GeezerVison

Assisted-by: Claude Code:claude-opus-5-5

Bun records a bundleDependencies copy as its own parent/child entry
flagged { "bundled": true } and unpacks it from the parent's
tarball, never reading the entry. Hosted and vendored scans rewired
those entries and reported success, and vex attested not_affected,
while the copy the parent loads stayed unpatched.

Both rewriters now skip a bundled entry with a loud warning (vendored
refuses when it is the only instance), and vex never takes a bundled
entry as a ref: it contests a ref for the same name@version in the
same lock or any other, like npm's inBundle handling (#325).

Refs #469

Assisted-by: Claude Code:claude-opus-5-5

bun.lockb marks a bundleDependencies edge with the bundled behavior
bit. A record only such edges reach is unpacked from the parent's
tarball, so redirecting or vendoring it installed nothing while scan
reported success and vex attested not_affected. Bun also shares one
record between a regular and a bundled install of the same version,
where the bundled copy stays unpatched.

The binary codec now flags those records. Hosted and vendored skip a
bundled-only record (vendored refuses when nothing else matches),
warn when the record is shared, and vex never attests either case.

Refs #469

Assisted-by: Claude Code:claude-opus-5-5

vlt unpacks a bundleDependencies copy into its parent's store entry
and records no vlt-lock.json node for it, so no hosted or vendored
rewire reaches it. vex still attested the patch as not_affected while
that copy stayed unpatched.

vex now looks for real package directories inside each store
package's own node_modules (vlt links real dependencies as symlinks
beside the package), and does not attest a ref whose name@version a
bundled copy also installs. Vendored warns about such a copy, and
when it is the only install it refuses with that reason instead of
"run vlt install".

Refs #471

Assisted-by: Claude Code:claude-opus-5-5

A hosted scan in a vlt project pinned the regular lock node and
reported a clean success while a bundled copy of the same version,
unpacked into its parent's store entry, stayed unpatched. The scan
now warns redirect_vlt_bundled_instance_skipped and keeps that purl
out of the in-run VEX attestation.

Refs #471

Assisted-by: Claude Code:claude-opus-5-5

Assisted-by: Claude Code:claude-opus-5-5

CodeQL flagged the new bun and vlt bundled-copy diagnostics for
printing the patch uuid. They now name only the package, matching
the other recent VEX diagnostics.

Assisted-by: Claude Code:claude-opus-5-5

The new bun-lockb-bundled fixtures join the VEX discovery golden
corpus. The new bundled-copy tests no longer print lock specs or
diagnostics that carry patch URLs and uuids (CodeQL), only case
numbers and diagnostic codes.

Assisted-by: Claude Code:claude-opus-5-5

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

A hosted scan --vex treated every confirmed redirect as applied. When
Bun shares a record between a regular install and a bundled copy,
or bun.lock has both entries, the regular entry is redirected but
the bundled copy stays unpatched, and the in-run attestation still
said not_affected.

The bun rewriters now record the uuids whose bundled instance they
skipped, and hosted scan verifies those purls instead of assuming
them applied, matching a standalone vex run.

Refs #469

Assisted-by: Claude Code:claude-opus-5-5

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

The redirect equivalence goldens hash each RewriteResult. The new
bundled_skipped_uuids set is left out of the serde digests while
empty, and the two goldens that hash its Debug form (pdm, poetry)
are re-blessed: their inputs are unchanged, only the printed struct
gained the empty field.

Assisted-by: Claude Code:claude-opus-5-5

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

An earlier cargo fmt --all reformatted about 120 files this fix does
not touch (main is not rustfmt-clean and CI has no fmt check). Those
files are back to main's bytes, and the files this PR changes carry
only their real edits on top of main's formatting.

Assisted-by: Claude Code:claude-opus-5-5

cursor Bot left a comment