feat: support parsing bun.lock files

.prettierignore

@@ -1,3 +1,4 @@
+**/fixtures/bun/*.json5
 **/fixtures/pnpm/*.yaml
 **/fixtures/**/invalid.json
 **/fixtures/configs-invalid/*.yaml

README.md

@@ -59,6 +59,7 @@ The detector supports parsing the following lockfiles:
 | `packages.lock.json`          | `NuGet`     | `dotnet`   |
 | `package-lock.json`           | `npm`       | `npm`      |
 | `yarn.lock`                   | `npm`       | `yarn`     |
+| `bun.lock`                    | `npm`       | `bun`      |
 | `pnpm-lock.yaml`              | `npm`       | `pnpm`     |
 | `composer.lock`               | `Packagist` | `composer` |
 | `Gemfile.lock`                | `RubyGems`  | `bundler`  |

go.mod

@@ -6,6 +6,7 @@ require (
 	github.com/BurntSushi/toml v1.3.2
 	github.com/fatih/color v1.16.0
 	github.com/google/go-cmp v0.6.0
+	github.com/tidwall/jsonc v0.3.2
 	golang.org/x/mod v0.14.0
 	gopkg.in/yaml.v3 v3.0.1
 )

go.sum

@@ -9,6 +9,8 @@ github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovk
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/tidwall/jsonc v0.3.2 h1:ZTKrmejRlAJYdn0kcaFqRAKlxxFIC21pYq8vLa4p2Wc=
+github.com/tidwall/jsonc v0.3.2/go.mod h1:dw+3CIxqHi+t8eFSpzzMlcVYxKp08UP5CD8/uSFCyJE=
 golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
 golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

main_test.go

@@ -158,6 +158,7 @@ func TestRun(t *testing.T) {
 			wantStderr: `
 				Don't know how to parse files as "my-file" - supported values are:
 					buildscript-gradle.lockfile
+          bun.lock
 					Cargo.lock
 					composer.lock
 					Gemfile.lock

pkg/lockfile/ecosystems_test.go

@@ -34,11 +34,11 @@ func TestKnownEcosystems(t *testing.T) {
 
 	expectedCount := numberOfLockfileParsers(t)
 
-	// - npm, yarn, and pnpm,
+	// - npm, yarn, bun, and pnpm,
 	// - pip, poetry, pdm and pipenv,
 	// - maven and gradle,
 	// all use the same ecosystem so "ignore" those parsers in the count
-	expectedCount -= 6
+	expectedCount -= 7
 
 	ecosystems := lockfile.KnownEcosystems()
 

pkg/lockfile/fixtures/bun/alias.json5

@@ -0,0 +1,21 @@
+{
+  "lockfileVersion": 0,
+  "workspaces": {
+    "": {
+      "name": "bun-lockfile",
+      "dependencies": {
+        "supports-color": "^7.0.0",
+        "supports-color-old": "npm:supports-color@^6.0.0",
+      },
+    },
+  },
+  "packages": {
+    "has-flag": ["[email protected]", "", {}, "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ=="],
+
+    "supports-color": ["[email protected]", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw=="],
+
+    "supports-color-old": ["[email protected]", "", { "dependencies": { "has-flag": "^3.0.0" } }, "sha512-qe1jfm1Mg7Nq/NSh6XE24gPXROEVsWHxC1LIx//XNlD9iw7YZQGjZNjYN7xGaEG6iKdA8EtNFW6R0gjnVXp+wQ=="],
+
+    "supports-color-old/has-flag": ["[email protected]", "", {}, "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw=="],
+  }
+}

pkg/lockfile/fixtures/bun/bad-tuple.json5

@@ -0,0 +1,16 @@
+{
+  "lockfileVersion": 0,
+  "workspaces": {
+    "": {
+      "name": "bun-lockfile",
+      "dependencies": {
+        "wrappy": "^1.0.0",
+      },
+    },
+  },
+  "packages": {
+    "wrappy-bad1": [123, "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="],
+    "wrappy": ["[email protected]", "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="],
+    "wrappy-bad2": [{}, "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="],
+  }
+}

pkg/lockfile/fixtures/bun/blog-sample.json5

@@ -0,0 +1,13 @@
+{
+  "lockfileVersion": 0,
+  "workspaces": {
+    "": {
+      "dependencies": {
+        "uWebSocket.js": "uNetworking/uWebSockets.js#v20.51.0",
+      },
+    },
+  },
+  "packages": {
+    "uWebSocket.js": ["uWebSockets.js@github:uNetworking/uWebSockets.js#6609a88", {}, "uNetworking-uWebSockets.js-6609a88"],
+  }
+}

pkg/lockfile/fixtures/bun/commits.json5

@@ -0,0 +1,58 @@
+{
+  "lockfileVersion": 0,
+  "workspaces": {
+    "": {
+      "name": "bun-lockfile",
+      "dependencies": {
+        "lodash": "^1.2.1",
+        "stopwords": "0.0.1",
+      },
+      "devDependencies": {
+        "@prettier/sync": "github:prettier/prettier-synchronized",
+        "babel-preset-php": "gitlab:kornelski/babel-preset-php#master",
+        "is-number-1": "https://github.com/jonschlinkert/is-number.git",
+        "is-number-2": "https://github.com/jonschlinkert/is-number.git#d5ac058",
+        "is-number-3": "https://github.com/jonschlinkert/is-number.git#2.0.0",
+        "raven-js": "getsentry/raven-js#3.23.1",
+        "slick-carousel": "git://github.com/brianfryer/slick",
+      },
+    },
+  },
+  "packages": {
+    "@babel/helper-plugin-utils": ["@babel/[email protected]", "", {}, "sha512-RS+jZcRdZdRFzMyr+wcsaqOmld1/EqTghfaBGQQd/WnRdzdlvSZ//kF7U8VQTxf1ynZ4cjUcYgjVGx13ewNPMg=="],
+
+    "@babel/helper-string-parser": ["@babel/[email protected]", "", {}, "sha512-4A/SCr/2KLd5jrtOMFzaKjVtAei3+2r/NChoBNoZ3EyP/+GlhoaEGoWOZUmFmoITP7zOJyHIMm+DYRd8o3PvHA=="],
+
+    "@babel/helper-validator-identifier": ["@babel/[email protected]", "", {}, "sha512-Ed61U6XJc3CVRfkERJWDz4dJwKe7iLmmJsbOGu9wSloNSFttHV0I8g6UAgb7qnK5ly5bGLPd4oXZlxCdANBOWQ=="],
+
+    "@babel/parser": ["@babel/[email protected]", "", { "dependencies": { "@babel/types": "^7.26.5" }, "bin": "./bin/babel-parser.js" }, "sha512-SRJ4jYmXRqV1/Xc+TIVG84WjHBXKlxO9sHQnA2Pf12QQEAp1LOh6kDzNHXcUnbH1QI0FDoPPVOt+vyUDucxpaw=="],
+
+    "@babel/types": ["@babel/[email protected]", "", { "dependencies": { "@babel/helper-string-parser": "^7.25.9", "@babel/helper-validator-identifier": "^7.25.9" } }, "sha512-L6mZmwFDK6Cjh1nRCLXpa6no13ZIioJDz7mdkzHv399pThrTa/k0nUlNaenOeh2kWu/iaOQYElEpKPUswUa9Vg=="],
