Fix bun.lockb prerelease order in hash check (#739)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #739

Summary

Some valid bun.lockb files were refused with "package metadata hash does not match the lockfile". This happened whenever the lock held a release and a prerelease of the same version (for example uuid@8.0.0 and uuid@8.0.0-beta.0). Those locks are now accepted, so hosted and vendored modes can patch these projects. Before this change, hosted mode patched nothing and still exited 0, vendored mode failed, and bun install never helped, because Bun's stored hash was valid all along.

Root cause

BunLockb::meta_hash (crates/socket-patch-core/src/vendor/bun_lockb.rs) recomputes Bun's package metadata hash before any edit, and hash_style refuses the lock when no dialect matches. The recomputation sorts packages by name and then by version. When two versions shared major.minor.patch and only one had a prerelease tag, the code compared the prerelease fields as strings, which put the release ("") first. Bun's Version.orderWithoutTag puts the prerelease first, as semver precedence does. Real locks from Bun 0.8.1, 1.0.0, 1.1.45 and 1.3.14 confirm Bun's order, in both the legacy and the current hash dialect.

Change

• One added comparison in the meta_hash sort: a prerelease sorts before its release, in every dialect. Ordering between two prereleases is unchanged.
• New fixtures tests/fixtures/bun-lockb/prerelease-pair-{0.8.1,1.0.0,1.1.45,1.3.14}. These are real Bun-written locks (Linux x64) with provenance.json, documented in the fixtures README. Their VEX-discovery goldens were regenerated with SOCKET_PATCH_UPDATE_GOLDEN=1; each lists its three registry packages and nothing else.
• New prerelease shape in the real-Bun e2e_bun_lockb extended matrix: hosted scan, frozen install, VEX and vendored round trip on a project carrying the pair. CI already runs it on Bun 1.0.36 and 1.1.45.

Test evidence

Issue	Test	Without fix	With fix
#739	vendor::bun_lockb::tests::release_and_same_triple_prerelease_keep_a_valid_metahash (all 4 writers)	FAIL: package metadata hash does not match the lockfile	pass
#739	e2e_bun_lockb::native_binary_alias_and_transitive, prerelease shape (real Bun)	FAIL on Bun 1.1.45: hosted scan status: success, redirected: 0 (the issue's fail-open)	pass on Bun 1.0.0, 1.1.45, 1.3.14

CI: every workflow on 0b1a2ae is green (CI, Bun, npm, pnpm, vlt and Composer compatibility, Benchmarks, Audit GHA Workflows). Cursor Bugbot reviewed 0b1a2ae and found no issues. The earlier red test/coverage runs on 9d2047b were the VEX golden corpus missing the new fixtures; 0b1a2ae fixes that.

Local gate:

• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test --workspace --all-features --no-fail-fast: 214 test binaries pass, including the VEX golden. 12 tests fail locally only: they force write failures with read-only permissions (*_write_failure_*, unremovable-file and copy_tree permission cases), which the root-run sandbox ignores. None involves the Bun codec, and all pass in CI.
• cargo fmt --check: no new diffs. main already has unrelated fmt drift, and CI has no fmt step.
• No wrapper changes (npm/, pypi/, gem/): the fix is entirely inside the Rust lock codec.

🤖 Generated with Claude Code

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 0b1a2ae. Configure here.}

[Mikola Lysenko (mikolalysenko)]

[burn-down agent] Ready for review at head 0b1a2ae.

• CI: 96/96 check runs green on 0b1a2ae. 4 matrix templates are skipped, as on every PR.
• Bugbot: reviewed 0b1a2ae, no findings. The only earlier review, on 9d2047b, is stale and had no open findings. No unresolved review threads.
• Mergeable, no conflicts with main.
• Reviewer focus: the one-line prerelease-before-release tiebreak in BunLockb::meta_hash (crates/socket-patch-core/src/vendor/bun_lockb.rs), and the four real Bun-written prerelease-pair-* fixtures that pin the ordering.

---

Generated by Claude Code