Bun¶

ID: bun
Links: Home page · Documentation · Repository · Wikipedia
Upstream stars: ⭐ 96,074
Last commit: 2026-09-29
Version requirement: >= 1.2
Platforms: 🐧 Linux · 🍎 macOS · 🪟 Windows
Operations: installed · outdated · install · upgrade · upgrade_all · remove
purl types: pkg:bun/ · pkg:npm/
CLI name: bun
Issues and PRs: 📦 manager: npm-based
Source: bun.toml

bun is a JavaScript runtime and package manager (https://bun.sh), and what is wrapped here is what it installs globally.

bun resolves from the npm registry like the rest of that family, but installs into its own prefix rather than npm’s: $BUN_INSTALL before ~/.bun, with the packages under install/global. Nothing it installs appears in npm’s, pnpm’s or yarn’s inventory, and none of them contend for its lock, so bun joins no lock family despite sharing their registry.

Warning

Upgrades force --latest, and leaving it off would be a silent no-op rather than a lesser upgrade. bun records the range a package was installed with, so a package pinned at install time is held there by a bare bun update: the command reports success, the version does not move, and bun outdated says as much by printing an Update column that stays at the installed version while Latest shows the newer one. Forcing --latest is what makes an upgrade mean what mpm means by it.

Note

The inventory is a tree, and only its branch lines are matched. The first line names the global node_modules and its total package count, which is a count of everything pulled in rather than of what was asked for, so it is deliberately not read. A scoped package carries an @ in its name as well as before its version, which the greedy pattern resolves by splitting on the last one.

Note

The outdated table is padded ASCII with no machine-readable alternative: --json is accepted and ignored by both this command and the listing. The version fields are therefore anchored on a leading digit, which is what rejects the header row (Current, Latest) and the dashed separators without matching on their text. The third column, Update, is the version a range-respecting upgrade would reach and is skipped in favour of Latest, which is where --latest actually goes.

No search: bun exposes package metadata for a name already known (bun info) but no query against the registry.

No sync and no cleanup: nothing refreshes an index without acting, and nothing prunes the global install.

No escalation: everything lives under the user’s own prefix.

What `mpm` adds to `bun`¶

mpm reaches across every manager at once, not bun alone: mpm installed and mpm outdated cover bun alongside npm, pnpm, volta, yarn, yarn-berry and any other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `bun` commands, in `mpm`¶

You already know bun: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `bun`	With `mpm`
List what’s installed	`bun pm ls --global`	`mpm --bun installed`
List outdated packages	`bun outdated --global`	`mpm --bun outdated`
Install a package	`bun install --global <package_id>`	`mpm install pkg:bun/<package_id>`
Upgrade one package	`bun update --global --latest <package_id>`	`mpm --bun upgrade <package_id>`
Upgrade everything	`bun update --global --latest`	`mpm --bun upgrade --all`
Remove a package	`bun remove --global <package_id>`	`mpm remove pkg:bun/<package_id>`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported
`installed`	✅
`outdated`	✅
`orphans`
`search`
`install`	✅
`upgrade`	✅
`upgrade_all`	✅
`remove`	✅
`sync`
`cleanup`
`doctor`

Configuration¶

Ignore bun on the mpm CLI by passing the --no-bun option.
Ignore it for every run in your configuration:
```
[mpm]
bun = false
```
Raise the timeout of all bun calls:
```
[mpm.overrides.bun]
timeout = 900
```

Run mpm config-template bun to print all overridable settings for your configuration file:

[mpm.overrides.bun]
cli_names = [
    "bun",
]
cli_search_path = []
dry_run = false
ignore_auto_updates = true
plan = false
post_args = []
pre_args = []
pre_cmds = []
requirement = ">=1.2.0"
stop_on_error = false
unmaintained = false
version_cli_options = [
    "--version",
]
version_regexes = [
    "^(?P<version>\\d+\\.\\d+\\.\\d+\\S*)$",
]

Recipes¶

A few jobs you would otherwise script around bun, one mpm command each:

Snapshot and clone a machine: mpm --bun dump bun.toml, then mpm restore bun.toml on the next one.
Export a compliance SBOM: mpm --bun sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations is privileged.

See privilege escalation for the full policy.

Cooldown¶

State of Bun’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: npm registry (pkg:npm)
Retraction: Unpublish within 72 h of publishing, then only with no dependents, under 300 weekly downloads and a single owner (policy). Past that, flag only: npm deprecate warns on install but does not stop resolution
Publish date: ✅ time, mapping each version to its publication timestamp (packument)

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Reference traces¶

A collection of raw native outputs captured from the manager’s own CLI and recorded in the bundled definition. If you know Bun well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ bun pm ls --global
/home/user/.bun/install/global node_modules (42)
├── @sindresorhus/[email protected]
└── [email protected]

$ bun outdated --global
bun outdated v1.3.14 (0d9b296a)
|--------------------------------------|
| Package  | Current | Update | Latest |
|----------|---------|--------|--------|
| cowsay   | 1.5.0   | 1.5.0  | 1.6.0  |
|--------------------------------------|

Version check¶

The version is probed by running:

$ bun --version
1.3.14

and extracted with:

r"^(?P<version>\d+\.\d+\.\d+\S*)$"

Upstream project¶

Metrics	`oven-sh/bun`
Activity
Popularity
Metadata

Changelog¶

8.0.0 (2026-09-20)
- Add bun, covering what it installs globally into its own prefix, invisible to npm, pnpm and yarn. Upgrades force --latest, without which a package held at its recorded range reports success while changing nothing.