Merge branch 'main' into jarred/esm-conditionsjarred/esm-conditions

1 files changed, 147 insertions, 97 deletions

diff --git a/src/install/lockfile.zig b/src/install/lockfile.zig
index 5c27c1a69..843381228 100644
--- a/src/install/lockfile.zig
+++ b/src/install/lockfile.zig
@@ -85,6 +85,7 @@ const PackageJSON = @import("../resolver/package_json.zig").PackageJSON;
 const MetaHash = [std.crypto.hash.sha2.Sha512256.digest_length]u8;
 const zero_hash = std.mem.zeroes(MetaHash);
 const NameHashMap = std.ArrayHashMapUnmanaged(u32, String, ArrayIdentityContext, false);
+const NameHashSet = std.ArrayHashMapUnmanaged(u32, void, ArrayIdentityContext, false);
 
 // Serialized data
 /// The version of the lockfile format, intended to prevent data corruption for format changes.
@@ -103,6 +104,7 @@ allocator: Allocator,
 scratch: Scratch = .{},
 
 scripts: Scripts = .{},
+trusted_dependencies: NameHashSet = .{},
 workspace_paths: NameHashMap = .{},
 
 const Stream = std.io.FixedBufferStream([]u8);
@@ -113,15 +115,15 @@ pub const Scripts = struct {
         cwd: string,
         script: string,
     };
-    const StringArrayList = std.ArrayListUnmanaged(Entry);
+    const Entries = std.ArrayListUnmanaged(Entry);
     const RunCommand = @import("../cli/run_command.zig").RunCommand;
 
-    preinstall: StringArrayList = .{},
-    install: StringArrayList = .{},
-    postinstall: StringArrayList = .{},
-    preprepare: StringArrayList = .{},
-    prepare: StringArrayList = .{},
-    postprepare: StringArrayList = .{},
+    preinstall: Entries = .{},
+    install: Entries = .{},
+    postinstall: Entries = .{},
+    preprepare: Entries = .{},
+    prepare: Entries = .{},
+    postprepare: Entries = .{},
 
     pub fn hasAny(this: *Scripts) bool {
         inline for (Package.Scripts.Hooks) |hook| {
@@ -195,6 +197,7 @@ pub fn loadFromBytes(this: *Lockfile, buf: []u8, allocator: Allocator, log: *log
 
     this.format = FormatVersion.current;
     this.scripts = .{};
+    this.trusted_dependencies = .{};
     this.workspace_paths = .{};
 
     Lockfile.Serializer.load(this, &stream, allocator, log) catch |err| {
@@ -343,31 +346,23 @@ pub const Tree = struct {
         dependencies: []const Dependency,
         resolution_lists: []const Lockfile.DependencyIDSlice,
         queue: Lockfile.TreeFiller,
-        log: ?*logger.Log = null,
-        old_lockfile: ?*Lockfile = null,
+        log: *logger.Log,
+        old_lockfile: *Lockfile,
 
         pub fn maybeReportError(this: *Builder, comptime fmt: string, args: anytype) void {
-            var log = this.log orelse return;
-            if (this.old_lockfile == null) return;
-
-            log.addErrorFmt(null, logger.Loc.Empty, this.allocator, fmt, args) catch {};
+            this.log.addErrorFmt(null, logger.Loc.Empty, this.allocator, fmt, args) catch {};
         }
 
         pub fn buf(this: *const Builder) []const u8 {
-            var lockfile = this.old_lockfile orelse return "";
-            return lockfile.buffers.string_bytes.items;
+            return this.old_lockfile.buffers.string_bytes.items;
         }
 
         pub fn packageName(this: *Builder, id: PackageID) String.Formatter {
-            var lockfile = this.old_lockfile orelse return undefined;
-
-            return lockfile.packages.items(.name)[id].fmt(lockfile.buffers.string_bytes.items);
+            return this.old_lockfile.packages.items(.name)[id].fmt(this.old_lockfile.buffers.string_bytes.items);
         }
 
