install: fold the open bun install / pm / pack+publish PRs into one branch (172 PRs)

[Jarred-Sumner]

Folds the open bun install / bun pm / pack+publish PRs from Aug 12–17 into one branch so they can be reviewed and landed together. Each original PR is one squashed commit here (<title> (#N)), in dependency order, so the branch stays bisectable; conflict resolutions between overlapping PRs live in the later PR's commit, and cross-PR API reconciliation is in the mega-merge fixup: commits at the end.

172 PRs folded, 2 excluded, 1 pending (see below). cargo check --workspace and cargo clippy --workspace are clean; test status is tracked in the checklist at the bottom.

Not folded

PR	Why
#37925	semantic conflict with #39002 (which needs optional peers bound at load); #39002 is newer and explicitly calls this out
#38777	security screen: make_executable() follows an absolute bin-target symlink out of a file:/link: package and chmods the real file (CVE-2019-16775 class) when the folder dep resolves to an ancestor dir; needs rework before merging
#38557	written against the pre-bun audit fix audit_command.rs; needs a hand re-port (in progress)

Security screen

Every folded diff was reviewed for regressions (path traversal, credential leakage, TLS/integrity weakening, lifecycle-script trust widening, terminal injection, new unsafe on untrusted input). One PR was dropped for it (#38777 above). Items a reviewer may still want to eyeball — none were judged exploitable regressions:

• bunx: serialize concurrent installs into the shared cache dir with a file lock #37851 (concern, low): bunx serialises concurrent installs into the shared /bunx-- dir with an flock on /.bunx-lock; the lock file is opened by path with O_CREAT|O_RDWR and without O_NOFOLLOW, adding a small symlink-following primitive inside the pre-existing TOCTOU window of the cache-dir trust check.
• install: stamp lockfileVersion 1 on new bun.lock files #38741 (concern, low): New bun.lock files are stamped lockfileVersion 1 instead of 2, so the two v2-only parse-time fail-closed checks (off-registry npm tarball URL without a supported integrity hash; unsafe git .bun-tag) no longer apply to any lockfile created after this lands. The reduction is defence-in-depth only: the checks are keyed on a digit the lockfile tamperer also controls, main already stamps v1 whenever bun's own output would trip them, a tamperer can supply a matching integrity for their own tarball anyway, and the git tag is re-validated at checkout/extract time (repository.rs:923, extract_tarball.rs:484; github tags stay checked at every version).
• install: fix default-trusted lifecycle scripts being blocked after yarn.lock migration #38795 (concern, low): Default-trusted check now ignores the URL fragment; the claim that this is exactly as strict as before is slightly off because bun_url lets a ? after # leak the fragment into the request path, though no attacker-chosen tarball results.
• install: resolve .npmrc //host/ credentials by request URL #38800 (concern, low): .npmrc //host/path/ credentials are now resolved by request URL (npm nerf-dart semantics): scopes without credentials pick them up by registry URL, and tarballs on a host other than the registry get that host's own .npmrc credentials. Scope credentials still never leave the scope origin, but the by-URL match is scheme-agnostic and path-unnormalized, which slightly widens where a registry-controlled dist.tarball can make bun present a token.
• install: install a git dependency's devDependencies before running its prepare scripts #38810 (concern, low): For a git/github dependency that is already in trustedDependencies and has a prepare-family script, runs a nested bun install --ignore-scripts --no-save in the checkout first. Lifecycle trust is not widened (only reached via has_trusted_dependency, nested install ignores scripts, git deps are never default-trusted), but the nested install fetches and then (via prepare) executes third-party devDependencies chosen by the git repo's ranges without the project's bunfig protections, notably install.minimumReleaseAge / overrides / scoped registries, and it forwards the default-registry token into a child process whose cwd is attacker-authored.
• install: migrate a package's own file: directories from package-lock.json relative to the package #38990 (concern, low): package-lock file: targets inside a registry/tarball/git package are now migrated as package-relative folder rows without normalising the sub-path, so a hand-edited key with .. is no longer skipped at migration time and containment relies on the installer (hoisted linker checks it, with an overrides-name exemption; isolated linker does not).
• install: don't issue openat2/fchmodat2 on Android (seccomp SIGSYS) #39084 (concern, low): Skips openat2/fchmodat2 on Android (kernel release contains 'android' OR both ANDROID_ROOT and ANDROID_DATA env vars set); symlink-safety semantics are preserved by the fallbacks, but the env-var trigger lets any environment downgrade RESOLVE_BENEATH/RESOLVE_IN_ROOT hardening on ordinary Linux.

Product-behaviour changes worth a deliberate look: #38741 (new bun.lock files are stamped lockfileVersion: 1 again), #38797 (libc recorded in bun.lock / bun.lockb meta), #38804 (a migrated lockfile and its package.json edits are only written when the command saves a lockfile), #38923 (bun pm ls lists what is installed and exits 1 without node_modules), #38813 (pack/publish resolve workspace:/catalog: from package.json files, not bun.lock).

Conflict resolutions that changed a PR's code (not just context)

• install: resolve deferred * peers after their siblings, not on arrival order #37713 × install: resolve a range onto an existing version only when every install has it #38832: kept install: resolve deferred * peers after their siblings, not on arrival order #37713's rule that a deferred peer never range-matches on sight (no * exemption); install: resolve a range onto an existing version only when every install has it #38832's AppendedFor/settled_package_count model replaces the exact_pinned guard, with install: keep transitive rows on the copy a direct dependency resolves to #38770's direct-dependency clause folded into the reusable predicate.
• install: rebind ranged peers whose target the saved tree drops #38768 × install: keep a peer nothing in bun.lock satisfies where the file records it #38892: resolve_peer_dep_version_based_among keeps install: rebind ranged peers whose target the saved tree drops #38768's candidate filter but drops the highest-candidate fallback install: keep a peer nothing in bun.lock satisfies where the file records it #38892 removed.
• install: bind peer edges in the hoister, the way loading bun.lock binds them #38767/install: keep the packages bun.lock holds only through optional peers when an install re-resolves #39002 vs install: let the hoister bind optional peers when loading bun.lock #37925: install: let the hoister bind optional peers when loading bun.lock #37925 excluded (see above).
• install: keep bundleDependencies from every dependency group when parsing a registry manifest #38857 vs main's collect_bundled_deps refactor: took install: keep bundleDependencies from every dependency group when parsing a registry manifest #38857's per-version bundled_dependencies list.
• install: migrate workspace packages from yarn.lock #38878 (yarn migrator rewrite) absorbed install: bind peer edges in the hoister, the way loading bun.lock binds them #38767's yarn index change; install: fix yarn.lock migration panic on tarball URLs with "/-/" right after the host #38803/install: name yarn.lock npm: alias packages after the alias spec, not the tarball URL #38948/install: migrate yarn.lock registry entries that have no resolved field #38985/install: skip yarn.lock entries the migration cannot build a resolution for #39001 re-applied onto the rewritten migrator (install: skip yarn.lock entries the migration cannot build a resolution for #39001's id remap now runs right after the append loop).
• install: import pnpm-workspace.yaml even without a migratable pnpm-lock.yaml #38754/install: keep the pnpm block in package.json when migrating from pnpm #38775/install: migrate pnpm onlyBuiltDependencies and report blocked scripts under the isolated linker #38780/install: write a migrated lockfile and its package.json edits only when the command saves a lockfile #38804 in pnpm.rs: one update_package_json_after_migration(lockfile: Option<&mut Lockfile>, …); everything is reported as “copied … in package.json” (pnpm keeps reading its own block), the write is deferred to lockfile save (install: write a migrated lockfile and its package.json edits only when the command saves a lockfile #38804), and bun pm migrate on a read-only package.json reports the failed write but keeps the migrated bun.lock (install: only open package.json for writing in the commands that rewrite it #38745's intent).
• publish: honor publishConfig.registry and publishConfig["@scope:registry"] #38322 re-based onto install: resolve .npmrc //host/ credentials by request URL #38800's url_auth model instead of adding a second .npmrc credential table; --registry goes through the same set_default_registry path unless the URL itself carries credentials (install: send credentials embedded in a registry URL that comes from an env var #38834).
• install: escape control characters in resolutions, specifiers, bin names and registry error text #38631/install: redact credentials in tarball and git URLs printed as resolutions and specifiers #38977 at shared print sites resolve to EscapeControlChars(redacted(…)) (redact inside, escape outside); one EscapeControlChars implementation (the multiline-capable one from pm view: escape control characters coming from the registry #38536) is kept.
• install: fail the isolated install with ENAMETOOLONG when a link: target does not fit the path buffer #38369 on top of the refactored isolated linker: symlink_dependencies returns Result<bool, TaskError> so LinkPathTooLong still names the package.
• run, install: honor --no-env-file / --env-file for scripts run through the bun exec hop #38182 × install: install a git dependency's devDependencies before running its prepare scripts #38810: ScriptArgv::install_dependencies() builds the nested bun install --ignore-scripts --no-save argv.
• auto-install: report why a root dependency could not be resolved #38180: fail_fn removed as in the PR; the invalid-name path from install: reject dependency names containing control characters #38615 now logs like the other root-resolution errors.
• test(install): run bun-install-registry.test.ts concurrently and tighten its assertions #38504: tests other PRs added to bun-install-registry.test.ts against the old shared packageDir now call setupTest().

Folded PRs

Peer binding, hoisting, bun.lock load/round-trip, resolver dedupe (21)

• install: bind peer edges in the hoister, the way loading bun.lock binds them #38767 install: bind peer edges in the hoister, the way loading bun.lock binds them
• install: keep transitive rows on the copy a direct dependency resolves to #38770 install: keep transitive rows on the copy a direct dependency resolves to
• install: load root and workspace dependencies from bun.lock the way package.json parses them #38869 install: load root and workspace dependencies from bun.lock the way package.json parses them
• install: keep a peer nothing in bun.lock satisfies where the file records it #38892 install: keep a peer nothing in bun.lock satisfies where the file records it
• install: re-resolve a peer row instead of binding it to a stale bun.lock leftover #38901 install: re-resolve a peer row instead of binding it to a stale bun.lock leftover
• install: keep the packages bun.lock holds only through optional peers when an install re-resolves #39002 install: keep the packages bun.lock holds only through optional peers when an install re-resolves
• install: bind unbound required peers while hoisting, like optional peers #39343 install: bind unbound required peers while hoisting, like optional peers
• install: bind a multi-path package's edges from the bun.lock row that prints the binding #39347 install: bind a multi-path package's edges from the bun.lock row that prints the binding
• install: only re-resolve rows a package still owns when overrides or catalogs change #38849 install: only re-resolve rows a package still owns when overrides or catalogs change
• install: resolve deferred * peers after their siblings, not on arrival order #37713 install: resolve deferred * peers after their siblings, not on arrival order
• install: rebind ranged peers whose target the saved tree drops #38768 install: rebind ranged peers whose target the saved tree drops
• install: resolve a range onto an existing version only when every install has it #38832 install: resolve a range onto an existing version only when every install has it
• install: keep a bundle's dependency out of a slot the bundling package resolves through #38848 install: keep a bundle's dependency out of a slot the bundling package resolves through
• test(install): pin both no-deps versions instead of racing a range against a pin #38858 test(install): pin both no-deps versions instead of racing a range against a pin
• install: keep bundled peer edges on their own bun.lock entry when loading #38837 install: keep bundled peer edges on their own bun.lock entry when loading
• install: keep bundleDependencies from every dependency group when parsing a registry manifest #38857 install: keep bundleDependencies from every dependency group when parsing a registry manifest
• Hold a transitive update that would re-fork a deduped package #38919 Hold a transitive update that would re-fork a deduped package
• install: stop hoisting a dependency cycle forever #38976 install: stop hoisting a dependency cycle forever
• install: warn when the hoisted tree serves a peer from a root copy outside its range #39053 install: warn when the hoisted tree serves a peer from a root copy outside its range
• install: stamp lockfileVersion 1 on new bun.lock files #38741 install: stamp lockfileVersion 1 on new bun.lock files
• test(install): establish the warm manifest cache before the unmet peer test re-resolves #39190 test(install): establish the warm manifest cache before the unmet peer test re-resolves

bun update / bun add package.json edits, overrides (7)

• install: print the update row for catalog entries moved by bun update #38763 install: print the update row for catalog entries moved by bun update
• install: keep workspace and other non-registry entries as written on bun update <name> #38847 install: keep workspace and other non-registry entries as written on bun update
• Report package.json sync in the bun update summary instead of (no changes) #38918 Report package.json sync in the bun update summary instead of (no changes)
• install: ignore leading whitespace in dist-tag, bare folder and local tarball versions #38331 install: ignore leading whitespace in dist-tag, bare folder and local tarball versions
• install: apply both "overrides" and "resolutions" when package.json has both #38811 install: apply both "overrides" and "resolutions" when package.json has both
• install: keep the workspace: spelling given to bun add <member>@workspace:<range> #38866 install: keep the workspace: spelling given to bun add @workspace:
• install: ignore leading whitespace wherever a dependency literal is classified or re-parsed #38309 install: ignore leading whitespace wherever a dependency literal is classified or re-parsed

