Bun fails to install GitHub dependencies with silent skips

“What happens One install removes an npm: alias and adds a package that depends on the same name. The package that the new dependency gets depends on the lockfile format. bun install exits 0 and prints no warning. The registry has kept@1.0.0 , short@1.0.0 and new dependency@1.0.0 . new dependency depends on kept@^1.0.0 . | Lockfile from the first install | node modules/kept after the second install | Manifests that the second install requests | | | | | | bun.lock | kept@1.0.0 | /kept , /new depen”

“Bun version and platform Bun 1.4.2+744846f84 , Linux x86 64 ( 7.2.5 3 omarchy ). Reproduction This script creates a standalone package. It first installs with a link to an existing directory, which also warms the package cache. It then replaces node modules with a dangling symlink and repeats the install. Expected Bun reports the invalid node modules link or replaces it, then exits promptly. Actual The second install consumes a CPU core and does not exit before the five second timeout (status 12”

“What version of Bun is running? 1.4.3 canary.1+c6b7fcb5b, and main at 367d939d9a What platform is your computer? Linux x64. The same on Windows x64. What steps can reproduce the bug? bun.lock resolves an optional git dependency. The cache is cold and the repository is unreachable. Use linker=isolated in both installs for the isolated linker. What is the expected behavior? A warning and exit 0 with both linkers. The install leaves the package out. The hoisted linker does that for an optional regi”

“What version of Bun is running? 1.4.3 canary.1+b52d51348, and main at 663508d6d6 What platform is your computer? Linux x64 What steps can reproduce the bug? Workspace y lists workspace x in optionalDependencies . x has a postinstall script that fails. Run bun install filter y with the isolated linker. What is the expected behavior? packages/x still exists. A failed script of an optional dependency removes the installed copy of that dependency. A workspace has no installed copy, its files are the”

What version of Bun is running? 1.4.0+34cbb9a40 What platform is your computer? GitHub hosted Actions runner: Ubuntu 24.04.4, image ubuntu 24.04 / 20260823.283.1. What steps can reproduce the bug? 1. Use a…

“What version of Bun is running? 1.4.0 What platform is your computer? Linux 7.1.11 gentoo dist hardened aarch64 unknown What steps can reproduce the bug? What is the expected behavior? What do you see instead? Additional information Note: npm version works just fine on the same system: It seems the bash script fetches the wrong binary for this system.”

“What version of Bun is running? 1.4.0+34cbb9a40 What platform is your computer? Darwin 25.6.0 arm64 arm What steps can reproduce the bug? Install a github repo dependency with a hash (ex: bun i github:user/repo 123456 ) Install a different hash (ex: bun i github:user/repo 654321 ) What is the expected behavior? The version gets overwritten What do you see instead? A duplicate key is inserted into the package.json Additional information No response”

“What version of Bun is running? 1.4.0+34cbb9a40 What platform is your computer? Microsoft Windows NT 10.0.26200.0 x64 What steps can reproduce the bug? my app build started to fail on version 1.4 and we had to stick with 1.3.14 on which it's working package.json package lock.json webpack.dev.config.js webpack.prod.config.js bun install frozen lockfile bun run prod The webpack runs in mode: production ℹ ｢atl｣: Using typescript@3.9.10 from typescript ℹ ｢atl｣: Using tsconfig.json from /home/vsts/wo”

“What version of Bun is running? 1.4.0+34cbb9a40 What platform is your computer? Linux 6.12.101+deb13 amd64 x86 64 unknown What steps can reproduce the bug? Description With minimumReleaseAge enabled, I want to be able to explicitly approve a specific newly released package version, commit that resolution to bun.lock , and then have bun ci reproduce the committed lockfile. On Bun 1.4.0, bun ci appears to re resolve the dependency and re apply minimumReleaseAge , even though the exact version is a”

“What version of Bun is running? 1.3.14+0d9b296af What platform is your computer? Linux 6.6.87.2 microsoft standard WSL2 x86 64 x86 64 What steps can reproduce the bug? 1. Create a private Git repository hosted on GitLab with SSH running on a non default port (52626). 2. Make sure the repository is accessible via SSH: Output: 3. Verify Git can clone the repository: The clone succeeds. 4. Create a Bun project and install the git dependency: The installation hangs at: or fails with: The same depend”

“What version of Bun is running? 1.3.11, 1.3.14, and canary 1.4.0 What platform is your computer? Windows 11 x64 (native) and Linux x86 64 (Ubuntu under WSL2) What steps can reproduce the bug? The project depends on 16 packages that are all branches of one private git repository (Bitbucket Cloud, SSH auth): One of the packages declares 11 of its siblings in its own package.json, so most specs appear both directly and transitively. There are two distinct failures. Bug 2 (silent skip) is the severe”

“What version of Bun is running? 1.3.14 canary.1+b8ecc78b0 What platform is your computer? Microsoft Windows NT 10.0.26200.0 x64 What steps can reproduce the bug? bun add g opencode ai in any folder. Or any other global install I've tried. Fails in PowerShell, cmd, and MSYS2 Bash. What is the expected behavior? It installs the tool globally. What do you see instead? Note there is no package lock.json anywhere in the directory tree that I'm running it in. I tried in /tmp and in C:/tmp . I tried ru”

“What version of Bun is running? 1.3.11+af24e281e What platform is your computer? Linux 6.19.8 arch1 1 x86 64 unknown What steps can reproduce the bug? When using auto install for dependencies, the import fails if it's running inside a worker thread. Here's a script that can reproduce the problem: The import fails only in the worker thread, and only if using auto install. If the dependency is installed with node modules, it works fine. What is the expected behavior? All packages that can work in”

“What version of Bun is running? 1.3.10+30e609e08 What platform is your computer? Darwin 24.6.0 arm64 arm What steps can reproduce the bug? 1. Clone the repo with branch refactor/monorepo (https://github.com/tweenjs/es6 tween/tree/refactor/monorepo) 2. Try bun remove uglify js or bun remove filter 'es6tween ' uglify js What is the expected behavior? Uninstalled uglify js from all workspace What do you see instead? For bun remove uglify js : i see but no removed dependency from workspaces. For bun”

“What version of Bun is running? 1.3.2+b131639cc What platform is your computer? Linux 6.12.67 1 lts x86 64 unknown What steps can reproduce the bug? 1. Create a project with a package.json using workspaces For example 2. Introduce some vulnerable devDependency within of the packages/projects For example 3. Run bun audit prod in the root of the folder 4. Receive errors for vulnerable devDeps What is the expected behavior? If I run this directly into the folder (not root since is a monorepo) I see”

“What version of Bun is running? 1.3.5 What platform is your computer? Windows 25H2 26200.7462 (x64) What steps can reproduce the bug? 1. Create a structure of project: module a package.json module a sub package.json < write "module a": "../../module a" in dependencies list project a package.json < write "module a": "../module a" in dependencies list 2. Run bun install 3. Bun create infinity node modules/module a sub/node modules/module a/module a sub/node modules/module a/... What is the expecte”

“What version of Bun is running? 1.3.3 What platform is your computer? Microsoft Windows NT 10.0.26200.0 x64 What steps can reproduce the bug? https://github.com/Haaxor1689/next turbopack issue repro 1. bun i 2. bun bun dev ( bun is important to run with bun runtime) 3. Open http://localhost:3000 What is the expected behavior? Should load the module successfully What do you see instead? Additional information This issue was initially opened as a nextjs issue and was marked as fixed by this PR. It”

“What version of Bun is running? 1.3.3 What platform is your computer? Linux 6.16.5 arch1 1 x86 64 unknown What steps can reproduce the bug? Put this package.json in an empty directory dir1 : Then run this command in empty directory dir2 adjacent to dir1 : bun i ../dir1 What is the expected behavior? bun creates package.json and copies or symlinks node modules/test to ../../dir1 What do you see instead? and bun never exits, consuming 100% CPU and increasing amounts of memory (I killed it at 30% o”

“Bun version: 1.3.0+b0a6feca5 MacOS Darwin 25.0.0 arm64 arm Summary Bun 1.3.0's new default isolated installs with workspaces has two critical bugs that combine to make the catalog feature unusable for production monorepos: 1. Catalog fails to deduplicate compatible semver ranges installs multiple versions even when one would satisfy all requirements 2. Cache doesn't clean up on version changes old versions persist in .bun cache after bun install , causing runtime errors even after "fixing" packa”

“What version of Bun is running? 1.2.22+6bafe2602 What platform is your computer? Microsoft Windows NT 10.0.26100.0 x64 What steps can reproduce the bug? Running "bun install" while having HTTP Debugger (or any "invalid" cert) installed. What is the expected behavior? Running the install normally, the specific certificate I'm having an error with seems to be valid and works for it's uses, just not through bun. What do you see instead? [0.15ms] ".env" bun install v1.2.22 (6bafe260) HTTPThread: inv”

“What is the problem this feature would solve? When running a script with Bun (e.g., bun index.ts ), the install option is supported and allows the script to run even if node modules is not present, as dependencies are installed automatically. However, this experience is not shared by the bun build CLI or the bun.build API, which require that dependencies are already installed. This leads to an inconsistent developer experience, as running scripts is seamless, but building/bundling requires a man”

“What version of Bun is running? 1.2.20 What platform is your computer? x64 windows What steps can reproduce the bug? run in some package you want to link bun link g What is the expected behavior? the command should either : ignore the g and proceed as if it was run without it ( pnpm ) or show an error and not do the link. ( npm) npm pnpm ignored the g and created a symlink in the global install path What do you see instead? bun create a symlink to the global install path inside its own node modu”

“What is the problem this feature would solve? I'm really glad to see bun audit (https://github.com/oven sh/bun/issues/5359) land. However, as documented in https://github.com/oven sh/bun/issues/5359 issuecomment 2950370811 it's quite easy to end up in a situation where bun audit is able to identify a vulnerable dependency but there is no straightforward way to fix it using bun : In this particular case, I was unable to fix the vuln without resorting to npm to re create and migrate the lockfile f”

“What version of Bun is running? 1.27 What platform is your computer? Docker What steps can reproduce the bug? It does not resolve dependencies, why? docker build t bun bug ubuntu f Dockerfile . What is the expected behavior? Expected to resolve dependencies in milliseconds as it does locally What do you see instead? Original output Additional information No response”

“What version of Bun is running? 1.2.5 What platform is your computer? Darwin 24.3.0 arm64 arm What steps can reproduce the bug? Take a nodejs project with a package lock.json file. Run bun install , it installs all dependencies and also migrates to bun.lock . Let's say there is a package.json script to build the project, so you run bun run build . Now you want to remove all devDeps from the project. bun install production or bun install omit=dev does not do it. I still see a whole bunch of devDe”

“What version of Bun is running? 1.1.39 canary.12+da5d4d791 What platform is your computer? Linux 5.15.167.4 microsoft standard WSL2 x86 64 x86 64 What steps can reproduce the bug? My .npmignore : It should discard all files (except those required for the package) and leave only the dist folder Steps 1. Run bun pm pack dry run Output: As you can see, it didn't leave the dist' folder at all, let's see how npm handles this 2. Run bunx npm pack dry run Output: As you can see, npm handles this correc”

“What version of Bun is running? 1.1.34+5e5e7c60f What platform is your computer? Linux 5.15.167.4 microsoft standard WSL2 x86 64 x86 64 What steps can reproduce the bug? When using packages from local git, using bun install will 100% fail to pull them, using npm install works fine. Image Error bun i [0.02ms] ".env.production" bun install v1.1.34 (5e5e7c60) 🔍 Resolving [1/2] error: no commit matching "sdsky v1.8.0" found for "lcdp lib form designer" (but repository exists) What is the expected b”

“What is the problem this feature would solve? Right now, if I have a monorepo, running bun add PKG (in the root directory) will add the package into the root package.json (as expected). Afaict there is no way to tell Bun to only add this package into workspace A's package.json rather than the root package.json . So right now, if I want to install a package to a workspace, I have to run the bun add command, then manually edit the two relevant package.json files and run bun install again; or I hav”

“What version of Bun is running? 1.1.29 What platform is your computer? Linux 6.8.0 45 generic x86 64 x86 64 What steps can reproduce the bug? The webframework that I wrote for bun has a function to build frontends. ( url.frontend("nameOfFrontendEntrypoint.tsx") ) It populates an array with the name of the frontend. To build them, the build function imports the backend code that the consumer (/developer) of this webframework wrote. This executes all the invocations of url.frontend and populates t”

“What version of Bun is running? 1.1.29+6d43b3662 What platform is your computer? Darwin 24.0.0 arm64 arm What steps can reproduce the bug? A) clone repo https://github.com/ViliamKopecky/bun yield import bug report and bun run good bun run bad . B) install @react email/render and use async render() function. It works in regular bun run but fails compiled with bun compile . What is the expected behavior? bun compile variant of script should work the same as bun run version. What do you see instead”

“What version of Bun is running? 1.1.27+267afa293 What platform is your computer? Linux 6.10.9 zen1 1 zen x86 64 (I use Arch btw) What steps can reproduce the bug? open a shell and type in this (it doesn't matter that the server doesn't exist, or the package or anything): What is the expected behavior? I would expect bunx to try to reolve the package, download it, find the binary and excute it (last steps won't work with a non existent repository obviously). But bunx already fails when it comes t”

“What version of Bun is running? 1.1.24+85a329911 What platform is your computer? Linux 6.10.3 200.fc40.x86 64 x86 64 unknown What steps can reproduce the bug? or What is the expected behavior? no error, clean install of all dependencies What do you see instead? ✔ Would you like to use TypeScript? … No / Yes ✔ Would you like to use ESLint? … No / Yes ✔ Would you like to use Tailwind CSS? … No / Yes ✔ Would you like to use src/ directory? … No / Yes ✔ Would you like to use App Router? (recommended”

“What is the problem this feature would solve? Currently running bun create solidjs/templates/ts my app is cloning the entire solidjs/templates repo into my app . What is the feature you are proposing to solve the problem? It would be nice to clone the specified directory What alternatives have you considered? No response”

“What version of Bun is running? 1.1.16 What platform is your computer? Microsoft Windows NT 10.0.22631.0 x64 What steps can reproduce the bug? Installing a local dependency, either using bun I ../local package or installing a package.json with a local dependency throws an error, image This bug started for bun 1.1.14 (couldn't reproduce on bun 1.1.13) What is the expected behavior? Installing the local dependency What do you see instead? I down graded to bun 1.1.13 Additional information No respo”

“What version of Bun is running? 1.1.12+43f0913c3 What platform is your computer? Microsoft Windows NT 10.0.19045.0 x64 What steps can reproduce the bug? Bun install/add still hang on resolve when packages are not in cache. To simulate this remove cache. bun pm cache rm (This is because trying versions, 1.1.12 1.1.8, only 1.1.8 doesn't hang on install/add packages but then after switching back to v1.1.12 it will resolve because it is in cache) (I use scoop reset bun@version to switch versions 1.1”

“What version of Bun is running? 1.1.8+89d25807f What platform is your computer? Darwin 23.5.0 arm64 arm What steps can reproduce the bug? 1. Creating a dir with a package json 2. Running bun i rhinestonewtf/modulekit What is the expected behavior? Installing the dependency What do you see instead? Additional information This bug is also reproducible when trying to install other similar dependencies (eg the ones throwing errors above) and when trying to install the dependencies of this repo (http”

“What version of Bun is running? 1.1.4+fbe2fe0c3 What platform is your computer? Darwin 23.0.0 arm64 arm What steps can reproduce the bug? Create 2 files a.ts and b.ts both imorting any package but with different versions. Then run On a.ts run everything is ok, 'lodash@4.17.20' installed and a.ts executed. Execution of b.ts will fail with Cannot find package "lodash@4.17.21" from {PATH} What is the expected behavior? Should allow use different package versions as described here https://bun.sh/doc”

“What version of Bun is running? 1.0.36+40f61ebb9 What platform is your computer? Linux 5.15.133.1 microsoft standard WSL2 x86 64 x86 64 What steps can reproduce the bug? 1. Fork i18n num in words repository into your GitHub profile, so you can simulate the error in GitHub Action. 2. Clone i18n num in words repository into your local machine or fork. (e.g. gh repo clone USERNAME/i18n num in words ) 3. Run package manager install ( bun install ) 4. Run tests ( bun test ) 5. It will run successfull”

What version of Bun is running? 1.0.30+1424a196f What platform is your computer? Darwin 23.2.0 arm64 arm What steps can reproduce the bug? In my project I'm currently using @google cloud/pubsub and @google…

