install: fold the open bun install / pm / pack+publish PRs into one branch (171 PRs)

[Jarred-Sumner]

Folds the open bun install / bun pm / pack+publish PRs from Aug 12–17 into one branch so they can be reviewed and landed together. Each original PR is one squashed commit here (<title> (#N)), in dependency order, so git log/git blame attribute every hunk to its PR; conflict resolutions between overlapping PRs live in the later PR's commit. Cross-PR API reconciliation is in the mega-merge fixup: commits at the end, so the per-PR commits after #38804 (e2cf8c4305) do not build on their own until 0adcafaf8b — bisect across the fold with --first-parent on the fixups, not inside it.

171 PRs folded, 3 excluded (see below); #38557 was re-ported by hand onto the newer audit_command.rs. A simplification pass then roughly halved the net src/ addition (see below). cargo check --workspace and cargo clippy --workspace are clean, the debug build links, and all 94 test/cli/install/** files pass locally on Linux (debug+ASAN); see Verification.

Not folded

PR	Why
#37925	semantic conflict with #39002 (which needs optional peers bound at load); #39002 is newer and explicitly calls this out
#38777	security screen: make_executable() follows an absolute bin-target symlink out of a file:/link: package and chmods the real file (CVE-2019-16775 class) when the folder dep resolves to an ancestor dir; needs rework before merging
#38810	dropped on request: installing a git dependency's devDependencies before prepare is rarely needed and runs a nested install (fetching and, via prepare, executing third-party devDependencies chosen by the git repo) outside the project's bunfig protections — too much attack surface for the benefit

Security screen

Every folded diff was reviewed for regressions (path traversal, credential leakage, TLS/integrity weakening, lifecycle-script trust widening, terminal injection, new unsafe on untrusted input). One PR was dropped for it (#38777 above) and one more on review (#38810). Items a reviewer may still want to eyeball — none were judged exploitable regressions:

• bunx: serialize concurrent installs into the shared cache dir with a file lock #37851 (concern, low): bunx serialises concurrent installs into the shared /bunx-- dir with an flock on /.bunx-lock; the lock file is opened by path with O_CREAT|O_RDWR and without O_NOFOLLOW, adding a small symlink-following primitive inside the pre-existing TOCTOU window of the cache-dir trust check.
• install: stamp lockfileVersion 1 on new bun.lock files #38741 (concern, low): New bun.lock files are stamped lockfileVersion 1 instead of 2, so the two v2-only parse-time fail-closed checks (off-registry npm tarball URL without a supported integrity hash; unsafe git .bun-tag) no longer apply to any lockfile created after this lands. The reduction is defence-in-depth only: the checks are keyed on a digit the lockfile tamperer also controls, main already stamps v1 whenever bun's own output would trip them, a tamperer can supply a matching integrity for their own tarball anyway, and the git tag is re-validated at checkout/extract time (repository.rs:923, extract_tarball.rs:484; github tags stay checked at every version).
• install: fix default-trusted lifecycle scripts being blocked after yarn.lock migration #38795 (concern, low): Default-trusted check now ignores the URL fragment; the claim that this is exactly as strict as before is slightly off because bun_url lets a ? after # leak the fragment into the request path, though no attacker-chosen tarball results.
• install: resolve .npmrc //host/ credentials by request URL #38800 (concern, low): .npmrc //host/path/ credentials are now resolved by request URL (npm nerf-dart semantics): scopes without credentials pick them up by registry URL, and tarballs on a host other than the registry get that host's own .npmrc credentials. Scope credentials still never leave the scope origin, but the by-URL match is scheme-agnostic and path-unnormalized, which slightly widens where a registry-controlled dist.tarball can make bun present a token.
• install: migrate a package's own file: directories from package-lock.json relative to the package #38990 (concern, low): package-lock file: targets inside a registry/tarball/git package are now migrated as package-relative folder rows without normalising the sub-path, so a hand-edited key with .. is no longer skipped at migration time and containment relies on the installer (hoisted linker checks it, with an overrides-name exemption; isolated linker does not).
• install: don't issue openat2/fchmodat2 on Android (seccomp SIGSYS) #39084 (concern, low): Skips openat2/fchmodat2 on Android (kernel release contains 'android' OR both ANDROID_ROOT and ANDROID_DATA env vars set); symlink-safety semantics are preserved by the fallbacks, but the env-var trigger lets any environment downgrade RESOLVE_BENEATH/RESOLVE_IN_ROOT hardening on ordinary Linux.

Product-behaviour changes that need a maintainer decision before this lands: #38741 (new bun.lock files are stamped lockfileVersion: 1 again — its own PR defers this to a maintainer, and it obsoletes the open #36464; the sibling snapshots are already re-stamped inside the fold, so pulling it back out is one revert + fixlv), #38797 (libc filtering needs the full registry document for every optional dependency on every OS, since npm's abbreviated document omits libc; measured: @esbuild/linux-x64 43 KB → 54 KB gzipped, @rollup/rollup-linux-x64-gnu 40 KB → 58 KB, one-time per package per manifest cache, in exchange for not downloading the other libc's multi-MB tarballs on Linux and a host-independent lockfile), #38804 (a migrated lockfile and its package.json edits are only written when the command saves a lockfile), #38923 (bun pm ls lists what is installed and exits 1 without node_modules), #38813 (pack/publish resolve workspace:/catalog: from package.json files, not bun.lock).

Simplification pass (after folding)

The PRs were written independently, so the folded diff carried duplicate helpers and a lot of narrative comments. A follow-up pass (the simplify(...) commits) cut the src/ diff against main from +12,081 / −6,723 (net +5,358) to +10,284 / −7,559 (net +2,725) with no behaviour change intended and the full test/cli/install/** suite green before and after. Main items:

• One Lockfile::packages_named / package_satisfying / patched_package_satisfying replaces nine "package_index → first candidate whose resolution satisfies a range and a predicate" helpers spread over lockfile.rs, bun.lock.rs, PackageManagerEnqueue.rs, update_transitive.rs and prune.rs.
• update_transitive.rs (Hold a transitive update that would re-fork a deduped package #38919/install: keep transitive rows on the copy a direct dependency resolves to #38770) no longer re-implements the resolver's rules: it calls keep_locked_if_ahead, is_named_update_row (split out of should_update) and dedupe::applied_override directly, and its Plan/Planned/InstanceEdges/KeepLocked scaffolding is gone; reachability uses lockfile::reachable.
• One checked NUL-terminated join (resolve_path::join_abs_string_buf_z_checked) and one spill helper replace bin.rs::join_z_checked, PackageManager::join_path_z, and pack's normalize_buf_spill; the bunx install lock (bunx: serialize concurrent installs into the shared cache dir with a file lock #37851) is a single InstallLock RAII type.
• Isolated linker: one append_store_path_at(buf, entry, Which) family; PackageInstall::destination_dir_subpath_buf and the DestinationSubpath guard removed in favour of join_z_spill; staging installs re-target a PackageInstall instead of threading dest_subpath through every backend; remove_link shared.
• yarn.rs: one dependency-section table instead of four loops, git URL parsing folded into Entry::set_git_source, root/workspace package.json parsing shared; pnpm.rs: one merge-based copy_into_root, one workspaces object path; finish_migration builds the one error shape.
• Options/registry: RegistryPath, set_scope_registry and the second credential lookup removed in favour of scope_for_package_name + UrlAuth::find; fmt::for_terminal(x) = EscapeControlChars(Redacted(x)) at every call site; MinimumReleaseAgeExcludes is one list.
• Multi-line justification comments added by the PRs trimmed to one line or removed throughout (SAFETY lines kept).

Two small behaviour fixes fell out of the review agents' cross-checks and are their own commits: bun audit fix now rewrites a matching rule in resolutions as well as overrides (the parser reads both since #38811), and a failed root package.json write says failed to write package.json: <errno> instead of for workspace ''.

Conflict resolutions that changed a PR's code (not just context)

• install: resolve deferred * peers after their siblings, not on arrival order #37713 × install: resolve a range onto an existing version only when every install has it #38832: kept install: resolve deferred * peers after their siblings, not on arrival order #37713's rule that a deferred peer never range-matches on sight (no * exemption); install: resolve a range onto an existing version only when every install has it #38832's AppendedFor/settled_package_count model replaces the exact_pinned guard, with install: keep transitive rows on the copy a direct dependency resolves to #38770's direct-dependency clause folded into the reusable predicate.
• install: rebind ranged peers whose target the saved tree drops #38768 × install: keep a peer nothing in bun.lock satisfies where the file records it #38892: resolve_peer_dep_version_based_among keeps install: rebind ranged peers whose target the saved tree drops #38768's candidate filter but drops the highest-candidate fallback install: keep a peer nothing in bun.lock satisfies where the file records it #38892 removed.
• install: bind peer edges in the hoister, the way loading bun.lock binds them #38767/install: keep the packages bun.lock holds only through optional peers when an install re-resolves #39002 vs install: let the hoister bind optional peers when loading bun.lock #37925: install: let the hoister bind optional peers when loading bun.lock #37925 excluded (see above).
• install: keep bundleDependencies from every dependency group when parsing a registry manifest #38857 vs main's collect_bundled_deps refactor: took install: keep bundleDependencies from every dependency group when parsing a registry manifest #38857's per-version bundled_dependencies list.
• install: migrate workspace packages from yarn.lock #38878 (yarn migrator rewrite) absorbed install: bind peer edges in the hoister, the way loading bun.lock binds them #38767's yarn index change; install: fix yarn.lock migration panic on tarball URLs with "/-/" right after the host #38803/install: name yarn.lock npm: alias packages after the alias spec, not the tarball URL #38948/install: migrate yarn.lock registry entries that have no resolved field #38985/install: skip yarn.lock entries the migration cannot build a resolution for #39001 re-applied onto the rewritten migrator (install: skip yarn.lock entries the migration cannot build a resolution for #39001's id remap now runs right after the append loop).
• install: import pnpm-workspace.yaml even without a migratable pnpm-lock.yaml #38754/install: keep the pnpm block in package.json when migrating from pnpm #38775/install: migrate pnpm onlyBuiltDependencies and report blocked scripts under the isolated linker #38780/install: write a migrated lockfile and its package.json edits only when the command saves a lockfile #38804 in pnpm.rs: one update_package_json_after_migration(lockfile: Option<&mut Lockfile>, …); everything is reported as “copied … in package.json” (pnpm keeps reading its own block), the write is deferred to lockfile save (install: write a migrated lockfile and its package.json edits only when the command saves a lockfile #38804), and bun pm migrate on a read-only package.json reports the failed write but keeps the migrated bun.lock (install: only open package.json for writing in the commands that rewrite it #38745's intent).
• publish: honor publishConfig.registry and publishConfig["@scope:registry"] #38322 re-based onto install: resolve .npmrc //host/ credentials by request URL #38800's url_auth model instead of adding a second .npmrc credential table; --registry goes through the same set_default_registry path unless the URL itself carries credentials (install: send credentials embedded in a registry URL that comes from an env var #38834).
• install: escape control characters in resolutions, specifiers, bin names and registry error text #38631/install: redact credentials in tarball and git URLs printed as resolutions and specifiers #38977 at shared print sites resolve to EscapeControlChars(redacted(…)) (redact inside, escape outside); one EscapeControlChars implementation (the multiline-capable one from pm view: escape control characters coming from the registry #38536) is kept.
• install: fail the isolated install with ENAMETOOLONG when a link: target does not fit the path buffer #38369 on top of the refactored isolated linker: symlink_dependencies returns Result<bool, TaskError> so LinkPathTooLong still names the package.
• auto-install: report why a root dependency could not be resolved #38180: fail_fn removed as in the PR; the invalid-name path from install: reject dependency names containing control characters #38615 now logs like the other root-resolution errors.
• install: fail the isolated install when a link: dependency's target is missing #38045 × install: fail the isolated install with ENAMETOOLONG when a link: target does not fit the path buffer #38369 (isolated linker): symlink entries build their target through append_dependency_path, which now joins with the ..-normalising checked join, so a link:/file: target that only overflows once joined reports LinkPathTooLong instead of hitting the "packages have no store path" unreachable.
• install: migrate pnpm onlyBuiltDependencies and report blocked scripts under the isolated linker #38780 × install: link packages into a staging directory and rename them into place #38783: count_blocked_scripts reads lifecycle scripts from the final node_modules location for local (non-global-store) entries.
• install: keep transitive rows on the copy a direct dependency resolves to #38770 × Hold a transitive update that would re-fork a deduped package #38919: bun update no longer treats a workspace member that was removed from workspaces as a direct-dependency owner, so its former deps can move.
• install: stop panicking on bin values longer than the path buffer #38954 × test(install): run bun-install-registry.test.ts concurrently and tighten its assertions #38504: the long-bin-value tests set up their own directory per test (the file now runs under describe.concurrent).
• install: import pnpm-workspace.yaml even without a migratable pnpm-lock.yaml #38754 × install: write a migrated lockfile and its package.json edits only when the command saves a lockfile #38804: with the migrated package.json written at flush time, a read-only package.json fails the install with failed to write package.json: EACCES after the lockfile is saved (test updated).
• test(install): keep bun-update-security-provider on the dummy registry, assert the update, run concurrently #38185: bun update moo keeps a >=0.1.0 literal that still covers the new version (main's behaviour); the test asserted ^0.2.0.
• http: report a refused HTTP client thread as an error instead of a crash #38766: the pthread_create LD_PRELOAD shim cannot interpose on ASAN builds (the executable's own interceptor wins), so that file skips under ASAN like it already does on musl.
• test(install): run bun-install-registry.test.ts concurrently and tighten its assertions #38504: tests other PRs added to bun-install-registry.test.ts against the old shared packageDir now call setupTest().

