From 202a1cb11e519b77423d1b769a3d0f2d514e3fb7 Mon Sep 17 00:00:00 2001
From: Tom Boucher <trekkie@nomorestars.com>
Date: Mon, 13 Apr 2026 08:37:59 -0400
Subject: [PATCH] fix(ci): regenerate package-lock.json during version bump
 (#4116)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

bump-version.mjs was updating package.json and sub-packages but never
regenerating package-lock.json, causing the lockfile to drift behind
by one version on every release.

Adds `npm install --package-lock-only` as the final step so the lockfile
is always in sync with the version being committed. Also regenerates the
current lockfile to fix the existing 2.58.0 → 2.64.0 drift.

Closes #4115

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 package-lock.json        | 6 +++---
 scripts/bump-version.mjs | 5 +++++
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 47e4a1876..9a69520aa 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "gsd-pi",
-  "version": "2.68.0",
+  "version": "2.72.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "gsd-pi",
-      "version": "2.68.0",
+      "version": "2.72.0",
       "hasInstallScript": true,
       "license": "MIT",
       "workspaces": [
@@ -9535,7 +9535,7 @@
     },
     "packages/pi-coding-agent": {
       "name": "@gsd/pi-coding-agent",
-      "version": "2.68.0",
+      "version": "2.72.0",
       "dependencies": {
         "@mariozechner/jiti": "^2.6.2",
         "@silvia-odwyer/photon-node": "^0.3.4",
diff --git a/scripts/bump-version.mjs b/scripts/bump-version.mjs
index 77be226c1..35595290c 100644
--- a/scripts/bump-version.mjs
+++ b/scripts/bump-version.mjs
@@ -37,3 +37,8 @@ execSync("node native/scripts/sync-platform-versions.cjs", { cwd: root, stdio: "
 
 // 4. Sync pkg/package.json (reads from pi-coding-agent)
 execSync("node scripts/sync-pkg-version.cjs", { cwd: root, stdio: "inherit" });
+
+// 5. Regenerate package-lock.json to match the new version.
+//    --package-lock-only updates the lockfile in-place without touching node_modules.
+execSync("npm install --package-lock-only", { cwd: root, stdio: "inherit" });
+console.log(`[bump-version] package-lock.json regenerated at ${newVersion}`);