“What version of Bun is running? 1.0.25 What platform is your computer? Linux 6.5.13 1rodete1 amd64 x86 64 unknown What steps can reproduce the bug? bun package manager fails to resolve github dependencies of packages. What is the expected behavior? Works without error. What do you see instead? However, when trying to add the depend package directly, it works Additional information No response”

“What is the problem this feature would solve? Currently, the bun pm ls outputs all dependencies at once. Thus, with a package.json like this one the output is The issues are as follows: If some different version of a package is already installed in any of the dependencies, that should be removed and the package should be installed as specified in the last run add command. Should any need arise for installing different versions of a package at once, that should be installed via tag installs. The”

“What version of Bun is running? 1.0.23+83f2432da What platform is your computer? Darwin 23.2.0 x86 64 i386 What steps can reproduce the bug? Add file: dependencies to package.json and run bun install multiple times. The file: dependencies are always reinstalled. E.g.: What is the expected behavior? I expect bun install for vendored packages to be as fast as it is for cached remote packages. What do you see instead? It takes 8 seconds on my machine to reinstall 8 vendored packages (about 60k smal”

“1. bun add mishoo/UglifyJS v3.14.1 2. bun add mishoo/UglifyJS v3.14.2 2 should replace 1 Instead:”

“What version of Bun is running? 1.0.20 What platform is your computer? Linux 5.15.133.1 microsoft standard WSL2 x86 64 x86 64 What steps can reproduce the bug? I cannot install node packages using bun install even though npm install works. The other problem is that even though I install packages with npm i , bun run dev doesn't even boot my Next.js project. To reproduce the bug, create a next project and try to install packages or run the project. What is the expected behavior? bun install shoul”

“What is the problem this feature would solve? No package information which produces these warnings bun update f bun update v1.0.14 (1147c708) warn: incorrect peer dependency "svelte@3.59.2" warn: incorrect peer dependency "vite@4.5.0" warn: incorrect peer dependency "svelte@3.59.2" warn: incorrect peer dependency "vite@4.5.0" warn: incorrect peer dependency "vite@4.5.0" warn: incorrect peer dependency "vite@4.5.0" What is the feature you are proposing to solve the problem? Add package info which”

“What version of Bun is running? No response What platform is your computer? Linux 5.15.0 88 generic x86 64 x86 64 What steps can reproduce the bug? What is the expected behavior? Bun to get installed. What do you see instead? Additional information If I run”

“What is the problem this feature would solve? When running bun install in a project of mine, I get a ton on errors saying Missing "name" from package.json in packages/features//some feature , and the install doesn't work. In this project we sometimes us package.json files to host other metadata for folders, i.e. the owning team. What is the feature you are proposing to solve the problem? It would be great if bun just ignored these package.json files since there's nothing to do here. I'm not sure”

“What version of Bun is running? 1.0.1+31aec4ebe325982fc0ef27498984b0ad9969162b What platform is your computer? Linux 5.15.0 82 generic x86 64 x86 64 What steps can reproduce the bug? Create a new directory, and create the following files a.ts b.ts Attempt to transpile these files in place via bun build a.ts b.ts no bundle outdir . What is the expected behavior? a.ts and b.ts are successfully transpiled into a.js and b.js respectively, in the same directory a.ts and b.ts are located. What do you”

“What version of Bun is running? 1.0.0+822a00c4d508b54f650933a73ca5f4a3af9a7983 What platform is your computer? Darwin 23.0.0 arm64 arm What steps can reproduce the bug? While trying to migrate to bun workspace, I noticed that bun isn't able to resolve internal packages that contain organization alias. Repository: https://github.com/devraul/bun workspace organization error Steps to reproduce: 1. Clone the project 2. Try to run bun install yarn 3. see the error Notice that this only happens becaus”

“What is the problem this feature would solve? When building for deployment (i.e., there is a build step defined in package.json ), a common paradigm is to install all dependencies (including devDependencies), run the build step, then prune the devDependencies. npm, yarn, and pnpm all support this feature. What is the feature you are proposing to solve the problem? A prune subcommand or option, much like npm, yarn, and pnpm already support. What alternatives have you considered? Here's what I'm c”