v2 config schema — separate work)Caveat carried over from upstream
bun.lockupdating is known to silently no-op in npm-workspace layouts (still open). This repo is a single package, so it is not affected — worth remembering if that ever changes.