+
+    "@prettier/sync": ["@prettier/sync@github:prettier/prettier-synchronized#527e8ce", { "dependencies": { "make-synchronized": "^0.2.8" }, "peerDependencies": { "prettier": "*" } }, "prettier-prettier-synchronized-527e8ce"],
+
+    "babel-preset-php": ["babel-preset-php@git+ssh://gitlab:kornelski/babel-preset-php#1ae6dc1267500360b411ec711b8aeac8c68b2246", { "dependencies": { "@babel/helper-plugin-utils": "^7.8.3", "@babel/parser": "^7.8.4", "php-parser": "^2.2.0" } }, "1ae6dc1267500360b411ec711b8aeac8c68b2246"],
+
+    "is-number-1": ["is-number@github:jonschlinkert/is-number#98e8ff1", {}, "jonschlinkert-is-number-98e8ff1"],
+
+    "is-number-2": ["is-number@github:jonschlinkert/is-number#d5ac058", {}, "jonschlinkert-is-number-d5ac058"],
+
+    "is-number-3": ["is-number@github:jonschlinkert/is-number#b7aef34", {}, "jonschlinkert-is-number-b7aef34"],
+
+    "jquery": ["[email protected]", "", {}, "sha512-m4avr8yL8kmFN8psrbFFFmB/If14iN5o9nw/NgnnM+kybDJpRsAynV2BsfpTYrTRysYUdADVD7CkUUizgkpLfg=="],
+
+    "lodash": ["[email protected]", "", {}, "sha512-F7AB8u+6d00CCgnbjWzq9fFLpzOMCgq6mPjOW4+8+dYbrnc0obRrC+IHctzfZ1KKTQxX0xo/punrlpOWcf4gpw=="],
+
+    "make-synchronized": ["[email protected]", "", {}, "sha512-4wczOs8SLuEdpEvp3vGo83wh8rjJ78UsIk7DIX5fxdfmfMJGog4bQzxfvOwq7Q3yCHLC4jp1urPHIxRS/A93gA=="],
+
+    "php-parser": ["[email protected]", "", {}, "sha512-zwPZ5fN7Bw+6Od1EMC8JEON/F/nRDEwIGxFoFsssU+c8aTIlu+13JjmnXsNt+Cnsqn8A7Lvy3O8MMGAlsMO8jA=="],
+
+    "prettier": ["[email protected]", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-e9MewbtFo+Fevyuxn/4rrcDAaq0IYxPGLvObpQjiZBMAzB9IGmzlnG9RZy3FFas+eBMu2vA0CszMeduow5dIuQ=="],
+
+    "raven-js": ["raven-js@github:getsentry/raven-js#91ef2d4", {}, "getsentry-sentry-javascript-91ef2d4"],
+
+    "slick-carousel": ["slick-carousel@github:brianfryer/slick#fc6f7d8", { "peerDependencies": { "jquery": ">=1.8.0" } }, "brianfryer-slick-fc6f7d8"],
+
+    "stopwords": ["[email protected]", "", {}, "sha512-7YdkaV8Z9eg5zEz6/z4B7Nm3e1nQuOxAW6V/k+mzdVAuxNfBo9PgfXTlQ1iwBPEwrfY0rI2cfVcNkBxhgj05ZA=="],
+  }
+}

