fix(install): warn when dependencies come from a bun other than .bun-version by saddlepaddle · Pull Request #8618 · ParadevAI/Paradev

saddlepaddle · 2026-10-18T01:20:00Z

Where the cause is: the root cause is outside apps/mobile. It is the version of bun that installs the dependencies on a cloud box. This PR changes root install config (scripts/postinstall.sh). fingerprint.config.js and eas.json stay unchanged: they are already correct.

Problem

A cloud sandbox computed a different development-simulator fingerprint than EAS. eas-dev.sh found no matching build, started a ~15 min build, and that build failed at "Configure expo-updates". The workaround was MOBILE_EAS_BUILD_ID.

Cause

The "Configure expo-updates" log of the failed builds f8ebea6a and fbc879f6 (commit 035965bc, 2026-10-17) gives the fingerprint diff. Only three autolinked sources differ, and only in the bun store suffix:

source	sandbox	EAS
`@expo/dom-webview@57.0.1/ios`	`+74e171d88a660d73`	`+6dc057f194158d3d`
`@expo/log-box@57.0.4`	`+74e171d88a660d73`	`+6dc057f194158d3d`
`expo-symbols@57.0.3/ios`	`+945b7335f0d7483f`	`+5d9a54ca60cce305`

The expoAutolinkingConfig:ios podspec dirs that contain these paths differ too.

+74e171d… is bun 1.3.14's name for these entries. Build ccee2940 (2026-10-08) shows the same pair the other way round: EAS was still on its default bun 1.3.14 then, and the submitting machine was on 1.4.2. #8313 pinned EAS to 1.4.2. On 10-17 the sandbox was on 1.3.14:

.bun-version was 1.3.14 until e1347c7 (2026-10-03).
packages/sandbox/src/image.ts installs bun only in the image (npm install -g bun@${BUN_VERSION}). The nightly bundle updates do not install bun, so a box made from an older image keeps 1.3.14.

Reproduced at this branch's HEAD from a clean bun install --frozen-lockfile in a scratch worktree, using the same command eas-dev.sh runs (eas fingerprint:generate -p ios --build-profile development-simulator, without EXPO_PUBLIC_*):

install	fingerprint
bun 1.3.14	`01c85500dc2cfe18731792da3b7498af320743a6`: exactly the "local machine" runtime of the failed builds
bun 1.4.2	`9245768a665fbc158a16bdc248da6532799346c8`: what EAS resolved for those builds
bun 1.3.14, then `bun install` with 1.4.2 on top	`9245768a…`: a reinstall with the right bun is enough to recover

--os/--cpu overrides (linux-arm64, darwin-arm64), non-frozen and --production installs all give 6dc057…, so platform and install flags do not cause it.

Fix

scripts/postinstall.sh now warns on stderr when bun --version differs from .bun-version, and tells you how to recover (install the pinned bun, then rm -rf node_modules && bun install). It only warns, because developers on a newer bun can still install. Nothing is ignored in the fingerprint: the store path is the only input that differs, and fingerprint config cannot rewrite a path without skipping all autolinked native modules.

A box that is already on the right bun needs no change. This box (image of 2026-10-15, bun 1.4.2) already gets the EAS hash.

Verification

Hashes on this box at 19cecc9c and on EAS:
- This box: 9245768a665fbc158a16bdc248da6532799346c8.
- EAS: build 47f68dac (commit c1d34872, the latest finished development-simulator build) records 9245768a665fbc158a16bdc248da6532799346c8.
- EAS also resolved 9245768a… for both builds of 035965bc, the commit the sandbox failed on.
- No EAS build exists of this exact commit, and I did not start one.
apps/mobile/scripts/eas-dev.sh with no MOBILE_EAS_BUILD_ID: it installed 47f68dac without starting a build, and the app loaded from Metro (signed-in home screen). I stopped the session afterwards.
The warning prints under bun 1.3.14 and stays silent under 1.4.2.
bun test apps/mobile/eas-runtime-version.test.ts: 3 pass.

Note: the dev menu shows runtime 0462196c…. That is Metro's manifest, which is computed with the dev .env loaded. It is not the build's runtime, and the build lookup does not use it.

Follow-ups (other owners)

packages/sandbox: install the pinned bun from the bundle, not only the image, so older boxes are upgraded.
apps/mobile/scripts/eas-dev.sh: before the fingerprint lookup, stop when bun --version differs from .bun-version, instead of starting a build that will fail.

Summary by cubic

Fixes a silent mismatch between the bun version used during install and the one pinned in .bun-version, which caused apps/mobile to compute a different development-simulator fingerprint than EAS, making eas-dev.sh start a build that failed at "Configure expo-updates". The root cause is that cloud boxes keep the bun from their image, which can be older. scripts/postinstall.sh now warns on stderr when bun version differs and explains how to recover (install the pinned bun, then rm -rf node_modules && bun install). It only warns; the install still succeeds.

^{Written for commit 75bb608. Summary will update on new commits.}

Summary by CodeRabbit

Installation
- The install process now checks whether your Bun version matches the project’s pinned version. If they differ, it prints the expected version and suggested reinstall commands; installation continues without interruption.

…version A cloud box keeps the bun its image was built with: bun is installed in the image only, and nightly bundle updates do not replace it. A box from an image built before 2026-10-03 still runs bun 1.3.14. That bun names the node_modules/.bun store entries of @expo/dom-webview, @expo/log-box and expo-symbols differently (+74e171d88a660d73 instead of +6dc057f194158d3d), and the mobile runtime version is a fingerprint of those paths. So eas-dev.sh found no build with that fingerprint, started a new one, and the build failed at "Configure expo-updates". The install now says so, and says how to recover.

coderabbitai · 2026-10-18T01:20:46Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults
Review profile: CHILL
Plan: Advanced
Run ID: c0362935-9014-4dea-84cb-4e42d354a98e

📥 Commits

Reviewing files that changed from the base of the PR and between 19cecc9 and 75bb608.

📒 Files selected for processing: 1

scripts/postinstall.sh

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.

📝 Walkthrough

The postinstall script reads the pinned Bun version from .bun-version. If it differs from the installed version, the script prints a warning and reinstall instructions to stderr, then continues.

Changes: Bun version check

Layer / File(s)	Summary
Check and report Bun version `scripts/postinstall.sh`	The script compares the installed Bun version with the pinned version. On mismatch, it prints diagnostic messages and reinstall instructions to stderr without stopping installation.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Suggested reviewers: kitenite

Merge Risk: ⚪ Minimal · up to 75bb6

The version check warns about local Bun mismatches; EAS builds use the pinned version, and no actionable merge risk remains.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title uses conventional commit format and clearly describes the main change: warning when the installed Bun version differs from .bun-version.
Description check		The description clearly explains the problem, root cause, fix, impact, and verification. It includes detailed testing results, although it does not reproduce the template headings or checklist.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.

✨ Finishing Touches

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-18T01:22:12Z

🧹 Preview Cleanup Complete

The following preview resources have been cleaned up:

✅ Neon database branch

Thank you for your contribution! 🎉

greptile-apps · 2026-10-18T01:22:38Z

Confidence Score: 5/5

[Low impact] The PR appears safe to merge; the new check warns without stopping installation.

Summary

Adds a warning when the Bun used during installation differs from .bun-version.

Dependency installs warn when Bun does not match the repository pin.

saddlepaddle explicitly deferred automatic Bun upgrades for older sandbox boxes and a version check that stops the mobile build lookup.

_{Reviews (1) · Last reviewed commit: "fix(install): warn when dependencies com..." · Reviewed by Greptile}

- Pass disableAutoLaunch=1&disableFab=1 on every dev-client load, so no dev menu opens at launch and no gear covers the toolbar (replaces #8616). - Keep egress and Metro logs and PIDs in .tmp/eas-dev/ of the checkout, and kill a PID only when it is still an egress client, so two checkouts no longer stop each other's tunnel. - On macOS, find a client's cwd with lsof instead of matching every client. - Confirm a load from the Metro log only when this script started Metro. - Treat the tunnel as healthy only when its last state is "connected". - Refuse the fingerprint lookup when bun differs from .bun-version, instead of starting a build that fails (the root cause behind #8618). - Exit when Metro does not start; reject --new with --reload.

) * fix(mobile): make eas-dev.sh survive new sessions and first loads --new used to keep the egress client of the old session, so the app could not reach Metro. The script now records the client it starts, replaces it whenever a session starts or the client is not connected to the current session, and keeps a healthy one on reuse. After the tunnel connects, it loads the app through the dev-client URL and waits for a new "iOS Bundled" line in the Metro log, three tries. --reload does only that, so agents never need agent-device open Superset. simctl is out of reach, so on a new session the script opens the keyboard once in Settings and dismisses the slide-to-type intro. Docs: how to reload and switch sessions, and that SwiftUI menu items need coordinate taps. * fix(mobile): eas-dev.sh hides dev overlays and keeps state per checkout - Pass disableAutoLaunch=1&disableFab=1 on every dev-client load, so no dev menu opens at launch and no gear covers the toolbar (replaces #8616). - Keep egress and Metro logs and PIDs in .tmp/eas-dev/ of the checkout, and kill a PID only when it is still an egress client, so two checkouts no longer stop each other's tunnel. - On macOS, find a client's cwd with lsof instead of matching every client. - Confirm a load from the Metro log only when this script started Metro. - Treat the tunnel as healthy only when its last state is "connected". - Refuse the fingerprint lookup when bun differs from .bun-version, instead of starting a build that fails (the root cause behind #8618). - Exit when Metro does not start; reject --new with --reload. * fix(mobile): eas-dev.sh matches only the exact connected line * fix(mobile): eas-dev.sh touches only egress clients in this checkout * fix(mobile): eas-dev.sh compares physical paths to find its egress clients

saddlepaddle · 2026-10-19T20:06:38Z

Closing: the warning reported the symptom but left the cause. Workspaces made before the Bun 1.4.2 pin (#8101, Oct 3) keep the image's Bun 1.3.14, because bundle updates never upgrade it. The image already installs the version in .bun-version, and the golden has rebuilt with 1.4.2 since Oct 4, so a new workspace fixes it. #8617 adds the one check where the mismatch costs something: eas-dev.sh refuses the fingerprint lookup when Bun differs from .bun-version, instead of starting a 15-minute build that cannot match.

saddlepaddle temporarily deployed to preview October 18, 2026 01:20 — with GitHub Actions Inactive

saddlepaddle mentioned this pull request Oct 19, 2026

fix(mobile): make eas-dev.sh survive new sessions and first loads #8617

Merged

saddlepaddle closed this Oct 19, 2026

Navigation Menu

Repository navigation

fix(install): warn when dependencies come from a bun other than .bun-version - #8618

fix(install): warn when dependencies come from a bun other than .bun-version#8618
saddlepaddle wants to merge 1 commit into
mainfrom
superset/eas-eas-fingerprint-88828a45

saddlepaddle commented Oct 18, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 18, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 18, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Oct 18, 2026 •

edited

Loading

Uh oh!

saddlepaddle commented Oct 19, 2026

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

saddlepaddle commented Oct 18, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Cause

Fix

Verification

Follow-ups (other owners)

Summary by cubic

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🧹 Preview Cleanup Complete

Uh oh!

greptile-apps Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

saddlepaddle commented Oct 19, 2026

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

saddlepaddle commented Oct 18, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 18, 2026 •

edited

Loading

github-actions Bot commented Oct 18, 2026 •

edited

Loading

greptile-apps Bot commented Oct 18, 2026 •

edited

Loading