Lockfile migration (yarn / pnpm / npm) (17)

• Fix package-lock.json migration for scope registries configured without a trailing slash #38698 Fix package-lock.json migration for scope registries configured without a trailing slash
• install: record package.json trustedDependencies when migrating a lockfile #38773 install: record package.json trustedDependencies when migrating a lockfile
• install: keep the pnpm block in package.json when migrating from pnpm #38775 install: keep the pnpm block in package.json when migrating from pnpm
• install: fix default-trusted lifecycle scripts being blocked after yarn.lock migration #38795 install: fix default-trusted lifecycle scripts being blocked after yarn.lock migration
• install: migrate the whole pnpm-workspace.yaml catalog into bun.lock #38829 install: migrate the whole pnpm-workspace.yaml catalog into bun.lock
• install: migrate a package's own file: directories from package-lock.json relative to the package #38990 install: migrate a package's own file: directories from package-lock.json relative to the package
• install: migrate pnpm onlyBuiltDependencies and report blocked scripts under the isolated linker #38780 install: migrate pnpm onlyBuiltDependencies and report blocked scripts under the isolated linker
• install: import pnpm-workspace.yaml even without a migratable pnpm-lock.yaml #38754 install: import pnpm-workspace.yaml even without a migratable pnpm-lock.yaml
• install: skip workspace members whose package.json has no name #38781 install: skip workspace members whose package.json has no name
• install: migrate pnpm importer rows in the shape package.json parsing produces #38791 install: migrate pnpm importer rows in the shape package.json parsing produces
• install: migrate workspace packages from yarn.lock #38878 install: migrate workspace packages from yarn.lock
• install: fix yarn.lock migration panic on tarball URLs with "/-/" right after the host #38803 install: fix yarn.lock migration panic on tarball URLs with "/-/" right after the host
• install: name yarn.lock npm: alias packages after the alias spec, not the tarball URL #38948 install: name yarn.lock npm: alias packages after the alias spec, not the tarball URL
• install: migrate yarn.lock registry entries that have no resolved field #38985 install: migrate yarn.lock registry entries that have no resolved field
• install: skip yarn.lock entries the migration cannot build a resolution for #39001 install: skip yarn.lock entries the migration cannot build a resolution for
• install: migrate npm-shrinkwrap.json like package-lock.json #38861 install: migrate npm-shrinkwrap.json like package-lock.json
• install: write a migrated lockfile and its package.json edits only when the command saves a lockfile #38804 install: write a migrated lockfile and its package.json edits only when the command saves a lockfile

file: / link: / tarball / git local dependencies (16)

• install: fail the isolated install when a link: dependency's target is missing #38045 install: fail the isolated install when a link: dependency's target is missing
• install: read the package.json of a file: dependency declared by a local file: package #38814 install: read the package.json of a file: dependency declared by a local file: package
• install: keep file: folder paths declared by git and tarball packages relative to the package #38816 install: keep file: folder paths declared by git and tarball packages relative to the package
• install: drop the query string and fragment from a tarball URL's extraction folder name #39011 install: drop the query string and fragment from a tarball URL's extraction folder name
• install: cache file: tarballs under the integrity the lockfile pins #39016 install: cache file: tarballs under the integrity the lockfile pins
• install: reject tarball, folder and git packages whose package.json name is invalid #38633 install: reject tarball, folder and git packages whose package.json name is invalid
• install: read git+git:// resolutions back from bun.lock #38798 install: read git+git:// resolutions back from bun.lock
• install: resolve file: dependencies loaded from the lockfile relative to the top-level dir #38850 install: resolve file: dependencies loaded from the lockfile relative to the top-level dir
• install: link file: dependencies of registry packages from inside the package with the isolated linker #38856 install: link file: dependencies of registry packages from inside the package with the isolated linker
• install: bound isolated store entry names; tarball URL credentials; file: tarballs relative to their folder package #38867 install: bound isolated store entry names; tarball URL credentials; file: tarballs relative to their folder package
• install: refuse local tarball dependencies declared by packages installed from the cache #38986 install: refuse local tarball dependencies declared by packages installed from the cache
• install(hoisted): link a file: override applied to a dependency of an installed package #38994 install(hoisted): link a file: override applied to a dependency of an installed package
• install: refuse link: paths with .. or an absolute path declared by packages installed from the cache #39023 install: refuse link: paths with .. or an absolute path declared by packages installed from the cache
• install: name folder, tarball and git packages without a package.json name after their source #38681 install: name folder, tarball and git packages without a package.json name after their source
• install: resolve file: and link: dependencies on the same directory as separate packages #38114 install: resolve file: and link: dependencies on the same directory as separate packages
• install: stop leaking the displaced cache folder when a tarball is re-extracted #38702 install: stop leaking the displaced cache folder when a tarball is re-extracted

Path-buffer overflows: panic → error (15)

• install: stop aborting on link: specifiers and patch paths longer than the path buffers #38359 install: stop aborting on link: specifiers and patch paths longer than the path buffers
• cli: stop aborting on --cwd and --tsconfig-override values longer than the path join buffer #38368 cli: stop aborting on --cwd and --tsconfig-override values longer than the path join buffer
• install: stop panicking when the cache directory setting does not fit the path buffer #38390 install: stop panicking when the cache directory setting does not fit the path buffer
• install: stop panicking when a progress bar name is longer than its buffer #38558 install: stop panicking when a progress bar name is longer than its buffer
• install: stop aborting on linked package names that do not fit the symlink buffers #38571 install: stop aborting on linked package names that do not fit the symlink buffers
• install: fail verification instead of panicking when <alias>/package.json does not fit the path buffer #38575 install: fail verification instead of panicking when /package.json does not fit the path buffer
• pm ls --all: stop panicking on resolutions longer than 512 bytes #38616 pm ls --all: stop panicking on resolutions longer than 512 bytes
• pack/publish: stop panicking on package.json bin and files entries longer than the path buffer #38784 pack/publish: stop panicking on package.json bin and files entries longer than the path buffer
• install: stop panicking on bin values longer than the path buffer #38954 install: stop panicking on bin values longer than the path buffer
• install: report ENAMETOOLONG for a --cwd value that does not fit the path buffer #38375 install: report ENAMETOOLONG for a --cwd value that does not fit the path buffer
• install: fail the isolated install with ENAMETOOLONG when a link: target does not fit the path buffer #38369 install: fail the isolated install with ENAMETOOLONG when a link: target does not fit the path buffer
• install: do not abort when $XDG_CONFIG_HOME or $HOME is too long for the .npmrc path buffer #38372 install: do not abort when $XDG_CONFIG_HOME or $HOME is too long for the .npmrc path buffer
• install: stop aborting on -g when $BUN_INSTALL, $XDG_CACHE_HOME or $HOME does not fit the global directory path buffer #38413 install: stop aborting on -g when $BUN_INSTALL, $XDG_CACHE_HOME or $HOME does not fit the global directory path buffer
• pack: report an error instead of panicking when --destination does not fit the path buffer #38749 pack: report an error instead of panicking when --destination does not fit the path buffer
• publish: report ENAMETOOLONG for a tarball path that does not fit the path buffer #38753 publish: report ENAMETOOLONG for a tarball path that does not fit the path buffer

Terminal control-character escaping and credential redaction (9)

• pm view: escape control characters coming from the registry #38536 pm view: escape control characters coming from the registry
• install: redact secrets in the URLs printed for failed manifest and tarball downloads #38817 install: redact secrets in the URLs printed for failed manifest and tarball downloads
• install: redact the registry URL in the manifest/tarball URL errors and keep namedRegistries credentials out of bun.lock #38997 install: redact the registry URL in the manifest/tarball URL errors and keep namedRegistries credentials out of bun.lock
• install: escape control characters in the bun pm untrusted/trust script listing #38525 install: escape control characters in the bun pm untrusted/trust script listing
• install: reject dependency names containing control characters #38615 install: reject dependency names containing control characters
• http: escape control characters in the verbose request/response trace #38673 http: escape control characters in the verbose request/response trace
• pm licenses: escape control characters in text output (adds bun_core::fmt::escape_control_chars) #39358 pm licenses: escape control characters in text output, including the name@version column
• install: escape control characters in resolutions, specifiers, bin names and registry error text #38631 install: escape control characters in resolutions, specifiers, bin names and registry error text
• install: redact credentials in tarball and git URLs printed as resolutions and specifiers #38977 install: redact credentials in tarball and git URLs printed as resolutions and specifiers

Registry auth, .npmrc, proxies, URL parsing (16)

• install: keep registry credentials across redirects to the same hostname #38001 install: keep registry credentials across redirects to the same hostname
• install: read NPM_CONFIG_USERCONFIG as the user-level .npmrc path #38047 install: read NPM_CONFIG_USERCONFIG as the user-level .npmrc path
• publish, pm whoami: route registry requests through http_proxy #38075 publish, pm whoami: route registry requests through http_proxy
• install: make BUN_CONFIG_NO_VERIFY disable integrity verification when set #38310 install: make BUN_CONFIG_NO_VERIFY disable integrity verification when set
• install: honor BUN_CONFIG_MAX_HTTP_REQUESTS #38744 install: honor BUN_CONFIG_MAX_HTTP_REQUESTS
• url: emit a single slash in href_without_auth() for root-path registry URLs #38812 url: emit a single slash in href_without_auth() for root-path registry URLs
• url: parse the host of a protocol-relative URL instead of leaving the authority in the path #39000 url: parse the host of a protocol-relative URL instead of leaving the authority in the path
• install: say --network-concurrency defaults to 64 in help and docs #38759 install: say --network-concurrency defaults to 64 in help and docs
• http: report a refused HTTP client thread as an error instead of a crash #38766 http: report a refused HTTP client thread as an error instead of a crash
• install: send credentials embedded in a registry URL that comes from an env var #38834 install: send credentials embedded in a registry URL that comes from an env var
• install: send Basic auth for a registry URL with a username but no password #39063 install: send Basic auth for a registry URL with a username but no password
• install: replace an existing manifest cache entry atomically instead of unlinking it first #38916 install: replace an existing manifest cache entry atomically instead of unlinking it first
• install: warn when a registry manifest advertises an integrity hash bun cannot use #38484 install: warn when a registry manifest advertises an integrity hash bun cannot use
• publish, pm whoami, audit: honor NODE_TLS_REJECT_UNAUTHORIZED=0 like bun install #38093 publish, pm whoami, audit: honor NODE_TLS_REJECT_UNAUTHORIZED=0 like bun install
• Normalize http_proxy/https_proxy env values through the WHATWG parser #38043 Normalize http_proxy/https_proxy env values through the WHATWG parser
• install: resolve .npmrc //host/ credentials by request URL #38800 install: resolve .npmrc //host/ credentials by request URL

bun pm subcommands, audit, help text (14)

• bun why: print a package's dependents once, mark repeats as *deduped #37922 bun why: print a package's dependents once, mark repeats as *deduped
• pm pkg: support arrays in set and delete #38025 pm pkg: support arrays in set and delete
• install: format versions with the string buffer they were parsed from (bun outdated table, minimum-release-age messages) #38649 install: format versions with the string buffer they were parsed from (bun outdated table, minimum-release-age messages)
• audit: list --production, --omit, --dry-run and --cwd in bun audit --help #38836 audit: list --production, --omit, --dry-run and --cwd in bun audit --help
• install: say --ignore-scripts also skips trusted dependencies' scripts in --help #38893 install: say --ignore-scripts also skips trusted dependencies' scripts in --help
• pm: polish dedupe, prune, pm ls and pm licenses output #38952 pm: polish dedupe, prune, pm ls and pm licenses output
• prune: add --check, a CI gate that exits 1 when anything would be removed #39216 prune: add --check, a CI gate that exits 1 when anything would be removed
• audit fix: never downgrade a package out of its installed release line #39317 audit fix: never downgrade a package out of its installed release line
• pm view: match the requested range against the buffer it was parsed from #38671 pm view: match the requested range against the buffer it was parsed from
• Make bun pm ls list installed packages instead of lockfile entries #38923 Make bun pm ls list installed packages instead of lockfile entries
• cli: load a package.json and name a lockfile load step from one place #39165 cli: load a package.json and name a lockfile load step from one place
• install: describe the real --save default in bun link and bun unlink --help #38915 install: describe the real --save default in bun link and bun unlink --help
• audit fix: report and rewrite the overrides rule that holds a vulnerable version #38785 audit fix: report and rewrite the overrides rule that holds a vulnerable version
• Add --why to bun dedupe to show one level of dependents under each row #39217 Add --why to bun dedupe to show one level of dependents under each row

bun pm pack / bun publish (13)

• run: set npm_package_name/version/json and npm_config_local_prefix per run #38071 run: set npm_package_name/version/json and npm_config_local_prefix per run
• publish: resolve a relative tarball path against the invoking directory #38704 publish: resolve a relative tarball path against the invoking directory
• pack, publish: include entries on filesystems whose readdir reports DT_UNKNOWN #38716 pack, publish: include entries on filesystems whose readdir reports DT_UNKNOWN
• pack: build the tarball in memory and write it out only once it is complete #38721 pack: build the tarball in memory and write it out only once it is complete
• publish: accept basic auth credentials from .npmrc and bunfig.toml #38776 publish: accept basic auth credentials from .npmrc and bunfig.toml
• publish: honor publishConfig.registry and publishConfig["@scope:registry"] #38322 publish: honor publishConfig.registry and publishConfig["@scope:registry"]
• pack: skip bins reached through symlinks; publish: do not read the readme through a symlink #38707 pack: skip bins reached through symlinks; publish: do not read the readme through a symlink
• pack: store tarball entry names byte for byte #38715 pack: store tarball entry names byte for byte
• pack: pack a file listed under several bin names once, strip the trailing slash from directories.bin #38720 pack: pack a file listed under several bin names once, strip the trailing slash from directories.bin
• pm pack: resolve relative --destination and --filename against the invoking directory #38739 pm pack: resolve relative --destination and --filename against the invoking directory
• pack/publish: resolve workspace: and catalog: specs from the package.json files, not bun.lock #38813 pack/publish: resolve workspace: and catalog: specs from the package.json files, not bun.lock
• pack: publish workspace: directory dependencies as the workspace's version #38835 pack: publish workspace: directory dependencies as the workspace's version
• pack: publish workspace: aliases as npm: aliases #38788 pack: publish workspace: aliases as npm: aliases

Linkers, bins, node_modules layout (9)

• install(hoisted): track replaced folders instead of deferring and re-verifying nested skips #38303 install(hoisted): track replaced folders instead of deferring and re-verifying nested skips
• Resolve dangling node_modules symlinks as missing modules; isolated installs unlink failed optional dependencies #38756 Resolve dangling node_modules symlinks as missing modules; isolated installs unlink failed optional dependencies
• install: link packages into a staging directory and rename them into place #38783 install: link packages into a staging directory and rename them into place
• bunx: resolve directories.bin relative to the package #39096 bunx: resolve directories.bin relative to the package
• install: remove the node_modules links of a renamed or removed workspace #38511 install: remove the node_modules links of a renamed or removed workspace
• install: reinstall node_modules when switching between the isolated and hoisted linkers #38779 install: reinstall node_modules when switching between the isolated and hoisted linkers
• install: keep linking the remaining bins when one bin or one dependency's bins fail to link #38972 install: keep linking the remaining bins when one bin or one dependency's bins fail to link
• install: link over an empty directory left at node_modules/<pkg> with the isolated linker #37757 install: link over an empty directory left at node_modules/ with the isolated linker
• install(windows): store an absolute target in .bunx shims when the package dir is on another drive #38018 install(windows): store an absolute target in .bunx shims when the package dir is on another drive

Lifecycle scripts, env, minimum-release-age, semver, auto-install (17)

• install: drop the duplicated warn: label from the verbose tarball retry notice #38648 install: drop the duplicated warn: label from the verbose tarball retry notice
• install: fix node-gyp shim PATH entry after tempdir falls back to cache/.tmp #38098 install: fix node-gyp shim PATH entry after tempdir falls back to cache/.tmp
• install: set npm_config_local_prefix and npm_package_config_* for lifecycle scripts #38110 install: set npm_config_local_prefix and npm_package_config_* for lifecycle scripts
• install: install a git dependency's devDependencies before running its prepare scripts #38810 install: install a git dependency's devDependencies before running its prepare scripts
• install: skip root lifecycle scripts and the yarn.lock write under --dry-run #38830 install: skip root lifecycle scripts and the yarn.lock write under --dry-run
• install: remove the same-filesystem probe from $TMPDIR when the rename into the cache fails #38859 install: remove the same-filesystem probe from $TMPDIR when the rename into the cache fails
• install: print version before package name in the minimum-release-age error #37895 install: print version before package name in the minimum-release-age error
• install: support name@version entries in minimumReleaseAgeExcludes #37909 install: support name@version entries in minimumReleaseAgeExcludes
• install: do not resolve an exact version from an abbreviated manifest under minimum-release-age #38659 install: do not resolve an exact version from an abbreviated manifest under minimum-release-age
• semver: print the build tag from the printed version's buffer in the colored version diff #38688 semver: print the build tag from the printed version's buffer in the colored version diff
• resolver: make auto-install use the version range from the project's package.json #38198 resolver: make auto-install use the version range from the project's package.json
• run, install: honor --no-env-file / --env-file for scripts run through the bun exec hop #38182 run, install: honor --no-env-file / --env-file for scripts run through the bun exec hop
• install: warn instead of failing when minimum-release-age blocks a peer dependency #38995 install: warn instead of failing when minimum-release-age blocks a peer dependency
• semver: record cloned prerelease/build tag offsets against the whole destination buffer #38687 semver: record cloned prerelease/build tag offsets against the whole destination buffer
• auto-install: report why a root dependency could not be resolved #38180 auto-install: report why a root dependency could not be resolved
• install: only open package.json for writing in the commands that rewrite it #38745 install: only open package.json for writing in the commands that rewrite it
• install: filter optionalDependencies by libc and record it in the lockfile #38797 install: filter optionalDependencies by libc and record it in the lockfile

Test-only changes (13)

• test(install): serve URL tarball dependencies locally in bun-install.test.ts #37919 test(install): serve URL tarball dependencies locally in bun-install.test.ts
• test(install): keep bun-update-security-provider on the dummy registry, assert the update, run concurrently #38185 test(install): keep bun-update-security-provider on the dummy registry, assert the update, run concurrently
• test(install): give each long-label bun patch test its own install cache #38255 test(install): give each long-label bun patch test its own install cache
• test(bunx): install fixture packages from a local registry instead of real ones #38467 test(bunx): install fixture packages from a local registry instead of real ones
• test(install): don't require the refetched manifest to be cached before install exits #38580 test(install): don't require the refetched manifest to be cached before install exits
• test(install): normalize the registry URL, not the bare port, in the lockb print snapshot #38627 test(install): normalize the registry URL, not the bare port, in the lockb print snapshot
• test(harness): let verdaccio pick its own port and fail start() when it exits early #38891 test(harness): let verdaccio pick its own port and fail start() when it exits early
• test(install): run overrides.test.ts against the local registry #39022 test(install): run overrides.test.ts against the local registry
• test(install): serve GitHub tarball fixtures locally in the GHSA-pfwx-36v6-832x and lifecycle script tests #39115 test(install): serve GitHub tarball fixtures locally in the GHSA-pfwx-36v6-832x and lifecycle script tests
• test: add a harness isRoot and skip the chmod-based ls and Bun.file cases as root #39232 test: add a harness isRoot and skip the chmod-based ls and Bun.file cases as root
• test(install): speed up bun-install.test.ts and tighten its assertions #38464 test(install): speed up bun-install.test.ts and tighten its assertions
• test(install): run bun-install-registry.test.ts concurrently and tighten its assertions #38504 test(install): run bun-install-registry.test.ts concurrently and tighten its assertions
• test/docker: wait for the docker daemon in the coordinator instead of failing on a one-shot probe #39243 test/docker: wait for the docker daemon in the coordinator instead of failing on a one-shot probe

Platform-specific (5)

• install: schedule the Windows hardlink task through the allocation's own pointer #37865 install: schedule the Windows hardlink task through the allocation's own pointer
• install.ps1: make the "another bun.exe is already in PATH" check work #38567 install.ps1: make the "another bun.exe is already in PATH" check work
• install: don't issue openat2/fchmodat2 on Android (seccomp SIGSYS) #39084 install: don't issue openat2/fchmodat2 on Android (seccomp SIGSYS)
• bunx: serialize concurrent installs into the shared cache dir with a file lock #37851 bunx: serialize concurrent installs into the shared cache dir with a file lock
• Fix bun install through subst drives, cross-drive junctions, and symlinked package.json #39361 Fix bun install through subst drives, cross-drive junctions, and symlinked package.json

Verification

• cargo check --workspace
• cargo clippy --workspace --no-deps
• debug build
• test/cli/install/** locally
• CI

[robobun]

^{Updated 9:33 PM PT - Aug 16th, 2026}

❌ @Jarred-Sumner, your commit 2381dc6 has 26 failures in Build #99835 (All Failures):

• test/cli/install/bun-lock.test.ts - code 1 on 🐧 3.23 aarch64
• test/cli/install/bun-lock.test.ts - code 1 on 🐧 25.04 aarch64
• test/cli/install/bun-lock.test.ts - code 1 on 🐧 13 aarch64
• test/cli/install/bun-lock.test.ts - code 1 on 🐧 13 x64-asan
• test/cli/install/bun-lock.test.ts - code 1 on 🐧 3.23 x64
• test/cli/install/bun-lock.test.ts - code 1 on 🪟 2019 x64
• test/cli/install/bun-lock.test.ts - code 1 on 🐧 25.04 x64
• test/cli/install/bun-lock.test.ts - code 1 on 🐧 13 x64
• test/cli/install/bun-lock.test.ts - code 1 on 🪟 11 aarch64
• test/cli/install/bun-lock.test.ts - code 1 on 🍎 any aarch64
• test/cli/install/bun-install-thread-spawn-failure.test.ts - code 1 on 🐧 13 x64-asan (new)
• test/cli/install/bun-update-security-provider.test.ts - code 1 on 🐧 25.04 aarch64
• test/cli/install/bun-update-security-provider.test.ts - code 1 on 🐧 13 x64-asan
• test/cli/install/bun-update-security-provider.test.ts - code 1 on 🐧 13 aarch64
• test/cli/install/bun-update-security-provider.test.ts - code 1 on 🐧 25.04 x64
• test/cli/install/bun-update-security-provider.test.ts - code 1 on 🐧 13 x64
• test/cli/install/bun-update-security-provider.test.ts - code 1 on 🐧 3.23 aarch64
• test/cli/install/bun-update-security-provider.test.ts - code 1 on 🐧 3.23 x64
• test/cli/install/bun-update-security-provider.test.ts - code 1 on 🪟 2019 x64
• test/cli/install/bun-update-security-provider.test.ts - code 1 on 🪟 11 aarch64
• test/cli/install/bun-update-security-provider.test.ts - code 1 on 🍎 any aarch64
• test/cli/install/minimum-release-age.test.ts - code 1 on 🐧 13 aarch64
• test/cli/install/minimum-release-age.test.ts - code 1 on 🐧 25.04 aarch64
• test/cli/install/minimum-release-age.test.ts - code 1 on 🐧 3.23 aarch64
• test/cli/install/minimum-release-age.test.ts - code 1 on 🐧 3.23 x64
• test/cli/install/minimum-release-age.test.ts - code 1 on 🐧 13 x64
• test/cli/install/minimum-release-age.test.ts - code 1 on 🐧 25.04 x64
• test/cli/install/minimum-release-age.test.ts - code 1 on 🐧 13 x64-asan
• test/cli/install/minimum-release-age.test.ts - code 1 on 🪟 2019 x64
• test/cli/install/minimum-release-age.test.ts - code 1 on 🪟 11 aarch64
• test/cli/install/minimum-release-age.test.ts - code 1 on 🍎 any aarch64
• test/cli/install/bun-install-proxy.test.ts - code 1 on 🐧 3.23 aarch64
• test/cli/install/bun-install-proxy.test.ts - code 1 on 🐧 3.23 x64
• test/cli/install/bun-install-proxy.test.ts - code 1 on 🐧 13 aarch64
• test/cli/install/bun-install-proxy.test.ts - code 1 on 🐧 25.04 aarch64
• test/cli/install/bun-install-proxy.test.ts - code 1 on 🐧 13 x64-asan
• test/cli/install/bun-install-proxy.test.ts - code 1 on 🪟 2019 x64
• test/cli/install/bun-install-proxy.test.ts - code 1 on 🐧 25.04 x64
• test/cli/install/bun-install-proxy.test.ts - code 1 on 🐧 13 x64
• test/cli/install/bun-install-proxy.test.ts - code 1 on 🪟 11 aarch64
• test/cli/install/bun-install-proxy.test.ts - code 1 on 🍎 any aarch64
• test/cli/install/migration/yarn-lock-migration.test.ts - code 1 on 🐧 25.04 aarch64
• test/cli/install/migration/yarn-lock-migration.test.ts - code 1 on 🐧 3.23 aarch64
• test/cli/install/migration/yarn-lock-migration.test.ts - code 1 on 🐧 3.23 x64
• test/cli/install/migration/yarn-lock-migration.test.ts - code 1 on 🐧 13 aarch64
• test/cli/install/migration/yarn-lock-migration.test.ts - code 1 on 🐧 13 x64-asan
• test/cli/install/migration/yarn-lock-migration.test.ts - code 1 on 🐧 13 x64
• test/cli/install/migration/yarn-lock-migration.test.ts - code 1 on 🐧 25.04 x64
• test/cli/install/migration/yarn-lock-migration.test.ts - code 1 on 🪟 2019 x64
• test/cli/install/migration/yarn-lock-migration.test.ts - code 1 on 🪟 11 aarch64
• test/cli/install/migration/yarn-lock-migration.test.ts - code 1 on 🍎 any aarch64
• test/cli/install/migration/pnpm-lock-v9.test.ts - code 1: error: "NO_DEPS_1_1_0_INTEGRITY" has already been declared on 🐧 3.23 aarch64
