From fa90165e092e08de8c401de775cc6cf30817baa3 Mon Sep 17 00:00:00 2001 From: John Fay Date: Thu, 3 Sep 2026 23:19:21 -0400 Subject: [PATCH] docs(ci): record why the bun dependabot run currently fails Keeping `package-ecosystem: bun`. The monthly run errors because bun 1.4 writes lockfileVersion 2 and Dependabot's bundled bun parses only version 1 (dependabot-core#16071, open). That hard error is itself the fix for #15848, where the old image silently downgraded the lockfile and changed resolutions with no warning. No dependency PRs until #16071 ships. Reverting to `npm` would bring the PRs back but each would carry a stale lockfile and fail CI, which is the noise #329 removed. --- .github/dependabot.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 68b94f0..601171e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,6 +7,20 @@ updates: # `bun install --frozen-lockfile` with "lockfile had changes, but lockfile is # frozen" (#323, #325, #326). Range-widening PRs slipped through only because # the locked version already satisfied the wider range (#324, #327). + # + # KNOWN BROKEN, deliberately left as-is: bun 1.4 writes + # `"lockfileVersion": 2`, and the bun bundled in Dependabot's updater image + # only parses version 1, so the monthly run currently errors with + # Unsupported bun.lock 'lockfileVersion' 2 in /bun.lock + # That error IS the fix for dependabot-core#15848, where the old image + # silently rewrote the lockfile to v1 and changed resolutions with no + # warning; #15896 made it fail loudly instead. Real support is + # dependabot-core#16071, still open. Bun has no flag to emit a v1 lockfile, + # so there is no local workaround. + # + # Until #16071 ships this yields no dependency PRs. That is the intended + # trade: reverting to `npm` would restore the PRs but every one of them + # would arrive with a stale lockfile and fail CI. - package-ecosystem: bun directory: '/' schedule: