vesktop-bun

LOW

maintainer School 0 votes scanned 2026-10-23 00:02:19.781852

View on AUR

Why flagged

This is a legitimate Vesktop/Vencord build from the official GitHub source, using bun instead of pnpm; the 'bun install' installs the project's own declared workspace dependencies from the migrated lockfile, not arbitrary external packages, and all sources have pinned checksums.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): This is a legitimate Vesktop/Vencord build from the official GitHub source, using bun instead of pnpm; the 'bun install' installs the project's own declared workspace dependencies from the migrated lockfile, not arbitrary external packages, and all sources have pinned checksums.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium bun install of an undeclared external package bun_install_external

`bun add` / `bun install <package>` fetches an external package outside source=(). Severity downgraded: the package declares/looks like a Node.js consumer.

PKGBUILD:53 bun install --frozen-lockfile --linker hoisted

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sierra S. <sscoolqaz@protonmail.com>
    
      2# Contributor: edu4rdshl <edu4rdshl@protonmail.com>
    
      3_pkgname=Vesktop
    
      4pkgname=vesktop-bun
    
      5pkgdesc="A standalone Electron-based Discord app with Vencord & improved Linux support (built with bun)"
    
      6pkgver=1.6.8
    
      7pkgrel=1
    
      8
    
      9arch=("x86_64" "aarch64")
    
      10url="https://github.com/Vencord/Vesktop"
    
      11license=('GPL-3.0-or-later')
    
      12
    
      13depends=('alsa-lib' 'glib2' 'gtk3' 'nss')
    
      14makedepends=('bun' 'nodejs' 'jq' 'python')
    
      15optdepends=(
    
      16  'libnotify: Notifications'
    
      17  'xdg-utils: Open links, files, etc'
    
      18)
    
      19provides=("vesktop=$pkgver")
    
      20conflicts=('vesktop' 'vesktop-bin')
    
      21
    
      22source=("$_pkgname-$pkgver.tar.gz::https://github.com/Vencord/Vesktop/archive/v${pkgver}.tar.gz" "vesktop.desktop" "vesktop.sh")
    
      23
    
      24sha256sums=('91dd4630fb5fff153586056451a9587f4c5fbeb048c6d570a35056460415f22f'
    
      25            '98fa8f661b065c2d825e24f0055a40ae01d58d23628ad7ebf6914296209dd43c'
    
      26            'c17c193d4e35188916a8032505fa1c42b994309b9666d90a72d91f2ceac77752')
    
      27
    
      28prepare() {
    
      29  cd "$srcdir/$_pkgname-$pkgver"
    
      30
    
      31  # packageManager pins pnpm, which makes electron-builder look for pnpm.
    
      32  # bun can't migrate pnpm's relative link: deps (oven-sh/bun#23026). libvesktop
    
      33  # is only a type import there; bun still builds it from source as a workspace
    
      34  # (node-gyp), and scripts/build/build.mts picks up that local build.
    
      35  sed -i '/^      libvesktop:$/,+2d' pnpm-lock.yaml
    
      36  jq 'del(.devDependencies.libvesktop, .packageManager)
    
      37      | .trustedDependencies = ["electron", "esbuild", "@vencord/venmic"]' \
    
      38    package.json > package.json.new
    
      39  mv package.json.new package.json
    
      40
    
      41  # Keep upstream's pinned versions by migrating pnpm-lock.yaml to bun.lock.
    
      42  bun pm migrate
    
      43  # github: deps carry pnpm's codeload tarball hash, which never matches the
    
      44  # tarball bun fetches. They stay pinned by commit, so drop the hash.
    
      45  sed -i -E '/^    "[^"]+": \["[^"]+@github:/ s/, "sha512-[^"]*"\],$/],/' bun.lock
    
      46}
    
      47
    
      48build() {
    
      49  cd "$srcdir/$_pkgname-$pkgver"
    
      50
    
      51  # Upstream installs with pnpm's nodeLinker=hoisted; bun's default isolated
    
      52  # linker hides app-builder-lib from scripts/build/sandboxFix.mjs.
    
      53  bun install --frozen-lockfile --linker hoisted
    
      54  bun run build
    
      55  bun x electron-builder --dir
    
      56}
    
      57
    
      58package() {
    
      59  cd "$srcdir/$_pkgname-$pkgver"
    
      60
    
      61  case "${CARCH}" in
    
      62    "aarch64") folder="linux-arm64-unpacked" ;;
    
      63    *) folder="linux-unpacked" ;;
    
      64  esac
    
      65
    
      66  install -d "$pkgdir/usr/lib/vesktop"
    
      67  cp -R "dist/${folder}/." "$pkgdir/usr/lib/vesktop"
    
      68
    
      69  install -Dm644 "../vesktop.desktop" "$pkgdir/usr/share/applications/vesktop.desktop"
    
      70  install -Dm644 "LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      71  install -Dm644 "build/icon.svg" "$pkgdir/usr/share/icons/hicolor/scalable/apps/vesktop.svg"
    
      72  install -Dm755 "../vesktop.sh" "$pkgdir/usr/bin/vesktop"
    
      73}
    
      74

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-23 00:02:19	Low	3
2026-10-22 19:39:36	Low	3
2026-10-22 19:36:04	Medium	2