Folded PRs

Peer binding, hoisting, bun.lock load/round-trip, resolver dedupe (21)

• install: bind peer edges in the hoister, the way loading bun.lock binds them #38767 install: bind peer edges in the hoister, the way loading bun.lock binds them
• install: keep transitive rows on the copy a direct dependency resolves to #38770 install: keep transitive rows on the copy a direct dependency resolves to
• install: load root and workspace dependencies from bun.lock the way package.json parses them #38869 install: load root and workspace dependencies from bun.lock the way package.json parses them
• install: keep a peer nothing in bun.lock satisfies where the file records it #38892 install: keep a peer nothing in bun.lock satisfies where the file records it
• install: re-resolve a peer row instead of binding it to a stale bun.lock leftover #38901 install: re-resolve a peer row instead of binding it to a stale bun.lock leftover
• install: keep the packages bun.lock holds only through optional peers when an install re-resolves #39002 install: keep the packages bun.lock holds only through optional peers when an install re-resolves
• install: bind unbound required peers while hoisting, like optional peers #39343 install: bind unbound required peers while hoisting, like optional peers
• install: bind a multi-path package's edges from the bun.lock row that prints the binding #39347 install: bind a multi-path package's edges from the bun.lock row that prints the binding
• install: only re-resolve rows a package still owns when overrides or catalogs change #38849 install: only re-resolve rows a package still owns when overrides or catalogs change
• install: resolve deferred * peers after their siblings, not on arrival order #37713 install: resolve deferred * peers after their siblings, not on arrival order
• install: rebind ranged peers whose target the saved tree drops #38768 install: rebind ranged peers whose target the saved tree drops
• install: resolve a range onto an existing version only when every install has it #38832 install: resolve a range onto an existing version only when every install has it
• install: keep a bundle's dependency out of a slot the bundling package resolves through #38848 install: keep a bundle's dependency out of a slot the bundling package resolves through
• test(install): pin both no-deps versions instead of racing a range against a pin #38858 test(install): pin both no-deps versions instead of racing a range against a pin
• install: keep bundled peer edges on their own bun.lock entry when loading #38837 install: keep bundled peer edges on their own bun.lock entry when loading
• install: keep bundleDependencies from every dependency group when parsing a registry manifest #38857 install: keep bundleDependencies from every dependency group when parsing a registry manifest
• Hold a transitive update that would re-fork a deduped package #38919 Hold a transitive update that would re-fork a deduped package
• install: stop hoisting a dependency cycle forever #38976 install: stop hoisting a dependency cycle forever
• install: warn when the hoisted tree serves a peer from a root copy outside its range #39053 install: warn when the hoisted tree serves a peer from a root copy outside its range
• install: stamp lockfileVersion 1 on new bun.lock files #38741 install: stamp lockfileVersion 1 on new bun.lock files
• test(install): establish the warm manifest cache before the unmet peer test re-resolves #39190 test(install): establish the warm manifest cache before the unmet peer test re-resolves

bun update / bun add package.json edits, overrides (7)

• install: print the update row for catalog entries moved by bun update #38763 install: print the update row for catalog entries moved by bun update
• install: keep workspace and other non-registry entries as written on bun update <name> #38847 install: keep workspace and other non-registry entries as written on bun update
• Report package.json sync in the bun update summary instead of (no changes) #38918 Report package.json sync in the bun update summary instead of (no changes)
• install: ignore leading whitespace in dist-tag, bare folder and local tarball versions #38331 install: ignore leading whitespace in dist-tag, bare folder and local tarball versions
• install: apply both "overrides" and "resolutions" when package.json has both #38811 install: apply both "overrides" and "resolutions" when package.json has both
• install: keep the workspace: spelling given to bun add <member>@workspace:<range> #38866 install: keep the workspace: spelling given to bun add @workspace:
• install: ignore leading whitespace wherever a dependency literal is classified or re-parsed #38309 install: ignore leading whitespace wherever a dependency literal is classified or re-parsed

Lockfile migration (yarn / pnpm / npm) (17)

• Fix package-lock.json migration for scope registries configured without a trailing slash #38698 Fix package-lock.json migration for scope registries configured without a trailing slash
• install: record package.json trustedDependencies when migrating a lockfile #38773 install: record package.json trustedDependencies when migrating a lockfile
• install: keep the pnpm block in package.json when migrating from pnpm #38775 install: keep the pnpm block in package.json when migrating from pnpm
• install: fix default-trusted lifecycle scripts being blocked after yarn.lock migration #38795 install: fix default-trusted lifecycle scripts being blocked after yarn.lock migration
• install: migrate the whole pnpm-workspace.yaml catalog into bun.lock #38829 install: migrate the whole pnpm-workspace.yaml catalog into bun.lock
• install: migrate a package's own file: directories from package-lock.json relative to the package #38990 install: migrate a package's own file: directories from package-lock.json relative to the package
• install: migrate pnpm onlyBuiltDependencies and report blocked scripts under the isolated linker #38780 install: migrate pnpm onlyBuiltDependencies and report blocked scripts under the isolated linker
• install: import pnpm-workspace.yaml even without a migratable pnpm-lock.yaml #38754 install: import pnpm-workspace.yaml even without a migratable pnpm-lock.yaml
• install: skip workspace members whose package.json has no name #38781 install: skip workspace members whose package.json has no name
• install: migrate pnpm importer rows in the shape package.json parsing produces #38791 install: migrate pnpm importer rows in the shape package.json parsing produces
• install: migrate workspace packages from yarn.lock #38878 install: migrate workspace packages from yarn.lock
• install: fix yarn.lock migration panic on tarball URLs with "/-/" right after the host #38803 install: fix yarn.lock migration panic on tarball URLs with "/-/" right after the host
• install: name yarn.lock npm: alias packages after the alias spec, not the tarball URL #38948 install: name yarn.lock npm: alias packages after the alias spec, not the tarball URL
• install: migrate yarn.lock registry entries that have no resolved field #38985 install: migrate yarn.lock registry entries that have no resolved field
• install: skip yarn.lock entries the migration cannot build a resolution for #39001 install: skip yarn.lock entries the migration cannot build a resolution for
• install: migrate npm-shrinkwrap.json like package-lock.json #38861 install: migrate npm-shrinkwrap.json like package-lock.json
• install: write a migrated lockfile and its package.json edits only when the command saves a lockfile #38804 install: write a migrated lockfile and its package.json edits only when the command saves a lockfile

file: / link: / tarball / git local dependencies (16)

• install: fail the isolated install when a link: dependency's target is missing #38045 install: fail the isolated install when a link: dependency's target is missing
• install: read the package.json of a file: dependency declared by a local file: package #38814 install: read the package.json of a file: dependency declared by a local file: package
• install: keep file: folder paths declared by git and tarball packages relative to the package #38816 install: keep file: folder paths declared by git and tarball packages relative to the package
• install: drop the query string and fragment from a tarball URL's extraction folder name #39011 install: drop the query string and fragment from a tarball URL's extraction folder name
• install: cache file: tarballs under the integrity the lockfile pins #39016 install: cache file: tarballs under the integrity the lockfile pins
• install: reject tarball, folder and git packages whose package.json name is invalid #38633 install: reject tarball, folder and git packages whose package.json name is invalid
• install: read git+git:// resolutions back from bun.lock #38798 install: read git+git:// resolutions back from bun.lock
• install: resolve file: dependencies loaded from the lockfile relative to the top-level dir #38850 install: resolve file: dependencies loaded from the lockfile relative to the top-level dir
• install: link file: dependencies of registry packages from inside the package with the isolated linker #38856 install: link file: dependencies of registry packages from inside the package with the isolated linker
• install: bound isolated store entry names; tarball URL credentials; file: tarballs relative to their folder package #38867 install: bound isolated store entry names; tarball URL credentials; file: tarballs relative to their folder package
• install: refuse local tarball dependencies declared by packages installed from the cache #38986 install: refuse local tarball dependencies declared by packages installed from the cache
• install(hoisted): link a file: override applied to a dependency of an installed package #38994 install(hoisted): link a file: override applied to a dependency of an installed package
• install: refuse link: paths with .. or an absolute path declared by packages installed from the cache #39023 install: refuse link: paths with .. or an absolute path declared by packages installed from the cache
• install: name folder, tarball and git packages without a package.json name after their source #38681 install: name folder, tarball and git packages without a package.json name after their source
• install: resolve file: and link: dependencies on the same directory as separate packages #38114 install: resolve file: and link: dependencies on the same directory as separate packages
• install: stop leaking the displaced cache folder when a tarball is re-extracted #38702 install: stop leaking the displaced cache folder when a tarball is re-extracted

Path-buffer overflows: panic → error (15)

• install: stop aborting on link: specifiers and patch paths longer than the path buffers #38359 install: stop aborting on link: specifiers and patch paths longer than the path buffers
• cli: stop aborting on --cwd and --tsconfig-override values longer than the path join buffer #38368 cli: stop aborting on --cwd and --tsconfig-override values longer than the path join buffer
• install: stop panicking when the cache directory setting does not fit the path buffer #38390 install: stop panicking when the cache directory setting does not fit the path buffer
• install: stop panicking when a progress bar name is longer than its buffer #38558 install: stop panicking when a progress bar name is longer than its buffer
• install: stop aborting on linked package names that do not fit the symlink buffers #38571 install: stop aborting on linked package names that do not fit the symlink buffers
• install: fail verification instead of panicking when <alias>/package.json does not fit the path buffer #38575 install: fail verification instead of panicking when /package.json does not fit the path buffer
• pm ls --all: stop panicking on resolutions longer than 512 bytes #38616 pm ls --all: stop panicking on resolutions longer than 512 bytes
• pack/publish: stop panicking on package.json bin and files entries longer than the path buffer #38784 pack/publish: stop panicking on package.json bin and files entries longer than the path buffer
• install: stop panicking on bin values longer than the path buffer #38954 install: stop panicking on bin values longer than the path buffer
• install: report ENAMETOOLONG for a --cwd value that does not fit the path buffer #38375 install: report ENAMETOOLONG for a --cwd value that does not fit the path buffer
• install: fail the isolated install with ENAMETOOLONG when a link: target does not fit the path buffer #38369 install: fail the isolated install with ENAMETOOLONG when a link: target does not fit the path buffer
• install: do not abort when $XDG_CONFIG_HOME or $HOME is too long for the .npmrc path buffer #38372 install: do not abort when $XDG_CONFIG_HOME or $HOME is too long for the .npmrc path buffer
• install: stop aborting on -g when $BUN_INSTALL, $XDG_CACHE_HOME or $HOME does not fit the global directory path buffer #38413 install: stop aborting on -g when $BUN_INSTALL, $XDG_CACHE_HOME or $HOME does not fit the global directory path buffer
• pack: report an error instead of panicking when --destination does not fit the path buffer #38749 pack: report an error instead of panicking when --destination does not fit the path buffer
• publish: report ENAMETOOLONG for a tarball path that does not fit the path buffer #38753 publish: report ENAMETOOLONG for a tarball path that does not fit the path buffer

Terminal control-character escaping and credential redaction (9)

• pm view: escape control characters coming from the registry #38536 pm view: escape control characters coming from the registry
• install: redact secrets in the URLs printed for failed manifest and tarball downloads #38817 install: redact secrets in the URLs printed for failed manifest and tarball downloads
• install: redact the registry URL in the manifest/tarball URL errors and keep namedRegistries credentials out of bun.lock #38997 install: redact the registry URL in the manifest/tarball URL errors and keep namedRegistries credentials out of bun.lock
• install: escape control characters in the bun pm untrusted/trust script listing #38525 install: escape control characters in the bun pm untrusted/trust script listing
• install: reject dependency names containing control characters #38615 install: reject dependency names containing control characters
• http: escape control characters in the verbose request/response trace #38673 http: escape control characters in the verbose request/response trace
• pm licenses: escape control characters in text output (adds bun_core::fmt::escape_control_chars) #39358 pm licenses: escape control characters in text output, including the name@version column
• install: escape control characters in resolutions, specifiers, bin names and registry error text #38631 install: escape control characters in resolutions, specifiers, bin names and registry error text
• install: redact credentials in tarball and git URLs printed as resolutions and specifiers #38977 install: redact credentials in tarball and git URLs printed as resolutions and specifiers

Registry auth, .npmrc, proxies, URL parsing (16)

• install: keep registry credentials across redirects to the same hostname #38001 install: keep registry credentials across redirects to the same hostname
• install: read NPM_CONFIG_USERCONFIG as the user-level .npmrc path #38047 install: read NPM_CONFIG_USERCONFIG as the user-level .npmrc path
• publish, pm whoami: route registry requests through http_proxy #38075 publish, pm whoami: route registry requests through http_proxy
• install: make BUN_CONFIG_NO_VERIFY disable integrity verification when set #38310 install: make BUN_CONFIG_NO_VERIFY disable integrity verification when set
• install: honor BUN_CONFIG_MAX_HTTP_REQUESTS #38744 install: honor BUN_CONFIG_MAX_HTTP_REQUESTS
• url: emit a single slash in href_without_auth() for root-path registry URLs #38812 url: emit a single slash in href_without_auth() for root-path registry URLs
• url: parse the host of a protocol-relative URL instead of leaving the authority in the path #39000 url: parse the host of a protocol-relative URL instead of leaving the authority in the path
• install: say --network-concurrency defaults to 64 in help and docs #38759 install: say --network-concurrency defaults to 64 in help and docs
• http: report a refused HTTP client thread as an error instead of a crash #38766 http: report a refused HTTP client thread as an error instead of a crash
• install: send credentials embedded in a registry URL that comes from an env var #38834 install: send credentials embedded in a registry URL that comes from an env var
• install: send Basic auth for a registry URL with a username but no password #39063 install: send Basic auth for a registry URL with a username but no password
• install: replace an existing manifest cache entry atomically instead of unlinking it first #38916 install: replace an existing manifest cache entry atomically instead of unlinking it first
• install: warn when a registry manifest advertises an integrity hash bun cannot use #38484 install: warn when a registry manifest advertises an integrity hash bun cannot use
• publish, pm whoami, audit: honor NODE_TLS_REJECT_UNAUTHORIZED=0 like bun install #38093 publish, pm whoami, audit: honor NODE_TLS_REJECT_UNAUTHORIZED=0 like bun install
• Normalize http_proxy/https_proxy env values through the WHATWG parser #38043 Normalize http_proxy/https_proxy env values through the WHATWG parser
• install: resolve .npmrc //host/ credentials by request URL #38800 install: resolve .npmrc //host/ credentials by request URL

bun pm subcommands, audit, help text (14)

• bun why: print a package's dependents once, mark repeats as *deduped #37922 bun why: print a package's dependents once, mark repeats as *deduped
• pm pkg: support arrays in set and delete #38025 pm pkg: support arrays in set and delete
• install: format versions with the string buffer they were parsed from (bun outdated table, minimum-release-age messages) #38649 install: format versions with the string buffer they were parsed from (bun outdated table, minimum-release-age messages)
• audit: list --production, --omit, --dry-run and --cwd in bun audit --help #38836 audit: list --production, --omit, --dry-run and --cwd in bun audit --help
• install: say --ignore-scripts also skips trusted dependencies' scripts in --help #38893 install: say --ignore-scripts also skips trusted dependencies' scripts in --help
• pm: polish dedupe, prune, pm ls and pm licenses output #38952 pm: polish dedupe, prune, pm ls and pm licenses output
• prune: add --check, a CI gate that exits 1 when anything would be removed #39216 prune: add --check, a CI gate that exits 1 when anything would be removed
• audit fix: never downgrade a package out of its installed release line #39317 audit fix: never downgrade a package out of its installed release line
• pm view: match the requested range against the buffer it was parsed from #38671 pm view: match the requested range against the buffer it was parsed from
• Make bun pm ls list installed packages instead of lockfile entries #38923 Make bun pm ls list installed packages instead of lockfile entries
• cli: load a package.json and name a lockfile load step from one place #39165 cli: load a package.json and name a lockfile load step from one place
• install: describe the real --save default in bun link and bun unlink --help #38915 install: describe the real --save default in bun link and bun unlink --help
• audit fix: report and rewrite the overrides rule that holds a vulnerable version #38785 audit fix: report and rewrite the overrides rule that holds a vulnerable version
• Add --why to bun dedupe to show one level of dependents under each row #39217 Add --why to bun dedupe to show one level of dependents under each row

bun pm pack / bun publish (13)