pkg/lockfile/fixtures/bun/empty.json5

@@ -0,0 +1 @@
+{}

pkg/lockfile/fixtures/bun/files.json5

@@ -0,0 +1,19 @@
+{
+  "lockfileVersion": 0,
+  "workspaces": {
+    "": {
+      "name": "bun-lockfile",
+      "dependencies": {
+        "lodash": "^1.2.1",
+      },
+      "devDependencies": {
+        "etag": "file:./deps/etag",
+      },
+    },
+  },
+  "packages": {
+    "etag": ["etag@file:deps/etag", {}],
+
+    "lodash": ["[email protected]", "", {}, "sha512-F7AB8u+6d00CCgnbjWzq9fFLpzOMCgq6mPjOW4+8+dYbrnc0obRrC+IHctzfZ1KKTQxX0xo/punrlpOWcf4gpw=="],
+  }
+}

pkg/lockfile/fixtures/bun/nested-dependencies-dup.json5

@@ -0,0 +1,30 @@
+{
+  "lockfileVersion": 0,
+  "workspaces": {
+    "": {
+      "name": "bun-lockfile",
+      "dependencies": {
+        "has-flag": "^2.0.0",
+        "supports-color": "^7.0.0",
+      },
+      "devDependencies": {
+        "chalk": "^4.0.0",
+      },
+    },
+  },
+  "packages": {
+    "ansi-styles": ["[email protected]", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
+
+    "chalk": ["[email protected]", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
+
+    "color-convert": ["[email protected]", "", { "dependencies": { "color-name": "~1.1.4" } }, "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ=="],
+
+    "color-name": ["[email protected]", "", {}, "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="],
+
+    "has-flag": ["[email protected]", "", {}, "sha512-P+1n3MnwjR/Epg9BBo1KT8qbye2g2Ou4sFumihwt6I4tsUX7jnLcX4BTOSKg/B1ZrIYMN9FcEnG4x5a7NB8Eng=="],
+
+    "supports-color": ["[email protected]", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw=="],
+
+    "supports-color/has-flag": ["[email protected]", "", {}, "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ=="],
+  }
+}

pkg/lockfile/fixtures/bun/nested-dependencies.json5

@@ -0,0 +1,34 @@
+{
+  "lockfileVersion": 0,
+  "workspaces": {
+    "": {
+      "name": "bun-lockfile",
+      "dependencies": {
+        "has-flag": "^2.0.0",
+        "supports-color": "^5.0.0",
+      },
+      "devDependencies": {
+        "chalk": "^4.0.0",
+      },
+    },
+  },
+  "packages": {
+    "ansi-styles": ["[email protected]", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
+
+    "chalk": ["[email protected]", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
+
+    "color-convert": ["[email protected]", "", { "dependencies": { "color-name": "~1.1.4" } }, "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ=="],
+
+    "color-name": ["[email protected]", "", {}, "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="],
+
+    "has-flag": ["[email protected]", "", {}, "sha512-P+1n3MnwjR/Epg9BBo1KT8qbye2g2Ou4sFumihwt6I4tsUX7jnLcX4BTOSKg/B1ZrIYMN9FcEnG4x5a7NB8Eng=="],
+
+    "supports-color": ["[email protected]", "", { "dependencies": { "has-flag": "^3.0.0" } }, "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow=="],
+
+    "chalk/supports-color": ["[email protected]", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw=="],
+
+    "supports-color/has-flag": ["[email protected]", "", {}, "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw=="],
+
+    "chalk/supports-color/has-flag": ["[email protected]", "", {}, "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ=="],
+  }
+}

pkg/lockfile/fixtures/bun/no-packages.json5

@@ -0,0 +1,6 @@
+{
+  "lockfileVersion": 0,
+  "workspaces": {
+    "": {},
+  },
+}

pkg/lockfile/fixtures/bun/not-json.txt

@@ -0,0 +1 @@
+this is not json!

pkg/lockfile/fixtures/bun/one-package-dev.json5

@@ -0,0 +1,14 @@
+{
+  "lockfileVersion": 0,
+  "workspaces": {
+    "": {
+      "name": "bun-lockfile",
+      "dependencies": {
+        "wrappy": "^1.0.0",
+      },
+    },
+  },
+  "packages": {
+    "wrappy": ["[email protected]", "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="],
+  }
+}

pkg/lockfile/fixtures/bun/one-package.json5

@@ -0,0 +1,14 @@
+{
+  "lockfileVersion": 0,
+  "workspaces": {
+    "": {
+      "name": "bun-lockfile",
+      "dependencies": {
+        "wrappy": "^1.0.0",
+      },
+    },
+  },
+  "packages": {
+    "wrappy": ["[email protected]", "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="],
+  }
+}

pkg/lockfile/fixtures/bun/optional-package.json5

@@ -0,0 +1,21 @@
+{
+  "lockfileVersion": 0,
+  "workspaces": {
+    "": {
+      "name": "bun-lockfile",
+      "dependencies": {
+        "acorn": "*",
+      },
+      "optionalDependencies": {
+        "fsevents": "0.3.8",
+      },
+    },
+  },
+  "packages": {
+    "acorn": ["[email protected]", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-cl669nCJTZBsL97OF4kUQm5g5hC2uihk0NxY3WENAC0TYdILVkAyHymAntgxGkl7K+t0cXIrH5siy5S4XkFycA=="],
+
+    "fsevents": ["[email protected]", "", { "dependencies": { "nan": "^2.0.2" }, "os": "darwin" }, "sha512-3vlmn1QaPoqSnhnorLFlp3+r3dUCZ8eZlaew+H8QhqB+0YBc9HSITh9wiZo76KYYExTC9DwG6otE/OzwbBLVIw=="],
+
+    "nan": ["[email protected]", "", {}, "sha512-nbajikzWTMwsW+eSsNm3QwlOs7het9gGJU5dDZzRTQGk03vyBOauxgI4VakDzE0PtsGTmXPsXTbbjVhRwR5mpw=="],
+  }
+}

pkg/lockfile/fixtures/bun/peer-dependencies-explicit.json5

@@ -0,0 +1,17 @@
+{
+  "lockfileVersion": 0,
+  "workspaces": {
+    "": {
+      "name": "bun-lockfile",
+      "dependencies": {
+        "acorn": "*",
+        "acorn-jsx": "*",
+      },
+    },
+  },
+  "packages": {
+    "acorn": ["[email protected]", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-cl669nCJTZBsL97OF4kUQm5g5hC2uihk0NxY3WENAC0TYdILVkAyHymAntgxGkl7K+t0cXIrH5siy5S4XkFycA=="],
+
+    "acorn-jsx": ["[email protected]", "", { "peerDependencies": { "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0" } }, "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ=="],
+  }
+}

pkg/lockfile/fixtures/bun/peer-dependencies-implicit.json5

@@ -0,0 +1,16 @@
+{
+  "lockfileVersion": 0,
+  "workspaces": {
+    "": {
+      "name": "bun-lockfile",
+      "dependencies": {
+        "acorn-jsx": "*",
+      },
+    },
+  },
+  "packages": {
+    "acorn": ["[email protected]", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-cl669nCJTZBsL97OF4kUQm5g5hC2uihk0NxY3WENAC0TYdILVkAyHymAntgxGkl7K+t0cXIrH5siy5S4XkFycA=="],
+
+    "acorn-jsx": ["[email protected]", "", { "peerDependencies": { "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0" } }, "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ=="],
+  }
+}

pkg/lockfile/fixtures/bun/same-package-different-groups.json5

@@ -0,0 +1,19 @@
+{
+  "lockfileVersion": 0,
+  "workspaces": {
+    "": {
+      "name": "bun-lockfile",
+      "dependencies": {
+        "supports-color": "^5.0.0",
+      },
+      "devDependencies": {
+        "has-flag": "^3.0.0",
+      },
+    },
+  },
+  "packages": {
+    "has-flag": ["[email protected]", "", {}, "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw=="],
+
+    "supports-color": ["[email protected]", "", { "dependencies": { "has-flag": "^3.0.0" } }, "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow=="],
+  }
+}

pkg/lockfile/fixtures/bun/scoped-packages-mixed.json5

@@ -0,0 +1,25 @@
+{
+  "lockfileVersion": 0,
+  "workspaces": {
+    "": {
+      "name": "bun-lockfile",
+      "dependencies": {
+        "@babel/code-frame": "^7.0.0",
+      },
+      "devDependencies": {
+        "wrappy": "^1.0.0",
+      },
+    },
+  },
+  "packages": {
+    "@babel/code-frame": ["@babel/[email protected]", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.25.9", "js-tokens": "^4.0.0", "picocolors": "^1.0.0" } }, "sha512-RJlIHRueQgwWitWgF8OdFYGZX328Ax5BCemNGlqHfplnRT9ESi8JkFlvaVYbS+UubVY6dpv87Fs2u5M29iNFVQ=="],
+
+    "@babel/helper-validator-identifier": ["@babel/[email protected]", "", {}, "sha512-Ed61U6XJc3CVRfkERJWDz4dJwKe7iLmmJsbOGu9wSloNSFttHV0I8g6UAgb7qnK5ly5bGLPd4oXZlxCdANBOWQ=="],
+
+    "js-tokens": ["[email protected]", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
+
+    "picocolors": ["[email protected]", "", {}, "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="],
+
+    "wrappy": ["[email protected]", "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="],
+  }
+}