• test/cli/install/migration/pnpm-lock-v9.test.ts - code 1: error: "NO_DEPS_1_1_0_INTEGRITY" has already been declared on 🐧 13 x64-asan
• test/cli/install/migration/pnpm-lock-v9.test.ts - code 1: error: "NO_DEPS_1_1_0_INTEGRITY" has already been declared on 🐧 3.23 x64
• test/cli/install/migration/pnpm-lock-v9.test.ts - code 1: error: "NO_DEPS_1_1_0_INTEGRITY" has already been declared on 🐧 25.04 aarch64
• test/cli/install/migration/pnpm-lock-v9.test.ts - code 1: error: "NO_DEPS_1_1_0_INTEGRITY" has already been declared on 🐧 13 aarch64
• test/cli/install/migration/pnpm-lock-v9.test.ts - code 1: error: "NO_DEPS_1_1_0_INTEGRITY" has already been declared on 🐧 25.04 x64
• test/cli/install/migration/pnpm-lock-v9.test.ts - code 1: error: "NO_DEPS_1_1_0_INTEGRITY" has already been declared on 🐧 13 x64
• test/cli/install/migration/pnpm-lock-v9.test.ts - code 1: error: "NO_DEPS_1_1_0_INTEGRITY" has already been declared on 🪟 2019 x64
• test/cli/install/migration/pnpm-lock-v9.test.ts - code 1: error: "NO_DEPS_1_1_0_INTEGRITY" has already been declared on 🪟 11 aarch64
• test/cli/install/migration/pnpm-lock-v9.test.ts - code 1: error: "NO_DEPS_1_1_0_INTEGRITY" has already been declared on 🍎 any aarch64
• test/cli/install/isolated-relink.test.ts - code 1 on 🐧 13 aarch64
• test/cli/install/isolated-relink.test.ts - code 1 on 🐧 13 x64-asan
• test/cli/install/isolated-relink.test.ts - code 1 on 🐧 3.23 aarch64
• test/cli/install/isolated-relink.test.ts - code 1 on 🐧 13 x64
• test/cli/install/isolated-relink.test.ts - code 1 on 🪟 2019 x64
• test/cli/install/isolated-relink.test.ts - code 1 on 🪟 11 aarch64
• test/cli/install/isolated-relink.test.ts - code 1 on 🍎 any aarch64
• test/cli/install/bun-update-transitive.test.ts - code 1 on 🐧 25.04 aarch64
• test/cli/install/bun-update-transitive.test.ts - code 1 on 🐧 13 aarch64
• test/cli/install/bun-update-transitive.test.ts - code 1 on 🐧 25.04 x64
• test/cli/install/bun-update-transitive.test.ts - code 1 on 🐧 13 x64
• test/cli/install/bun-update-transitive.test.ts - code 1 on 🐧 3.23 aarch64
• test/cli/install/bun-update-transitive.test.ts - code 1 on 🐧 13 x64-asan
• test/cli/install/bun-update-transitive.test.ts - code 1 on 🪟 2019 x64
• test/cli/install/bun-update-transitive.test.ts - code 1 on 🐧 3.23 x64
• test/cli/install/bun-update-transitive.test.ts - code 1 on 🪟 11 aarch64
• test/cli/install/bun-update-transitive.test.ts - code 1 on 🍎 any aarch64
• test/cli/install/bun-pack.test.ts - code 1 on 🐧 13 x64-asan
• test/cli/install/bun-pack.test.ts - code 1 on 🐧 25.04 aarch64
• test/cli/install/bun-pack.test.ts - code 1 on 🐧 3.23 aarch64
• test/cli/install/bun-pack.test.ts - code 1 on 🐧 3.23 x64
• test/cli/install/bun-pack.test.ts - code 1 on 🐧 13 aarch64
• test/cli/install/bun-pack.test.ts - code 1 on 🐧 25.04 x64
• test/cli/install/bun-pack.test.ts - code 1 on 🐧 13 x64
• test/cli/install/bun-pack.test.ts - code 1 on 🍎 any aarch64
• test/cli/install/bun-prune.test.ts - code 1 on 🐧 25.04 aarch64
• test/cli/install/bun-prune.test.ts - code 1 on 🐧 13 aarch64
• test/cli/install/bun-prune.test.ts - code 1 on 🐧 3.23 aarch64
• test/cli/install/bun-prune.test.ts - code 1 on 🐧 3.23 x64
• test/cli/install/bun-prune.test.ts - code 1 on 🐧 25.04 x64
• test/cli/install/bun-prune.test.ts - code 1 on 🐧 13 x64
• test/cli/install/bun-prune.test.ts - code 1 on 🪟 2019 x64
• test/cli/install/bun-prune.test.ts - code 1 on 🪟 11 aarch64
• test/cli/install/bun-prune.test.ts - code 1 on 🐧 13 x64-asan
• test/cli/install/bun-prune.test.ts - code 1 on 🍎 any aarch64
• test/cli/install/migration/migrate.test.ts - code 1 on 🐧 25.04 aarch64
• test/cli/install/migration/migrate.test.ts - code 1 on 🐧 13 aarch64
• test/cli/install/migration/migrate.test.ts - code 1 on 🐧 13 x64-asan
• test/cli/install/migration/migrate.test.ts - code 1 on 🐧 25.04 x64
• test/cli/install/migration/migrate.test.ts - code 1 on 🐧 13 x64
• test/cli/install/migration/migrate.test.ts - code 1 on 🐧 3.23 aarch64
• test/cli/install/migration/migrate.test.ts - code 1 on 🐧 3.23 x64
• test/cli/install/migration/migrate.test.ts - code 1 on 🪟 2019 x64
• test/cli/install/migration/migrate.test.ts - code 1 on 🪟 11 aarch64
• test/cli/install/migration/migrate.test.ts - code 1 on 🍎 any aarch64
• test/cli/install/bun-audit.test.ts - code 1 on 🐧 25.04 aarch64
• test/cli/install/bun-audit.test.ts - code 1 on 🐧 13 x64-asan
• test/cli/install/bun-audit.test.ts - code 1 on 🐧 13 aarch64
• test/cli/install/bun-audit.test.ts - code 1 on 🐧 3.23 aarch64
• test/cli/install/bun-audit.test.ts - code 1 on 🐧 3.23 x64
• test/cli/install/bun-audit.test.ts - code 1 on 🐧 25.04 x64
• test/cli/install/bun-audit.test.ts - code 1 on 🐧 13 x64
• test/cli/install/bun-audit.test.ts - code 1 on 🪟 2019 x64
• test/cli/install/bun-audit.test.ts - code 1 on 🪟 11 aarch64
• test/cli/install/bun-audit.test.ts - code 1 on 🍎 any aarch64
• test/cli/install/bun-install-registry.test.ts - code 1: ReferenceError: isMacOS is not defined on 🐧 25.04 aarch64
• test/cli/install/bun-install-registry.test.ts - code 1: ReferenceError: isMacOS is not defined on 🐧 13 aarch64
