feat: bun package manager support for electron-builder

[johnpyp]

Additions

• support for bun isolated mode / bun workspaces proper resolution and reification to the single node_modules directory in the ASAR
  • works with both --linker=isolated and --linker=hoisted modes
• Improved detectPackageManager by adding the Git Root + "nearest parent lockfile" to the search directories for a lockfile
  • this was previously not detecting bun workspaces where electron-builder was in packages/foo and the bun.lock only exists in the root
• add a test-bun-workspace fixture
• add a bun install --linker=isolated test and bun install --linker=hoisted test case
  • additionally, there's a test for conflicting package versions (lib depends on one version of a pakage and app depends on another), which bun isolated mode disambguates. the bunNodeModulesCollector correctly handles this case and nests node_modules appropriately for it.
• add a few deps to onlyBuiltDependencies, which seems to have been missed in the pnpm v9 -> v10 upgrade.

Notes

This PR adds support for bun package manger during electron node_modules packaging into an ASAR, particularly in the context of workspaces and bun's isolated install mode (like pnpm's default node_modules/.pnpm folder + symlinks, isolated mode in bun uses node_modules/.bin + symlinks).

I've confirmed on my real electron application with quite a few dependencies that this all seems to work as expected, and the new fixtures confirm that as well.

Something that seems like it could be a good idea is leveraging https://github.com/antfu-collective/package-manager-detector instead of the manual package management detection that's done currently, because there's a lot more techniques to judge it, and that library encapsulates the logic quite nicely into a configurable call. E.g I noticed that even though bun.lock was added in one place previously, it was missing in 2 others, leading to difficult to troubleshoot inconsistencies. If we leveraged package-manager-detection everywhere, that opportunity for inconsistency should hopefully vanish.

[changeset-bot]

🦋 Changeset detected

Latest commit: 19508e7

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 8 packages

Name	Type
app-builder-lib	Major
dmg-builder	Major
electron-builder-squirrel-windows	Major
electron-builder	Major
electron-forge-maker-appimage	Major
electron-forge-maker-nsis-web	Major
electron-forge-maker-nsis	Major
electron-forge-maker-snap	Major

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​vitest/​ui@​3.0.4 ⏵ 3.2.4			+5	+2

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[mmaietta]

This is awesome! Kicking off CI. Quick Q on this 👇 . What is it doing?

    "onlyBuiltDependencies": [
      "@parcel/watcher",
      "electron",
      "electron-winstaller",
      "esbuild"
    ]
    ```

[johnpyp]

Yeah, that's part of a breaking change in pnpm v10 (details here: https://github.com/orgs/pnpm/discussions/8945) where you're required to specify which dependencies which have postinstall scripts are allowed to run (for security).

It's unfortunately easy to miss it when initially migrating, because if you start from a pnpm v9 installation it won't always print out the error message... weird consistency bug in pnpm I think.

If you do pnpm dlx npkill to wipe out your node_modules, then I believe you'll see the message when you run pnpm install again.

[mmaietta]

Please also add a changeset to register it in the release notes via Changesets CI/CD
pnpm generate-changeset

[mmaietta]

Sorry for the delay on this! Been on a family vacation.

[mmaietta]

Is this still needed?

[mmaietta]

Can we revert this change please? Currently trying to freeze/separate dependency version changes to exclusively their own PRs unless otherwise required.

This should allow us to revert all changes to the pnpm-lock.yaml

[mmaietta]

I'm not familiar with this createRequire, but 2 quick Qs. What are we using it for here as opposed to directly require(...)?
Can we also change the import to from "node:module"?

[mmaietta]

Will this be called numerous times? If so, we could probably use the package lazy-val that is already used in this project for Lazy<string>

[mmaietta]

I can pull this feature into my larger refactor/bug-fixes of node module collector code.

[mmaietta]

Migrated code to be compatible with refactored node_module_collector code
New PR: #9357