Bun¶

ID: bun
Home page: https://bun.sh
Version requirement: >= 1.2
Platforms: 🐧 Linux · 🍎 macOS · 🪟 Windows
Operations: installed · outdated · install · upgrade · upgrade_all · remove
purl types: pkg:bun · pkg:npm
CLI name: bun
Issues and PRs: 📦 manager: npm-based
Source: meta_package_manager/managers/bun.toml

bun is a JavaScript runtime and package manager (https://bun.sh), and what is wrapped here is what it installs globally.

bun resolves from the npm registry like the rest of that family, but installs into its own prefix rather than npm’s: $BUN_INSTALL before ~/.bun, with the packages under install/global. Nothing it installs appears in npm’s, pnpm’s or yarn’s inventory, and none of them contend for its lock, so bun joins no lock family despite sharing their registry.

Warning

Upgrades force --latest, and leaving it off would be a silent no-op rather than a lesser upgrade. bun records the range a package was installed with, so a package pinned at install time is held there by a bare bun update: the command reports success, the version does not move, and bun outdated says as much by printing an Update column that stays at the installed version while Latest shows the newer one. Forcing --latest is what makes an upgrade mean what mpm means by it.

Note

The inventory is a tree, and only its branch lines are matched. The first line names the global node_modules and its total package count, which is a count of everything pulled in rather than of what was asked for, so it is deliberately not read. A scoped package carries an @ in its name as well as before its version, which the greedy pattern resolves by splitting on the last one.

Note

The outdated table is padded ASCII with no machine-readable alternative: --json is accepted and ignored by both this command and the listing. The version fields are therefore anchored on a leading digit, which is what rejects the header row (Current, Latest) and the dashed separators without matching on their text. The third column, Update, is the version a range-respecting upgrade would reach and is skipped in favour of Latest, which is where --latest actually goes.

No search: bun exposes package metadata for a name already known (bun info) but no query against the registry.

No sync and no cleanup: nothing refreshes an index without acting, and nothing prunes the global install.

No escalation: everything lives under the user’s own prefix.

What `mpm` adds to `bun`¶

mpm reaches across every manager at once, not bun alone: mpm installed and mpm outdated cover bun alongside npm, pnpm, volta, yarn, yarn-berry and any other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `bun` commands, in `mpm`¶

You already know bun: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `bun`	With `mpm`
List what’s installed	`bun pm ls --global`	`mpm --bun installed`
List outdated packages	`bun outdated --global`	`mpm --bun outdated`
Install a package	`bun install --global <package_id>`	`mpm install pkg:bun/<package_id>`
Upgrade one package	`bun update --global --latest <package_id>`	`mpm --bun upgrade <package_id>`
Upgrade everything	`bun update --global --latest`	`mpm --bun upgrade --all`
Remove a package	`bun remove --global <package_id>`	`mpm remove pkg:bun/<package_id>`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported
`installed`	✓
`outdated`	✓
`orphans`
`search`
`install`	✓
`upgrade`	✓
`upgrade_all`	✓
`remove`	✓
`sync`
`cleanup`
`doctor`

Selecting and configuring `bun`¶

Deselect bun for a single run with --no-bun, or persist the choice in your configuration:

[mpm]
bun = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.bun]
timeout = 900

mpm config-template bun prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around bun, one mpm command each:

Snapshot and clone a machine: mpm --bun dump bun.toml, then mpm restore bun.toml on the next one.
Export a compliance SBOM: mpm --bun sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations needs root.

See privilege escalation for the full policy.

Cooldown¶

State of Bun’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: npm registry (pkg:npm)
Retraction: Unpublish within 72 h of publishing, then only with no dependents, under 300 weekly downloads and a single owner (policy). Past that, flag only: npm deprecate warns on install but does not stop resolution
Publish date: ✅ time, mapping each version to its publication timestamp (packument)

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe¶

The version is probed by running:

$ bun --version
1.3.14

and extracted with:

r"^(?P<version>\d+\.\d+\.\d+\S*)$"

Reference traces¶

Raw native outputs captured in the bundled definition: the reference mpm’s parsers were written against. If you know Bun well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ bun pm ls --global
/home/user/.bun/install/global node_modules (42)
├── @sindresorhus/is@8.1.0
└── cowsay@1.6.0

$ bun outdated --global
bun outdated v1.3.14 (0d9b296a)
|--------------------------------------|
| Package  | Current | Update | Latest |
|----------|---------|--------|--------|
| cowsay   | 1.5.0   | 1.5.0  | 1.6.0  |
|--------------------------------------|

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --bun installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog¶

7.7.0.dev0 (unreleased)
- Implement bun, covering what it installs globally. It resolves the npm registry like the rest of that family but installs into its own prefix, so nothing it holds appears in npm, pnpm or yarn inventories. Upgrades force --latest, without which a package pinned at install time is held at its recorded range and the upgrade reports success while changing nothing.