• test/cli/install/bun-install-registry.test.ts - code 1: ReferenceError: isMacOS is not defined on 🐧 13 x64-asan
• test/cli/install/bun-install-registry.test.ts - code 1: ReferenceError: isMacOS is not defined on 🐧 25.04 x64
• test/cli/install/bun-install-registry.test.ts - code 1: ReferenceError: isMacOS is not defined on 🐧 13 x64
• test/cli/install/bun-install-registry.test.ts - code 1: ReferenceError: isMacOS is not defined on 🐧 3.23 x64
• test/cli/install/bun-install-registry.test.ts - code 1: ReferenceError: isMacOS is not defined on 🐧 3.23 aarch64
• test/cli/install/bun-install-registry.test.ts - code 1: ReferenceError: isMacOS is not defined on 🪟 2019 x64
• test/cli/install/bun-install-registry.test.ts - code 1: ReferenceError: isMacOS is not defined on 🪟 11 aarch64
• test/cli/install/bun-install.test.ts - code 1: error: Cannot call test() inside a test. Call it inside describe() instead. on 🐧 25.04 aarch64
• test/cli/install/bun-install.test.ts - code 1: error: Cannot call test() inside a test. Call it inside describe() instead. on 🐧 13 aarch64
• test/cli/install/bun-install.test.ts - code 1: error: Cannot call test() inside a test. Call it inside describe() instead. on 🐧 13 x64
• test/cli/install/bun-install.test.ts - code 1: error: Cannot call test() inside a test. Call it inside describe() instead. on 🐧 25.04 x64
• test/cli/install/bun-install.test.ts - code 1: error: Cannot call test() inside a test. Call it inside describe() instead. on 🐧 3.23 aarch64
• test/cli/install/bun-install.test.ts - code 1: error: Cannot call test() inside a test. Call it inside describe() instead. on 🐧 3.23 x64
• test/cli/install/bun-install.test.ts - code 1: error: Cannot call test() inside a test. Call it inside describe() instead. on 🐧 13 x64-asan
• test/cli/install/bun-install.test.ts - code 1: error: Cannot call test() inside a test. Call it inside describe() instead. on 🪟 2019 x64
• test/cli/install/bun-install.test.ts - code 1: error: Cannot call test() inside a test. Call it inside describe() instead. on 🪟 11 aarch64
• test/cli/install/catalogs.test.ts - code 1 on 🐧 13 x64-asan
• test/cli/install/catalogs.test.ts - code 1 on 🐧 3.23 aarch64
• test/cli/install/catalogs.test.ts - code 1 on 🐧 3.23 x64
• test/cli/install/catalogs.test.ts - code 1 on 🐧 13 aarch64
• test/cli/install/catalogs.test.ts - code 1 on 🐧 25.04 aarch64
• test/cli/install/catalogs.test.ts - code 1 on 🐧 25.04 x64
• test/cli/install/catalogs.test.ts - code 1 on 🐧 13 x64
• test/cli/install/catalogs.test.ts - code 1 on 🪟 2019 x64
• test/cli/install/catalogs.test.ts - code 1 on 🪟 11 aarch64
• test/cli/install/catalogs.test.ts - code 1 on 🍎 any aarch64
• test/cli/install/migration/pnpm-lock-migration.test.ts - code 1 on 🐧 25.04 aarch64
• test/cli/install/migration/pnpm-lock-migration.test.ts - code 1 on 🐧 13 aarch64
• test/cli/install/migration/pnpm-lock-migration.test.ts - code 1 on 🐧 3.23 x64
• test/cli/install/migration/pnpm-lock-migration.test.ts - code 1 on 🐧 3.23 aarch64
• test/cli/install/migration/pnpm-lock-migration.test.ts - code 1 on 🐧 25.04 x64
• test/cli/install/migration/pnpm-lock-migration.test.ts - code 1 on 🐧 13 x64
• test/cli/install/migration/pnpm-lock-migration.test.ts - code 1 on 🐧 13 x64-asan
• test/cli/install/migration/pnpm-lock-migration.test.ts - code 1 on 🪟 2019 x64
• test/cli/install/migration/pnpm-lock-migration.test.ts - code 1 on 🪟 11 aarch64
• test/cli/install/migration/pnpm-lock-migration.test.ts - code 1 on 🍎 any aarch64
• test/cli/install/isolated-install.test.ts - pid 3293 crash on 🐧 25.04 aarch64
• test/cli/install/isolated-install.test.ts - pid 2851 crash on 🐧 13 aarch64
• test/cli/install/isolated-install.test.ts - pid 3321 crash on 🐧 25.04 x64
• test/cli/install/isolated-install.test.ts - code 1 on 🐧 13 x64-asan
• test/cli/install/isolated-install.test.ts - pid 2960 crash on 🐧 13 x64
• test/cli/install/isolated-install.test.ts - pid 6084 crash on 🪟 2019 x64
• test/cli/install/isolated-install.test.ts - pid 7572 crash on 🪟 11 aarch64
• test/cli/install/isolated-install.test.ts - core dumped on 🐧 3.23 aarch64
• test/cli/install/isolated-install.test.ts - core dumped on 🐧 3.23 x64
• test/cli/install/isolated-install.test.ts - crash reported on 🍎 any aarch64
• test/cli/install/bun-dedupe.test.ts - code 1 on 🐧 13 x64-asan
• test/cli/install/bun-dedupe.test.ts - code 1 on 🐧 25.04 aarch64
• test/cli/install/bun-dedupe.test.ts - code 1 on 🐧 13 aarch64
• test/cli/install/bun-dedupe.test.ts - code 1 on 🐧 25.04 x64
• test/cli/install/bun-dedupe.test.ts - code 1 on 🐧 3.23 x64
• test/cli/install/bun-dedupe.test.ts - code 1 on 🐧 13 x64
• test/cli/install/bun-dedupe.test.ts - code 1 on 🐧 3.23 aarch64
• test/cli/install/bun-dedupe.test.ts - code 1 on 🪟 2019 x64
• test/cli/install/bun-dedupe.test.ts - code 1 on 🪟 11 aarch64
• test/cli/install/bun-dedupe.test.ts - code 1 on 🍎 any aarch64

---

🧪   To try this PR locally:

bunx bun-pr 39403

That installs a local version of the PR into your bun-39403 executable, so you can run:

bun-39403 --bun