Repository navigation
pstack: pin poteto-mode script devDependencies (bun-types and typescript use latest) #990
Description
Summary
pstack/skills/poteto-mode/scripts/package.json pins commander exactly, but its dev dependencies use the latest tag:
"devDependencies": {
"bun-types": "latest",
"typescript": "latest"
}Why it matters
- Installs are not reproducible:
bun installcan pick a differentbun-typesor TypeScript on every run. - A newly published (or compromised) release is picked up automatically.
- The
typecheckandbun testresults then depend on whichever versions happen to be current. - Static skill scanners flag this as an unpinned-dependency finding (SkillSpector
SC1).
Proposal
- Pin exact versions for
bun-typesandtypescript, and let Renovate/Dependabot (or a scheduled workflow) update the pins; or - Commit a lockfile for
scripts/so the resolved versions are reproducible.
Context
Found by a downstream APM/SkillSpector audit. commander is already pinned exactly; only the two dev dependencies are unpinned.
Related: #531 (CI/validator coverage, including npm dependencies without a lockfile).
Activity
deanrie commentedon Oct 27, 2026
Hey @kotarotaniguchi0523, one data point for the second option:
pstack/skills/poteto-mode/scripts/bun.lockis already committed and resolvesbun-typesto 1.3.14 andtypescriptto 7.0.2. A plainbun installin a fresh checkout keeps those versions and leaves the lockfile unchanged, even thoughbun-types@lateston the registry is 1.4.4 right now (checked with bun 1.4.3). Thelatestspec only takes effect when the lockfile is regenerated, so day-to-day installs andbun testare reproducible today; the scanner is readingpackage.jsonalone.What is missing is a check that the lockfile stays in sync. #618 adds a
script-packages.ymljob that runsbun install --frozen-lockfileplustypecheckandtestfor this directory and fororchestrate/skills/orchestrate/scriptson every PR touching them, which fails the moment someone bumpspackage.jsonwithout the lockfile. Pinning the two specs inpackage.jsonon top of that is a two-line change and makes the scanner happy; that is @poteto's call for the pstack tree.