Skip to content

fix(parsers): support legacy bun.lockb layouts#595

Merged
mstykow merged 3 commits intomainfrom
fix/bun-lockb-legacy-verification
Apr 9, 2026
Merged

fix(parsers): support legacy bun.lockb layouts#595
mstykow merged 3 commits intomainfrom
fix/bun-lockb-legacy-verification

Conversation

@mstykow
Copy link
Copy Markdown
Owner

@mstykow mstykow commented Apr 9, 2026

Summary

  • accept Bun's legacy seven-field bun.lockb package layout so bench/bundle/bun.lockb in oven-sh/bun @ 700fc117 no longer fails package extraction during compare-outputs
  • add Provenant-owned regression coverage for that exact case at the parser, golden, and scanner/assembly layers
  • record the verified oven-sh/bun compare run in docs/BENCHMARKS.md and expand the scorecard note with the reviewed remaining tail

Scope and exclusions

  • Included:
    • src/parsers/bun_lockb.rs support for 7-field and 8-field binary package layouts
    • src/parsers/bun_lockb_test.rs, src/parsers/bun_lockb_golden_test.rs, and src/parsers/npm_scan_test.rs coverage for the legacy bun.lockb scenario
    • Provenant-owned fixture files under testdata/bun/
    • Bun verification updates in docs/BENCHMARKS.md and docs/implementation-plans/package-detection/PARSER_VERIFICATION_SCORECARD.md
  • Explicit exclusions:
    • no attempt to add Bun support to upstream ScanCode
    • no broader Bun v3 bun.lockb support beyond the existing current-version boundary

Intentional differences from Python

  • Provenant now accepts Bun's older seven-field bun.lockb layout, which upstream ScanCode still does not parse natively; this is an intentional correctness improvement verified against Bun's own loader expectations and the saved compare-outputs artifacts.

Expected-output fixture changes

  • Files changed: testdata/bun/golden/bun-lockb-v2-no-scripts-expected.json
  • Why the new expected output is correct:
    • it is generated from a Provenant-owned copy of a real legacy bun.lockb that Bun itself accepts
    • the parser now emits the recovered root package pkg:npm/bundle with the resolved pkg:npm/bun-types@0.5.8 dependency information that previously failed behind a scan error

Follow-up work

  • Created or intentionally deferred:
    • intentionally deferred any Bun bun.lockb v3 support because this PR only fixes the verified legacy seven-field regression found in oven-sh/bun
    • intentionally deferred compare-tool normalization cleanup for ScanCode's duplicated package.json dependency identities because the raw compare output already matches and this branch is scoped to the Bun parser regression

mstykow and others added 3 commits April 9, 2026 17:54
Accept Bun's older 7-field binary lockfile records so legacy bun.lockb files discovered in oven-sh/bun no longer fail package extraction during compare verification.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Lock the seven-field Bun lockfile fix in place with parser, golden, and scanner-level regression coverage backed by a Provenant-owned fixture from the verified oven-sh/bun compare case.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Capture the validated Bun benchmark and scorecard outcome after the legacy bun.lockb regression was fixed and the remaining compare tail was reviewed down to non-blocking normalization differences.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
@mstykow mstykow enabled auto-merge (rebase) April 9, 2026 16:00
@mstykow mstykow merged commit 445ca84 into main Apr 9, 2026
14 checks passed
@mstykow mstykow deleted the fix/bun-lockb-legacy-verification branch April 9, 2026 16:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant