Migration to bun

[tuler]

This migrates from pnpm to bun as the package manager, and from node to bun as runtime platform.

[changeset-bot]

🦋 Changeset detected

Latest commit: 708887e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@cartesi/cli	Patch
@cartesi/devnet	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Coverage Report for ./apps/cli

Status	Category	Percentage	Covered / Total
🔵	Lines	90.56%	288 / 318
🔵	Statements	90.15%	293 / 325
🔵	Functions	91.22%	52 / 57
🔵	Branches	74.17%	112 / 151

File Coverage

No changed files found.

Generated in workflow #742 for commit 708887e by the Vitest Coverage Report Action

[tuler]

As far as I understand the release workflow is broken, because changeset publish is not compatible with bun yet, it only works with npm and pnpm.

We also need to understand how we are going to publish in case we opt for binaries produced by bun build --compile, as it's implemented right now. One idea is to use brew on Mac, and apt-get on Linux, but this still needs to be implemented.

[endersonmaia]

We also need to understand how we are going to publish in case we opt for binaries produced by bun build --compile, as it's implemented right now. One idea is to use brew on Mac, and apt-get on Linux, but this still needs to be implemented.

I think we could release the binaries via GitHub Releases at first, and think about brew and apt-get later.

[tuler]

I think we could release the binaries via GitHub Releases at first, and think about brew and apt-get later.

I changed the build process to do both for now.

1. produce dist/index.js as a minified bundle targeting nodejs. This should work as it is now, packaged and published to npmjs and executed with nodejs.
2. produce binaries at bin/cartesi-${os}-${arch}

I did not change the release workflow yet to save the binaries in the release. We need to see how to do that.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​inquirer/​type@​3.0.8 ⏵ 4.0.2	+1		-2	-3
	@​vitest/​coverage-istanbul@​3.2.4 ⏵ 4.0.16
	@​wagmi/​cli@​2.5.1 ⏵ 2.8.0	+1		+2	-4
	listr2@​9.0.4 ⏵ 9.0.5
	vitest@​3.2.4 ⏵ 4.0.16			+1	-1
	@​types/​node@​24.5.1 ⏵ 25.0.3
	commander@​14.0.1 ⏵ 14.0.2	-1
	turbo@​2.6.3 ⏵ 2.7.3				+1
	p-retry@​7.0.0 ⏵ 7.1.1	+1		+1
	rimraf@​6.0.1 ⏵ 6.1.2	+1
	execa@​9.6.0 ⏵ 9.6.1
	tsup@​8.3.0 ⏵ 8.5.1	+1	+1	+1	-1
	zod-validation-error@​3.4.0 ⏵ 3.5.4			+1
	fs-extra@​11.3.2 ⏵ 11.3.3
	fastify@​4.28.1 ⏵ 4.29.1	+1
	typescript@​5.9.2 ⏵ 5.9.3			+1
	smol-toml@​1.4.2 ⏵ 1.6.0
	permissionless@​0.1.45 ⏵ 0.1.49
	@​inquirer/​input@​4.2.4 ⏵ 5.0.3
	@​inquirer/​core@​10.2.2 ⏵ 11.1.0				-1
	@​inquirer/​confirm@​5.1.18 ⏵ 6.0.3			-2	-1
	@​inquirer/​select@​4.3.4 ⏵ 5.0.3
	zod@​3.25.42 ⏵ 3.25.76	+1			-1
	viem@​2.37.6 ⏵ 2.44.0			+1	+1
	@​biomejs/​biome@​2.2.4 ⏵ 2.3.11				+1

View full report