Files
2pac d5022bbdfd fix(release): sync-versions owns bun.lock and enforces bun pin parity; release v0.13.5 (#40)
v0.13.4 reached npm but its Docker and Fly builds failed on
`bun install --frozen-lockfile`. bun.lock still recorded workspace
versions 0.13.2 and FUSE optionalDependencies pins ^0.8.1. CI ran the
pinned bun 1.4.0, which tolerates that drift, while the image's floating
`oven/bun:1.4` tag resolved to 1.4.1, which refuses it. The tag content
cannot be fixed, so this ships as 0.13.5.

- scripts/sync-versions.ts: every bump now rewrites the bun.lock
  workspace versions and FUSE pins (version fields only, resolutions
  untouched). --check verifies them, and verifies that packageManager,
  both Dockerfile FROM oven/bun: tags, and every workflow bun-version:
  name the same exact bun. Floating tags fail the gate.
- scripts/release.sh: run bun install --frozen-lockfile before the
  check, the same gate the Docker build runs.
- Pin bun 1.4.1 in Dockerfile, package.json packageManager, and all
  workflows.
- Bump to 0.13.5.
- RELEASING.md + CLAUDE.md: document both invariants and the recovery
  rule for a broken tagged commit.
2026-09-04 15:38:05 +02:00
..