         pub fn packageVersion(this: *Builder, id: PackageID) Resolution.Formatter {
-            var lockfile = this.old_lockfile orelse return undefined;
-
-            return lockfile.packages.items(.resolution)[id].fmt(lockfile.buffers.string_bytes.items);
+            return this.old_lockfile.packages.items(.resolution)[id].fmt(this.old_lockfile.buffers.string_bytes.items);
         }
 
         pub const Entry = struct {
@@ -499,15 +494,14 @@ pub const Tree = struct {
             if (dep.name_hash != dependency.name_hash) continue;
             if (builder.resolutions[dep_id] != package_id) {
                 if (as_defined and !dep.behavior.isPeer()) {
-                    if (builder.log != null)
-                        builder.maybeReportError("Package \"{}@{}\" has a dependency loop\n  Resolution: \"{}@{}\"\n  Dependency: \"{}@{}\"", .{
-                            builder.packageName(package_id),
-                            builder.packageVersion(package_id),
-                            builder.packageName(builder.resolutions[dep_id]),
-                            builder.packageVersion(builder.resolutions[dep_id]),
-                            dependency.name.fmt(builder.buf()),
-                            dependency.version.literal.fmt(builder.buf()),
-                        });
+                    builder.maybeReportError("Package \"{}@{}\" has a dependency loop\n  Resolution: \"{}@{}\"\n  Dependency: \"{}@{}\"", .{
+                        builder.packageName(package_id),
+                        builder.packageVersion(package_id),
+                        builder.packageName(builder.resolutions[dep_id]),
+                        builder.packageVersion(builder.resolutions[dep_id]),
+                        dependency.name.fmt(builder.buf()),
+                        dependency.version.literal.fmt(builder.buf()),
+                    });
                     return error.DependencyLoop;
                 }
                 // ignore versioning conflicts caused by peer dependencies
@@ -544,6 +538,7 @@ pub const Tree = struct {
 pub fn maybeCloneFilteringRootPackages(
     old: *Lockfile,
     features: Features,
+    exact_versions: bool,
 ) !*Lockfile {
     const old_root_dependenices_list = old.packages.items(.dependencies)[0];
     var old_root_resolutions = old.packages.items(.resolutions)[0];
@@ -561,10 +556,10 @@ pub fn maybeCloneFilteringRootPackages(
 
     if (!any_changes) return old;
 
-    return try old.clean(&.{});
+    return try old.clean(&.{}, exact_versions);
 }
 
-fn preprocessUpdateRequests(old: *Lockfile, updates: []PackageManager.UpdateRequest) !void {
+fn preprocessUpdateRequests(old: *Lockfile, updates: []PackageManager.UpdateRequest, exact_versions: bool) !void {
     const root_deps_list: Lockfile.DependencySlice = old.packages.items(.dependencies)[0];
     if (@as(usize, root_deps_list.off) < old.buffers.dependencies.items.len) {
         var string_builder = old.stringBuilder();
@@ -581,7 +576,10 @@ fn preprocessUpdateRequests(old: *Lockfile, updates: []PackageManager.UpdateRequ
                         if (dep.name_hash == String.Builder.stringHash(update.name)) {
                             if (old_resolution > old.packages.len) continue;
                             const res = resolutions_of_yore[old_resolution];
-                            const len = std.fmt.count("^{}", .{res.value.npm.fmt(old.buffers.string_bytes.items)});
+                            const len = switch (exact_versions) {
+                                false => std.fmt.count("^{}", .{res.value.npm.fmt(old.buffers.string_bytes.items)}),
+                                true => std.fmt.count("{}", .{res.value.npm.fmt(old.buffers.string_bytes.items)}),
+                            };
                             if (len >= String.max_inline_len) {
                                 string_builder.cap += len;
                             }
@@ -609,7 +607,10 @@ fn preprocessUpdateRequests(old: *Lockfile, updates: []PackageManager.UpdateRequ
                         if (dep.name_hash == String.Builder.stringHash(update.name)) {
                             if (old_resolution > old.packages.len) continue;
                             const res = resolutions_of_yore[old_resolution];
-                            var buf = std.fmt.bufPrint(&temp_buf, "^{}", .{res.value.npm.fmt(old.buffers.string_bytes.items)}) catch break;
+                            var buf = switch (exact_versions) {
+                                false => std.fmt.bufPrint(&temp_buf, "^{}", .{res.value.npm.fmt(old.buffers.string_bytes.items)}) catch break,
+                                true => std.fmt.bufPrint(&temp_buf, "{}", .{res.value.npm.fmt(old.buffers.string_bytes.items)}) catch break,
+                            };
                             const external_version = string_builder.append(ExternalString, buf);
                             const sliced = external_version.value.sliced(old.buffers.string_bytes.items);
                             dep.version = Dependency.parse(
@@ -628,17 +629,36 @@ fn preprocessUpdateRequests(old: *Lockfile, updates: []PackageManager.UpdateRequ
         }
     }
 }
-pub fn clean(old: *Lockfile, updates: []PackageManager.UpdateRequest) !*Lockfile {
-    return old.cleanWithLogger(updates, null);
+pub fn clean(
+    old: *Lockfile,
+    updates: []PackageManager.UpdateRequest,
+    exact_versions: bool,
+) !*Lockfile {
+    // This is wasteful, but we rarely log anything so it's fine.
+    var log = logger.Log.init(bun.default_allocator);
+    defer {
+        for (log.msgs.items) |*item| {
+            item.deinit(bun.default_allocator);
+        }
+        log.deinit();
+    }
+
+    return old.cleanWithLogger(updates, &log, exact_versions);
 }
 
-pub fn cleanWithLogger(old: *Lockfile, updates: []PackageManager.UpdateRequest, log: ?*logger.Log) !*Lockfile {
+pub fn cleanWithLogger(
+    old: *Lockfile,
+    updates: []PackageManager.UpdateRequest,
+    log: *logger.Log,
+    exact_versions: bool,
+) !*Lockfile {
+    const old_trusted_dependencies = old.trusted_dependencies;
     const old_scripts = old.scripts;
     // We will only shrink the number of packages here.
     // never grow
 
     if (updates.len > 0) {
-        try old.preprocessUpdateRequests(updates);
+        try old.preprocessUpdateRequests(updates, exact_versions);
     }
 
     // Deduplication works like this
@@ -693,8 +713,7 @@ pub fn cleanWithLogger(old: *Lockfile, updates: []PackageManager.UpdateRequest,
     const root = old.rootPackage() orelse return error.NoPackage;
 
     var package_id_mapping = try old.allocator.alloc(PackageID, old.packages.len);
-    std.mem.set(
-        PackageID,
+    @memset(
         package_id_mapping,
         invalid_package_id,
     );
@@ -739,6 +758,7 @@ pub fn cleanWithLogger(old: *Lockfile, updates: []PackageManager.UpdateRequest,
             }
         }
     }
+    new.trusted_dependencies = old_trusted_dependencies;
     new.scripts = old_scripts;
     return new;
 }
@@ -781,7 +801,7 @@ const Cloner = struct {
     mapping: []PackageID,
     trees: Tree.List = Tree.List{},
     trees_count: u32 = 1,
-    log: ?*logger.Log = null,
+    log: *logger.Log,
 
     pub fn flush(this: *Cloner) anyerror!void {
         const max_package_id = this.old.packages.len;
@@ -910,10 +930,10 @@ pub const Printer = struct {
                     }),
                 }
                 if (log.errors > 0) {
-                    if (Output.enable_ansi_colors) {
-                        try log.printForLogLevelWithEnableAnsiColors(Output.errorWriter(), true);
-                    } else {
-                        try log.printForLogLevelWithEnableAnsiColors(Output.errorWriter(), false);
+                    switch (Output.enable_ansi_colors) {
+                        inline else => |enable_ansi_colors| {
+                            try log.printForLogLevelWithEnableAnsiColors(Output.errorWriter(), enable_ansi_colors);
+                        },
                     }
                 }
                 Global.crash();
@@ -998,7 +1018,7 @@ pub const Printer = struct {
             const dependencies_buffer: []const Dependency = this.lockfile.buffers.dependencies.items;
             const string_buf = this.lockfile.buffers.string_bytes.items;
             var id_map = try default_allocator.alloc(DependencyID, this.updates.len);
-            std.mem.set(DependencyID, id_map, invalid_package_id);
+            @memset(id_map, invalid_package_id);
             defer if (id_map.len > 0) default_allocator.free(id_map);
 
             visited.set(0);
@@ -1211,12 +1231,12 @@ pub const Printer = struct {
                     }
 
                     var dependency_versions = requested_version_start[0..j];
-                    if (dependency_versions.len > 1) std.sort.insertionSort(Dependency.Version, dependency_versions, string_buf, Dependency.Version.isLessThan);
+                    if (dependency_versions.len > 1) std.sort.insertion(Dependency.Version, dependency_versions, string_buf, Dependency.Version.isLessThan);
                     try requested_versions.put(i, dependency_versions);
                 }
             }
 
-            std.sort.sort(
+            std.sort.block(
                 PackageID,
                 alphabetized_names,
                 Lockfile.Package.Alphabetizer{
@@ -1494,6 +1514,7 @@ pub fn initEmpty(this: *Lockfile, allocator: Allocator) !void {
         .allocator = allocator,
         .scratch = Scratch.init(allocator),
         .scripts = .{},
+        .trusted_dependencies = .{},
         .workspace_paths = .{},
     };
 }
@@ -1908,11 +1929,11 @@ pub const Package = extern struct {
         field: string,
         behavior: Behavior,
 
-        pub const dependencies = DependencyGroup{ .prop = "dependencies", .field = "dependencies", .behavior = @intToEnum(Behavior, Behavior.normal) };
-        pub const dev = DependencyGroup{ .prop = "devDependencies", .field = "dev_dependencies", .behavior = @intToEnum(Behavior, Behavior.dev) };
-        pub const optional = DependencyGroup{ .prop = "optionalDependencies", .field = "optional_dependencies", .behavior = @intToEnum(Behavior, Behavior.optional) };
-        pub const peer = DependencyGroup{ .prop = "peerDependencies", .field = "peer_dependencies", .behavior = @intToEnum(Behavior, Behavior.peer) };
-        pub const workspaces = DependencyGroup{ .prop = "workspaces", .field = "workspaces", .behavior = @intToEnum(Behavior, Behavior.workspace) };
+        pub const dependencies = DependencyGroup{ .prop = "dependencies", .field = "dependencies", .behavior = @enumFromInt(Behavior, Behavior.normal) };
+        pub const dev = DependencyGroup{ .prop = "devDependencies", .field = "dev_dependencies", .behavior = @enumFromInt(Behavior, Behavior.dev) };
+        pub const optional = DependencyGroup{ .prop = "optionalDependencies", .field = "optional_dependencies", .behavior = @enumFromInt(Behavior, Behavior.optional) };
+        pub const peer = DependencyGroup{ .prop = "peerDependencies", .field = "peer_dependencies", .behavior = @enumFromInt(Behavior, Behavior.peer) };
+        pub const workspaces = DependencyGroup{ .prop = "workspaces", .field = "workspaces", .behavior = @enumFromInt(Behavior, Behavior.workspace) };
     };
 
     pub inline fn isDisabled(this: *const Lockfile.Package) bool {
@@ -2032,21 +2053,22 @@ pub const Package = extern struct {
 
         builder.clamp();
 
-        cloner.trees_count += @as(u32, @boolToInt(old_resolutions.len > 0));
+        cloner.trees_count += @as(u32, @intFromBool(old_resolutions.len > 0));
 
-        for (old_resolutions, 0..) |old_resolution, i| {
-            if (old_resolution >= max_package_id) continue;
+        for (old_resolutions, resolutions, 0..) |old_resolution, *resolution, i| {
+            if (old_resolution >= max_package_id) {
+                resolution.* = invalid_package_id;
+                continue;
+            }
 
             const mapped = package_id_mapping[old_resolution];
-            const resolve_id = new_package.resolutions.off + @intCast(PackageID, i);
-
             if (mapped < max_package_id) {
-                resolutions[i] = mapped;
+                resolution.* = mapped;
             } else {
                 try cloner.clone_queue.append(.{
                     .old_resolution = old_resolution,
                     .parent = new_package.meta.id,
-                    .resolve_id = resolve_id,
+                    .resolve_id = new_package.resolutions.off + @intCast(PackageID, i),
                 });
             }
         }
@@ -2108,7 +2130,7 @@ pub const Package = extern struct {
             if (comptime Environment.allow_assert) std.debug.assert(dependencies_list.items.len == resolutions_list.items.len);
 
             var dependencies: []Dependency = dependencies_list.items.ptr[dependencies_list.items.len..total_len];
-            std.mem.set(Dependency, dependencies, Dependency{});
+            @memset(dependencies, Dependency{});
 
             const package_dependencies = package_json.dependencies.map.values();
             const source_buf = package_json.dependencies.source_buf;
@@ -2135,7 +2157,7 @@ pub const Package = extern struct {
 
             const new_length = package.dependencies.len + dependencies_list.items.len;
 
-            std.mem.set(PackageID, resolutions_list.items.ptr[package.dependencies.off .. package.dependencies.off + package.dependencies.len], invalid_package_id);
+            @memset(resolutions_list.items.ptr[package.dependencies.off .. package.dependencies.off + package.dependencies.len], invalid_package_id);
 
             dependencies_list.items = dependencies_list.items.ptr[0..new_length];
             resolutions_list.items = resolutions_list.items.ptr[0..new_length];
@@ -2160,10 +2182,10 @@ pub const Package = extern struct {
 
         const dependency_groups = comptime brk: {
             var out_groups: [
-                @as(usize, @boolToInt(features.dependencies)) +
-                    @as(usize, @boolToInt(features.dev_dependencies)) +
-                    @as(usize, @boolToInt(features.optional_dependencies)) +
-                    @as(usize, @boolToInt(features.peer_dependencies))
+                @as(usize, @intFromBool(features.dependencies)) +
+                    @as(usize, @intFromBool(features.dev_dependencies)) +
+                    @as(usize, @intFromBool(features.optional_dependencies)) +
+                    @as(usize, @intFromBool(features.peer_dependencies))
             ]DependencyGroup = undefined;
             var out_group_i: usize = 0;
 
@@ -2252,7 +2274,7 @@ pub const Package = extern struct {
             if (comptime Environment.allow_assert) std.debug.assert(dependencies_list.items.len == resolutions_list.items.len);
 
             var dependencies = dependencies_list.items.ptr[dependencies_list.items.len..total_len];
-            std.mem.set(Dependency, dependencies, .{});
+            @memset(dependencies, .{});
 
             total_dependencies_count = 0;
             inline for (dependency_groups) |group| {
@@ -2323,7 +2345,7 @@ pub const Package = extern struct {
 
             const new_length = package.dependencies.len + dependencies_list.items.len;
 
-            std.mem.set(PackageID, resolutions_list.items.ptr[package.dependencies.off .. package.dependencies.off + package.dependencies.len], invalid_package_id);
+            @memset(resolutions_list.items.ptr[package.dependencies.off .. package.dependencies.off + package.dependencies.len], invalid_package_id);
 
             dependencies_list.items = dependencies_list.items.ptr[0..new_length];
             resolutions_list.items = resolutions_list.items.ptr[0..new_length];
@@ -2408,7 +2430,7 @@ pub const Package = extern struct {
     };
 
     pub fn hash(name: string, version: Semver.Version) u64 {
-        var hasher = std.hash.Wyhash.init(0);
+        var hasher = bun.Wyhash.init(0);
         hasher.update(name);
         hasher.update(std.mem.asBytes(&version));
         return hasher.final();
@@ -2438,12 +2460,11 @@ pub const Package = extern struct {
         initializeStore();
 
         const json = json_parser.ParseJSONUTF8(&source, log, allocator) catch |err| {
-            if (Output.enable_ansi_colors) {
-                log.printForLogLevelWithEnableAnsiColors(Output.errorWriter(), true) catch {};
-            } else {
-                log.printForLogLevelWithEnableAnsiColors(Output.errorWriter(), false) catch {};
+            switch (Output.enable_ansi_colors) {
+                inline else => |enable_ansi_colors| {
+                    log.printForLogLevelWithEnableAnsiColors(Output.errorWriter(), enable_ansi_colors) catch {};
+                },
             }
-
             Output.prettyErrorln("<r><red>{s}<r> parsing package.json in <b>\"{s}\"<r>", .{ @errorName(err), source.path.prettyDir() });
             Global.crash();
         };
@@ -2956,9 +2977,7 @@ pub const Package = extern struct {
             }
         }
 
