X_LOCKFILE_STALE
Means
bun.lock records an @ultimat3/* range that the package.json it was generated from no longer declares
Typical cause
a lockstep bump. bun install refreshes a workspace block only when that workspace's own manifest changed, and --frozen-lockfile accepts every stale one because a workspace edge resolves by name — the range is never read back. 90 entries sat at 1.2.0 and 2.0.0 against manifests that all said 3.0.0
Fix
bun run scripts/lockfile-pins.ts --write, then bun install --frozen-lockfile to confirm. Not rm bun.lock && bun install, which also drags every external dependency to its newest match — measured once as Biome 2.5.5 → 2.5.9 and @types/node 26.1.1 → 26.2.0