[yamcodes]

Hosted Renovate updates package.json and leaves nub.lock unchanged. CI's frozen nub install then exits 16 with ERR_NUB_OUTDATED_LOCKFILE, so every job on those PRs fails before the tests run.

Autofix now runs nub install --lockfile-only first. That command is allowed to rewrite nub.lock in CI, and autofix.ci commits it when it changes. The following CI run installs from that file.

TODO(2057) on that step tracks removing it once renovatebot/renovate#44422 is on the hosted Mend app. Tracking issue: #2057.

After this merges, re-run the autofix workflow on the open Renovate PRs so each one picks up its lockfile:

• chore(deps): update dependency ejs to v6 #2050 ejs
• chore(deps): update dependency concurrently to v10 - autoclosed #2049 concurrently
• chore(deps): update dependency @testing-library/jest-dom to v7 #2047 @testing-library/jest-dom
• fix(deps): update dependency @ark/util to v0.56.6 #2044 @ark/util
• fix(deps): pin dependencies #2040 pin dependencies
• chore(deps): pin dependencies #2039 pin @types/react
• fix(deps): update dependency vite to v8.0.16 [security] #2033 vite
• fix(deps): update dependency nuxt to v4.5.1 [security] #2032 nuxt
• chore(deps): update dependency postcss to v8.5.23 [security] #2031 postcss

#1862 is already green.

  

[changeset-bot]

⚠️ No Changeset found

Latest commit: 5cd455b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pullfrog]

✅ No new issues found.

Reviewed changes

• Lockfile refresh script — new scripts/nub-install-refresh-lockfile.js runs a frozen nub install, detects ERR_NUB_OUTDATED_LOCKFILE (exit 16), then reruns nub install --no-frozen-lockfile so the drift is repaired before autofix.ci commits.
• Autofix wiring — the autofix job's Install dependencies step now calls the script instead of a bare nub install.
• Tests — unit coverage for the detection/refresh paths plus a guard that the workflow keeps invoking the script.

I verified the load-bearing assumption directly against Nub 0.9.3 in a sandbox: a drifted manifest makes CI=1 nub install exit 16 and print ERR_NUB_OUTDATED_LOCKFILE, and running the script against that fixture refreshes nub.lock and exits 0. (The raw binary only carries ERR_AUBE_OUTDATED_LOCKFILE in its string table — Nub rewrites the prefix at display time, so the ERR_NUB_ spelling in the script is correct.) A healthy full-repo install captured ~12 KB, well under spawnSync's default buffer, and left the tree clean. biome check on both new files is clean.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes

This run re-reviewed the delta since the prior pullfrog review (8e8aeff), which had approved a wrapper-script approach:

• Dropped the refresh wrapper — scripts/nub-install-refresh-lockfile.js and its Vitest spec are removed (-219/-226 on the commit).
• Native lockfile refresh — the autofix job now runs nub install --lockfile-only in a Refresh lockfile step before the normal nub install, so autofix.ci commits the re-resolved nub.lock.

I verified the load-bearing behavior directly against the pinned Nub 0.9.3:

• Control: a drifted manifest makes CI=1 nub install exit 16 with ERR_NUB_OUTDATED_LOCKFILE.
• CI=1 nub install --lockfile-only on that same drift exits 0 and rewrites nub.lock; the following frozen CI=1 nub install then exits 0 ("skipped node_modules linking" on the lockfile-only pass).
• A healthy tree is no-churn ("Lockfile is up to date, resolution step is skipped"), so healthy PRs and pushes to dev/v1 produce no spurious commit.
• Nub's install docs list --lockfile-only as an accepted pnpm-shaped flag.

The simplification is behaviorally sound and drops ~220 lines of indirection and its tests.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}