From c038ba83f862415963653b60f4b1eb5c7295030b Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 21 Mar 2026 01:07:55 +0000 Subject: [PATCH 1/2] chore(deps): update dependency oven-sh/bun to v1.3.11 --- .prototools | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.prototools b/.prototools index 8c7d7a5e..34b733e0 100644 --- a/.prototools +++ b/.prototools @@ -1,4 +1,4 @@ -bun = "1.3.9" +bun = "1.3.11" node = "24" npm = "11.11.0" gh = "2.88.1" From f979d33ff556340a7bd1ddbe99d7486a83690cbd Mon Sep 17 00:00:00 2001 From: Rhuan Barreto Date: Sat, 21 Mar 2026 02:23:50 +0100 Subject: [PATCH 2/2] chore: remove hardcoded Bun versions from ADR risk sections Reference .prototools as the source of truth instead of hardcoding version numbers that go stale on every Renovate bump. --- .archgate/adrs/ARCH-005-testing-standards.md | 4 ++-- .archgate/adrs/ARCH-006-dependency-policy.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.archgate/adrs/ARCH-005-testing-standards.md b/.archgate/adrs/ARCH-005-testing-standards.md index c237ba16..e116ce18 100644 --- a/.archgate/adrs/ARCH-005-testing-standards.md +++ b/.archgate/adrs/ARCH-005-testing-standards.md @@ -184,8 +184,8 @@ globalThis.fetch = (() => ### Risks -- **Bun test runner API changes** — Although Bun is past 1.0 (currently 1.3.8), some newer APIs may still evolve between minor versions. Test runner behavior or API may change. - - **Mitigation:** The project pins a specific Bun version via `.prototools` (currently 1.3.8). Test runner API changes are caught during controlled Bun upgrades with full test suite validation. +- **Bun test runner API changes** — Although Bun is past 1.0, some newer APIs may still evolve between minor versions. Test runner behavior or API may change. + - **Mitigation:** The project pins a specific Bun version via `.prototools`. Test runner API changes are caught during controlled Bun upgrades with full test suite validation. - **Coverage reporting gaps** — `bun test --coverage` may not report accurate coverage for all code paths, especially for dynamically imported modules. - **Mitigation:** Coverage is a guideline (80% target), not a hard gate. Critical modules (engine, formats) are tested thoroughly regardless of coverage numbers. - **Third-party SDK event loop retention** — External SDK instances that hold internal resource references may keep Bun's event loop alive on Linux after all tests complete, causing `bun test` to hang indefinitely. This does not surface on macOS (event loop drains normally there), making it a Linux-CI-only failure that is hard to reproduce locally. diff --git a/.archgate/adrs/ARCH-006-dependency-policy.md b/.archgate/adrs/ARCH-006-dependency-policy.md index eaa28d9b..664a4ede 100644 --- a/.archgate/adrs/ARCH-006-dependency-policy.md +++ b/.archgate/adrs/ARCH-006-dependency-policy.md @@ -120,7 +120,7 @@ const subset = pick(obj, ["a", "b"]); ### Risks - **Bun API instability** — Bun built-in APIs (especially newer ones like `Bun.Glob`, `Bun.spawn`) may introduce breaking changes or behavioral differences between versions. The `Bun.$` shell API is explicitly avoided due to Windows pipe deadlocks discovered in production. - - **Mitigation:** The project pins Bun version via `.prototools` (currently 1.3.8). API changes are caught during controlled upgrades with full test suite validation. + - **Mitigation:** The project pins Bun version via `.prototools`. API changes are caught during controlled upgrades with full test suite validation. - **Bun built-in feature gaps** — Some functionality may be missing from Bun built-ins (e.g., advanced glob options, streaming HTTP edge cases). If a Bun built-in lacks a critical feature, the fallback is to add an approved dependency with full justification. - **Mitigation:** The approved dependency list exists precisely for this case. The threshold is "Bun cannot do this," not "Bun can do this but an npm package is slightly more convenient." - **New dependency pressure from contributors** — Contributors may add packages out of habit without checking Bun alternatives.