Garry Tan 9c4ae901ea fix(security): commit bun.lock to pin dependency versions ...

Remove bun.lock from .gitignore and commit the lockfile. Every bun install
now uses exact pinned versions instead of resolving floating ^ ranges from
npm fresh. Closes the supply-chain vector from #566.

Co-Authored-By: boinger <boinger@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-28 08:10:44 -07:00

18 KiB

Raw Blame History

View Raw