-        if (comptime features.scripts) {
-            Package.Scripts.parseCount(allocator, &string_builder, json);
-        }
+        Package.Scripts.parseCount(allocator, &string_builder, json);
 
         if (comptime ResolverContext != void) {
             resolver.count(*Lockfile.StringBuilder, &string_builder, json);
@@ -2966,11 +2985,11 @@ pub const Package = extern struct {
 
         const dependency_groups = comptime brk: {
             var out_groups: [
-                @as(usize, @boolToInt(features.dependencies)) +
-                    @as(usize, @boolToInt(features.dev_dependencies)) +
-                    @as(usize, @boolToInt(features.optional_dependencies)) +
-                    @as(usize, @boolToInt(features.peer_dependencies)) +
-                    @as(usize, @boolToInt(features.workspaces))
+                @as(usize, @intFromBool(features.dependencies)) +
+                    @as(usize, @intFromBool(features.dev_dependencies)) +
+                    @as(usize, @intFromBool(features.optional_dependencies)) +
+                    @as(usize, @intFromBool(features.peer_dependencies)) +
+                    @as(usize, @intFromBool(features.workspaces))
             ]DependencyGroup = undefined;
             var out_group_i: usize = 0;
 
@@ -3084,9 +3103,10 @@ pub const Package = extern struct {
                             string_builder.count(key);
                             string_builder.count(value);
 
-                            // If it's a folder, pessimistically assume we will need a maximum path
-                            if (Dependency.Version.Tag.infer(value) == .folder) {
-                                string_builder.cap += bun.MAX_PATH_BYTES;
+                            // If it's a folder or workspace, pessimistically assume we will need a maximum path
+                            switch (Dependency.Version.Tag.infer(value)) {
+                                .folder, .workspace => string_builder.cap += bun.MAX_PATH_BYTES,
+                                else => {},
                             }
                         }
                         total_dependencies_count += @truncate(u32, obj.properties.len);
@@ -3113,6 +3133,37 @@ pub const Package = extern struct {
             }
         }
 
+        if (comptime features.trusted_dependencies) {
+            if (json.asProperty("trustedDependencies")) |q| {
+                switch (q.expr.data) {
+                    .e_array => |arr| {
+                        try lockfile.trusted_dependencies.ensureUnusedCapacity(allocator, arr.items.len);
+                        for (arr.slice()) |item| {
+                            const name = item.asString(allocator) orelse {
+                                log.addErrorFmt(&source, q.loc, allocator,
+                                    \\trustedDependencies expects an array of strings, e.g.
+                                    \\"trustedDependencies": [
+                                    \\  "package_name"
+                                    \\]
+                                , .{}) catch {};
+                                return error.InvalidPackageJSON;
+                            };
+                            lockfile.trusted_dependencies.putAssumeCapacity(@truncate(u32, String.Builder.stringHash(name)), {});
+                        }
+                    },
+                    else => {
+                        log.addErrorFmt(&source, q.loc, allocator,
+                            \\trustedDependencies expects an array of strings, e.g.
+                            \\"trustedDependencies": [
+                            \\  "package_name"
+                            \\]
+                        , .{}) catch {};
+                        return error.InvalidPackageJSON;
+                    },
+                }
+            }
+        }
+
         try string_builder.allocate();
         try lockfile.buffers.dependencies.ensureUnusedCapacity(lockfile.allocator, total_dependencies_count);
         try lockfile.buffers.resolutions.ensureUnusedCapacity(lockfile.allocator, total_dependencies_count);
@@ -3233,9 +3284,7 @@ pub const Package = extern struct {
             }
         }
 
