install

74 notes in this subject, read out of this brain and free to use. This is page 2 of 2.

Generate lockfile without installing with --lockfile-only

Use the `--lockfile-only` flag with `bun install` to generate a lockfile without installing to `node_modules`. The lockfile is always saved to disk, even if it is already up to date with your project's `package.json` files. The `--lockfile-only` flag still populates the global install cache with registry metadata and git/tarball dependencies.

bun install --no-save installs without creating lockfile

Use the `--no-save` flag with `bun install` to install without creating a lockfile.

bun install --yarn generates Yarn lockfile alongside bun.lock

Use the `--yarn` flag with `bun install` to write a Yarn lockfile in addition to `bun.lock`.

install.lockfile.print configuration option

Set `[install.lockfile]` section with `print = "yarn"` in `bunfig.toml` to save a non-Bun lockfile alongside `bun.lock`. Only "yarn" is supported.

Migrate binary bun.lockb to text-based bun.lock

Bun v1.2 changed the default lockfile format to the text-based `bun.lock`. To migrate an existing binary `bun.lockb`, run `bun install --save-text-lockfile --frozen-lockfile --lockfile-only` and delete `bun.lockb`.

Automatic lockfile migration from other package managers

When running `bun install` in a project without a `bun.lock`, Bun automatically migrates existing lockfiles from `yarn.lock` (v1), `package-lock.json` (npm), or `pnpm-lock.yaml` (pnpm). The original lockfile is preserved and can be removed manually after verification.

bun install --save-text-lockfile flag

Use the `--save-text-lockfile` flag with `bun install` to save the text-based lockfile format.

bun install --frozen-lockfile flag

Use the `--frozen-lockfile` flag with `bun install` to prevent modifications to the lockfile.

Security scanner configuration in bunfig.toml

To configure a security scanner in bunfig.toml, add an [install.security] section with a scanner key set to the package name of the scanner. Example: [install.security] scanner = "@oven/bun-security-scanner"

Security scanner runs during package operations

Security scanners analyze packages during bun install, bun add, and other package operations. They can detect known security vulnerabilities (CVEs), malicious packages, and license compliance issues.

Fatal severity level stops installation

When a security scanner reports a fatal advisory, installation stops immediately and exits with a non-zero code.

Warn severity level behavior

When a security scanner reports a warn severity level, in interactive terminals it prompts to continue; in CI environments, it exits immediately.

Security scanner environment variables

Some enterprise security scanners take authentication and other configuration from environment variables. Consult your scanner's documentation for which environment variables to set.

bun install with --filter flag

bun install installs dependencies for all workspaces in the monorepo, de-duplicating packages if possible. To install dependencies for specific workspaces only, use the --filter flag. Multiple filters can be used: bun install --filter 'pkg-*' --filter '!pkg-c'. Paths can also be used, such as bun install --filter './packages/pkg-*' --filter '!pkg-c'.

Give your agent this brain