From 06283f194c4269e3c88e6060ce2e4326ead98eee Mon Sep 17 00:00:00 2001 From: void <1711810+taraxvoid@users.noreply.github.com> Date: Tue, 6 Oct 2026 08:57:35 -0700 Subject: [PATCH] docs: tell sites to run voidflow bins from the devDependency, not bunx The README told sites to wire check:licenses and test:e2e:lighthouse through bunx --package @taraxvoid/voidflow@. bunx reads the global ~/.bunfig.toml, so a global minimumReleaseAge that does not exclude voidflow blocks it locally for 3 days after every release, and the pinned version lives outside the lockfile and Renovate. Sites already depend on voidflow as a devDependency, so the bins are in node_modules/.bin. Co-Authored-By: Claude Sonnet 5.5 --- README.md | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 9f63a60..a35f463 100644 --- a/README.md +++ b/README.md @@ -107,10 +107,11 @@ static directory on a free port and runs [Unlighthouse](https://unlighthouse.dev/) against it, reusing Playwright's Chromium. It exits non-zero if a category budget in the site's config fails. -In the site's `package.json` (pin the tag): +Add `@taraxvoid/voidflow` as a devDependency and call the bin from the site's +`package.json`: ```json -"test:e2e:lighthouse": "bun run build && bunx --package @taraxvoid/voidflow@0.8.1 unlighthouse-runner --dir dist" +"test:e2e:lighthouse": "bun run build && unlighthouse-runner --dir dist" ``` Options: `--dir` (default `dist`, use `dist/client` for Cloudflare adapter @@ -126,12 +127,20 @@ change. Sites implement that script with the shared check, which runs `license-checker` in the site's repo root and fails on GPL, AGPL, SSPL and similar copyleft licenses (LGPL is allowed). -In the site's `package.json` (pin the tag): +With `@taraxvoid/voidflow` as a devDependency, call the bin from the site's +`package.json`: ```json -"check:licenses": "bunx --package @taraxvoid/voidflow@ check-licenses" +"check:licenses": "check-licenses" ``` +Don't use `bunx --package @taraxvoid/voidflow@ ...` for these. It +duplicates the version pin outside the lockfile and Renovate, and `bunx` reads +the global `~/.bunfig.toml` rather than the site's, so a global +`minimumReleaseAge` that doesn't exclude `@taraxvoid/voidflow` blocks it +locally (including in the pre-commit hook) for 3 days after every release. +The devDependency's bins are installed under the site's own `bunfig.toml`. + ### Playwright preview config Shared `playwright.config` for Astro sites that run e2e against