-        if (comptime features.scripts) {
-            package.scripts.parseAlloc(allocator, &string_builder, json);
-        }
+        package.scripts.parseAlloc(allocator, &string_builder, json);
         package.scripts.filled = true;
 
         // It is allowed for duplicate dependencies to exist in optionalDependencies and regular dependencies
@@ -3320,7 +3369,7 @@ pub const Package = extern struct {
             }
         }
 
-        std.sort.sort(
+        std.sort.block(
             Dependency,
             package_dependencies[0..total_dependencies_count],
             lockfile.buffers.string_bytes.items,
@@ -3332,7 +3381,7 @@ pub const Package = extern struct {
 
         package.resolutions = @bitCast(@TypeOf(package.resolutions), package.dependencies);
 
-        std.mem.set(PackageID, lockfile.buffers.resolutions.items.ptr[off..total_len], invalid_package_id);
+        @memset(lockfile.buffers.resolutions.items.ptr[off..total_len], invalid_package_id);
 
         const new_len = off + total_dependencies_count;
         lockfile.buffers.dependencies.items = lockfile.buffers.dependencies.items.ptr[0..new_len];
@@ -3397,7 +3446,7 @@ pub const Package = extern struct {
                 }
             };
             var trash: i32 = undefined; // workaround for stage1 compiler bug
-            std.sort.sort(Data, &data, &trash, Sort.lessThan);
+            std.sort.block(Data, &data, &trash, Sort.lessThan);
             var sizes_bytes: [fields.len]usize = undefined;
             var field_indexes: [fields.len]usize = undefined;
             var Types: [fields.len]type = undefined;
@@ -3492,10 +3541,10 @@ pub const Package = extern struct {
                 var bytes = std.mem.sliceAsBytes(sliced.items(@field(Lockfile.Package.List.Field, field.name)));
                 const end_pos = stream.pos + bytes.len;
                 if (end_pos <= end_at) {
-                    @memcpy(bytes.ptr, stream.buffer[stream.pos..].ptr, bytes.len);
+                    @memcpy(bytes, stream.buffer[stream.pos..][0..bytes.len]);
                     stream.pos = end_pos;
                 } else if (comptime strings.eqlComptime(field.name, "scripts")) {
-                    @memset(bytes.ptr, 0, bytes.len);
+                    @memset(bytes, 0);
                 } else {
                     return error.@"Lockfile validation failed: invalid package list range";
                 }
@@ -3511,6 +3560,7 @@ pub fn deinit(this: *Lockfile) void {
     this.packages.deinit(this.allocator);
     this.string_pool.deinit();
     this.scripts.deinit(this.allocator);
+    this.trusted_dependencies.deinit(this.allocator);
     this.workspace_paths.deinit(this.allocator);
 }
 
@@ -3564,7 +3614,7 @@ const Buffers = struct {
             }
         };
         var trash: i32 = undefined; // workaround for stage1 compiler bug
-        std.sort.sort(Data, &data, &trash, Sort.lessThan);
+        std.sort.block(Data, &data, &trash, Sort.lessThan);
         var sizes_bytes: [fields.len]usize = undefined;
         var names: [fields.len][]const u8 = undefined;
         var types: [fields.len]type = undefined;
@@ -3808,7 +3858,7 @@ pub const Serializer = struct {
 
         var writer = stream.writer();
         try writer.writeAll(header_bytes);
-        try writer.writeIntLittle(u32, @enumToInt(this.format));
+        try writer.writeIntLittle(u32, @intFromEnum(this.format));
 
         try writer.writeAll(&this.meta_hash);
 
@@ -3840,7 +3890,7 @@ pub const Serializer = struct {
         }
 
         var format = try reader.readIntLittle(u32);
-        if (format != @enumToInt(Lockfile.FormatVersion.current)) {
+        if (format != @intFromEnum(Lockfile.FormatVersion.current)) {
             return error.@"Outdated lockfile version";
         }
 
@@ -3928,7 +3978,7 @@ fn generateMetaHash(this: *Lockfile, print_name_version_string: bool) !MetaHash
         }
     }
 
-    std.sort.sort(
+    std.sort.block(
         PackageID,
         alphabetized_names,
         Lockfile.Package.Alphabetizer{