Skip to content

Sweep deps, stop the hooks running bunx, and cut 0.4.8 - #85

Merged
vvillait88 merged 2 commits into
mainfrom
sweep-deps-and-release
Aug 3, 2026
Merged

Sweep deps, stop the hooks running bunx, and cut 0.4.8#85
vvillait88 merged 2 commits into
mainfrom
sweep-deps-and-release

Conversation

@vvillait88

Copy link
Copy Markdown
Contributor

Summary

Dependency sweep, a real hook bug, and a version bump so this can be released.

  • knip 6.29.0 to 6.31.0, and @agent-score/sdk to 2.7.2 (published from node-sdk#70 today). eslint 10 and TypeScript 7 stay held org-wide.
  • packageManager bun@1.3.13 to 1.3.14, matching the release this repo is built and tested with.
  • Version to 0.4.8.

The hooks called bunx eslint and bunx tsc --noEmit. bunx resolves a tool independently of the project, so it can fetch a different major and then fail, or pass, for reasons unrelated to the code being checked, and it writes to the lockfile as a side effect. This repo is the worst case: eslint is held at 9 and TypeScript at 6 while 10 and 7 are published, so those two lines would pull exactly the majors the manifest pins away from. CI already had this right, fixed on main for the same reason; the hooks were left behind. A guard test now asserts no hook invokes bunx, that lint uses the local binary, that typecheck goes through the pinned script, and that every bun run <script> hook names a script that exists.

Two things checked rather than assumed. The incur patch is pinned to incur@0.4.26, which is still both the installed and the latest version, so nothing detached it, and no incur change means the compiled-binary MCP handshake this repo requires at an incur bump is not triggered. tsx shows an available version held back by the 24h release-age soak in bunfig, which is the soak working: tsx is not exact-pinned, so it correctly is not on the excludes list.

Nothing in 0.4.8 changes the published CLI's behavior: the only commit since v0.4.7 is a one-line ci.yml change and the SDK bump is a patch with no API change.

Type of change

  • Bug fix (no breaking change)
  • New feature (no breaking change)
  • Breaking change (existing callers must update)
  • Docs, tests, or internal maintenance only

Public API

None. No command, flag, output envelope, or exit code changed. @agent-score/sdk 2.7.1 to 2.7.2 is itself a no-op patch on the published surface.

Test plan

  • bun run test: 570 passed, 2 skipped
  • bun run lint, bun run typecheck, bun run knip: clean
  • bun run build: tsup build succeeded
  • The new guard test was proven to fail by putting bunx tsc back into the hook, then restored.
  • SDK resolution verified through the consumer (node_modules/@agent-score/sdk reports 2.7.2) rather than off the registry.

Reproduce with bun install && bun run lint && bun run typecheck && bun run knip && bun run test && bun run build.

Checklist

  • Tests cover the new behavior, and the suite passes locally
  • Lint, format, and type checks pass
  • Docs and README examples updated if the public surface changed (not applicable)
  • No secrets, credentials, or personal data in the diff or the tests

knip 6.29.0 to 6.31.0, the only available non-held bump. eslint 10 and
TypeScript 7 stay held org-wide. tsx shows an available version held back by
the 24h release-age soak in bunfig, which is the soak doing its job rather
than something to override: it is not exact-pinned, so it correctly is not on
the excludes list.

The hooks called `bunx eslint` and `bunx tsc --noEmit`. `bunx` resolves a tool
independently of the project, so it can fetch a different major and then fail,
or pass, for reasons unrelated to the code being checked, and it writes to the
lockfile as a side effect. This repo is the worst case: eslint is held at 9 and
TypeScript at 6 while 10 and 7 are published, so those two lines would pull
exactly the majors the manifest pins away from. CI already had this right,
fixed on main for the same reason; the hooks were left behind. A guard test now
asserts no hook invokes bunx, that lint uses the local binary, that typecheck
goes through the pinned script, and that every `bun run <script>` hook names a
script that exists.

packageManager bun@1.3.13 to 1.3.14, matching the release this repo is built
and tested with.

Version to 0.4.8. As with the SDKs, nothing here reaches a consumer: the only
commit since v0.4.7 is a one-line ci.yml change and knip is dev-only, so the
published CLI is unchanged.

The incur patch was checked rather than assumed. It is pinned to incur@0.4.26,
that is still both the installed and the latest version, so nothing detached
it. No incur change means the compiled-binary MCP handshake this repo requires
at an incur bump is not triggered here.

Gates: lint, typecheck, knip clean; 570 tests passed, 2 skipped; build ok.
The floor moves to ^2.7.2 rather than being left at ^2.7.1, which already
accepted it. Raising the declared floor is what stops the lock drifting back
under the version this repo is actually tested against; a caret sitting on an
older floor resolves correctly today and silently stops doing so later.

Resolution verified through the consumer rather than off the registry:
node_modules/@agent-score/sdk reports 2.7.2.

Gates re-run after the bump: lint, typecheck, knip clean, 570 tests passed,
build ok.
@vvillait88
vvillait88 merged commit 8ac0830 into main Aug 3, 2026
7 checks passed
@vvillait88
vvillait88 deleted the sweep-deps-and-release branch August 3, 2026 00:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant