critique

MEDIUM

maintainer roehistat 1 votes scanned 2026-09-27 17:19:13.301701

View on AUR

Why flagged

`bun add` / `bun install <package>` fetches an external package outside source=(). Severity downgraded: the package declares/looks like a Node.js consumer.

Triggered rules

Medium bun install of an undeclared external package bun_install_external

`bun add` / `bun install <package>` fetches an external package outside source=(). Severity downgraded: the package declares/looks like a Node.js consumer.

PKGBUILD:30 bun install --frozen-lockfile --linker isolated

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: roehistat <mail at iyxeyl.me>
    
      2
    
      3pkgname=critique
    
      4pkgver=0.2.1
    
      5pkgrel=1
    
      6pkgdesc="A beautiful terminal UI for reviewing git diffs with syntax highlighting"
    
      7arch=(x86_64)
    
      8url="https://github.com/remorses/critique"
    
      9license=('MIT')
    
      10depends=(git)
    
      11makedepends=(bun)
    
      12options=('!strip' '!debug')
    
      13
    
      14source=("$pkgname::git+$url.git#tag=$pkgname@$pkgver")
    
      15sha256sums=('7dcf7bd95b2a26a3d38d9590b23a641d3352cce329c0ba0c8e93f802de6a78ec')
    
      16
    
      17prepare() {
    
      18  cd "$pkgname"
    
      19
    
      20  # PDF export reads the font from a path relative to the entry point, which in
    
      21  # a compiled executable is the bunfs root (where the --asset below lands)
    
      22  sed -i \
    
      23    's|join(import.meta.dir, "..", "public", "jetbrains-mono-nerd.ttf")|join(import.meta.dir, "jetbrains-mono-nerd.ttf")|g' \
    
      24    cli/src/cli.tsx
    
      25  [[ $(grep -c 'join(import.meta.dir, "jetbrains-mono-nerd.ttf")' cli/src/cli.tsx) -eq 3 ]]
    
      26}
    
      27
    
      28build() {
    
      29  cd "$pkgname"
    
      30  bun install --frozen-lockfile --linker isolated
    
      31
    
      32  # @parcel/watcher picks its prebuilt native module with a dynamic require()
    
      33  # that a compiled executable cannot resolve; pin the glibc build instead
    
      34  local watcher
    
      35  watcher=$(readlink -f cli/node_modules/@parcel/watcher)
    
      36  sed -i \
    
      37    's|binding = require(name);|binding = require("@parcel/watcher-linux-x64-glibc");|' \
    
      38    "$watcher/index.js"
    
      39  grep -q 'require("@parcel/watcher-linux-x64-glibc")' "$watcher/index.js"
    
      40
    
      41  # the tree-sitter worker is spawned by its bunfs path, so build it as an
    
      42  # entry point at the bunfs root with a resolvable web-tree-sitter next to it
    
      43  local takumi webtree worker
    
      44  takumi=$(readlink -f cli/node_modules/@takumi-rs/core/../../@takumi-rs/core-linux-x64-gnu/core.linux-x64-gnu.node)
    
      45  webtree=$(readlink -f cli/node_modules/@opentuah/core/../../web-tree-sitter)
    
      46  worker=$(readlink -f cli/node_modules/@opentuah/core/parser.worker.js)
    
      47  [[ -f $takumi && -d $webtree && -f $worker ]] || return 1
    
      48
    
      49  cp -L "$worker" parser.worker.js
    
      50  ln -sfn "$webtree" node_modules/web-tree-sitter
    
      51
    
      52  bun build --compile \
    
      53    cli/src/cli.tsx \
    
      54    parser.worker.js \
    
      55    --asset cli/src/queries/json/highlights.scm \
    
      56    --asset cli/src/parsers/tree-sitter-prisma.wasm \
    
      57    --asset cli/public/jetbrains-mono-nerd.ttf \
    
      58    --asset "$takumi" \
    
      59    --outfile dist/critique
    
      60}
    
      61
    
      62check() {
    
      63  cd "$pkgname"
    
      64  local output
    
      65  output=$(./dist/critique --version)
    
      66  [[ $output == "critique/$pkgver"* ]]
    
      67}
    
      68
    
      69package() {
    
      70  cd "$pkgname"
    
      71  install -Dm755 dist/critique "$pkgdir/usr/bin/critique"
    
      72}
    
      73

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-09-27 17:19
@@ -1,26 +1,73 @@
 # Maintainer: roehistat <mail at iyxeyl.me>
 
 pkgname=critique
-pkgver=0.1.140
+pkgver=0.2.1
 pkgrel=1
 pkgdesc="A beautiful terminal UI for reviewing git diffs with syntax highlighting"
 arch=(x86_64)
 url="https://github.com/remorses/critique"
 license=('MIT')
-depends=(bun git)
+depends=(git)
+makedepends=(bun)
 options=('!strip' '!debug')
 
-source=("$pkgname::git+$url.git#tag=$pkgname@$pkgver" "critique.sh")
-sha256sums=('640999d1c662b18dd2dfeff8e0ed8bdd2a4d677677312c0433822747eb1ebd48'
-            'da25b3c236a78420d4ae39c1993183d5e6a1ae601a47f3367a2d960034a6397f')
+source=("$pkgname::git+$url.git#tag=$pkgname@$pkgver")
+sha256sums=('7dcf7bd95b2a26a3d38d9590b23a641d3352cce329c0ba0c8e93f802de6a78ec')
+
+prepare() {
+  cd "$pkgname"
+
+  # PDF export reads the font from a path relative to the entry point, which in
+  # a compiled executable is the bunfs root (where the --asset below lands)
+  sed -i \
+    's|join(import.meta.dir, "..", "public", "jetbrains-mono-nerd.ttf")|join(import.meta.dir, "jetbrains-mono-nerd.ttf")|g' \
+    cli/src/cli.tsx
+  [[ $(grep -c 'join(import.meta.dir, "jetbrains-mono-nerd.ttf")' cli/src/cli.tsx) -eq 3 ]]
+}
+
+build() {
+  cd "$pkgname"
+  bun install --frozen-lockfile --linker isolated
+
+  # @parcel/watcher picks its prebuilt native module with a dynamic require()
+  # that a compiled executable cannot resolve; pin the glibc build instead
+  local watcher
+  watcher=$(readlink -f cli/node_modules/@parcel/watcher)
+  sed -i \
+    's|binding = require(name);|binding = require("@parcel/watcher-linux-x64-glibc");|' \
+    "$watcher/index.js"
+  grep -q 'require("@parcel/watcher-linux-x64-glibc")' "$watcher/index.js"
+
+  # the tree-sitter worker is spawned by its bunfs path, so build it as an
+  # entry point at the bunfs root with a resolvable web-tree-sitter next to it
+  local takumi webtree worker
+  takumi=$(readlink -f cli/node_modules/@takumi-rs/core/../../@takumi-rs/core-linux-x64-gnu/core.linux-x64-gnu.node)
+  webtree=$(readlink -f cli/node_modules/@opentuah/core/../../web-tree-sitter)
+  worker=$(readlink -f cli/node_modules/@opentuah/core/parser.worker.js)
+  [[ -f $takumi && -d $webtree && -f $worker ]] || return 1
+
+  cp -L "$worker" parser.worker.js
+  ln -sfn "$webtree" node_modules/web-tree-sitter
+
+  bun build --compile \
+    cli/src/cli.tsx \
+    parser.worker.js \
+    --asset cli/src/queries/json/highlights.scm \
+    --asset cli/src/parsers/tree-sitter-prisma.wasm \
+    --asset cli/public/jetbrains-mono-nerd.ttf \
+    --asset "$takumi" \
+    --outfile dist/critique
+}
+
+check() {
+  cd "$pkgname"
+  local output
+  output=$(./dist/critique --version)
+  [[ $output == "critique/$pkgver"* ]]
+}
 
 package() {
-  cd "$srcdir/$pkgname"
-  bun install --frozen-lockfile
-
-  mkdir -p "$pkgdir/usr/lib/critique"
-  cp -r . "$pkgdir/usr/lib/critique/"
-
-  install -Dm755 "$srcdir/critique.sh" "$pkgdir/usr/bin/critique"
+  cd "$pkgname"
+  install -Dm755 dist/critique "$pkgdir/usr/bin/critique"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-27 17:19:13	Medium	1
2026-06-18 16:11:54	Clean	0