• run: set npm_package_name/version/json and npm_config_local_prefix per run #38071 run: set npm_package_name/version/json and npm_config_local_prefix per run
• publish: resolve a relative tarball path against the invoking directory #38704 publish: resolve a relative tarball path against the invoking directory
• pack, publish: include entries on filesystems whose readdir reports DT_UNKNOWN #38716 pack, publish: include entries on filesystems whose readdir reports DT_UNKNOWN
• pack: build the tarball in memory and write it out only once it is complete #38721 pack: build the tarball in memory and write it out only once it is complete
• publish: accept basic auth credentials from .npmrc and bunfig.toml #38776 publish: accept basic auth credentials from .npmrc and bunfig.toml
• publish: honor publishConfig.registry and publishConfig["@scope:registry"] #38322 publish: honor publishConfig.registry and publishConfig["@scope:registry"]
• pack: skip bins reached through symlinks; publish: do not read the readme through a symlink #38707 pack: skip bins reached through symlinks; publish: do not read the readme through a symlink
• pack: store tarball entry names byte for byte #38715 pack: store tarball entry names byte for byte
• pack: pack a file listed under several bin names once, strip the trailing slash from directories.bin #38720 pack: pack a file listed under several bin names once, strip the trailing slash from directories.bin
• pm pack: resolve relative --destination and --filename against the invoking directory #38739 pm pack: resolve relative --destination and --filename against the invoking directory
• pack/publish: resolve workspace: and catalog: specs from the package.json files, not bun.lock #38813 pack/publish: resolve workspace: and catalog: specs from the package.json files, not bun.lock
• pack: publish workspace: directory dependencies as the workspace's version #38835 pack: publish workspace: directory dependencies as the workspace's version
• pack: publish workspace: aliases as npm: aliases #38788 pack: publish workspace: aliases as npm: aliases

Linkers, bins, node_modules layout (9)

• install(hoisted): track replaced folders instead of deferring and re-verifying nested skips #38303 install(hoisted): track replaced folders instead of deferring and re-verifying nested skips
• Resolve dangling node_modules symlinks as missing modules; isolated installs unlink failed optional dependencies #38756 Resolve dangling node_modules symlinks as missing modules; isolated installs unlink failed optional dependencies
• install: link packages into a staging directory and rename them into place #38783 install: link packages into a staging directory and rename them into place
• bunx: resolve directories.bin relative to the package #39096 bunx: resolve directories.bin relative to the package
• install: remove the node_modules links of a renamed or removed workspace #38511 install: remove the node_modules links of a renamed or removed workspace
• install: reinstall node_modules when switching between the isolated and hoisted linkers #38779 install: reinstall node_modules when switching between the isolated and hoisted linkers
• install: keep linking the remaining bins when one bin or one dependency's bins fail to link #38972 install: keep linking the remaining bins when one bin or one dependency's bins fail to link
• install: link over an empty directory left at node_modules/<pkg> with the isolated linker #37757 install: link over an empty directory left at node_modules/ with the isolated linker
• install(windows): store an absolute target in .bunx shims when the package dir is on another drive #38018 install(windows): store an absolute target in .bunx shims when the package dir is on another drive

Lifecycle scripts, env, minimum-release-age, semver, auto-install (16)

• install: drop the duplicated warn: label from the verbose tarball retry notice #38648 install: drop the duplicated warn: label from the verbose tarball retry notice
• install: fix node-gyp shim PATH entry after tempdir falls back to cache/.tmp #38098 install: fix node-gyp shim PATH entry after tempdir falls back to cache/.tmp
• install: set npm_config_local_prefix and npm_package_config_* for lifecycle scripts #38110 install: set npm_config_local_prefix and npm_package_config_* for lifecycle scripts
• install: skip root lifecycle scripts and the yarn.lock write under --dry-run #38830 install: skip root lifecycle scripts and the yarn.lock write under --dry-run
• install: remove the same-filesystem probe from $TMPDIR when the rename into the cache fails #38859 install: remove the same-filesystem probe from $TMPDIR when the rename into the cache fails
• install: print version before package name in the minimum-release-age error #37895 install: print version before package name in the minimum-release-age error
• install: support name@version entries in minimumReleaseAgeExcludes #37909 install: support name@version entries in minimumReleaseAgeExcludes
• install: do not resolve an exact version from an abbreviated manifest under minimum-release-age #38659 install: do not resolve an exact version from an abbreviated manifest under minimum-release-age
• semver: print the build tag from the printed version's buffer in the colored version diff #38688 semver: print the build tag from the printed version's buffer in the colored version diff
• resolver: make auto-install use the version range from the project's package.json #38198 resolver: make auto-install use the version range from the project's package.json
• run, install: honor --no-env-file / --env-file for scripts run through the bun exec hop #38182 run, install: honor --no-env-file / --env-file for scripts run through the bun exec hop
• install: warn instead of failing when minimum-release-age blocks a peer dependency #38995 install: warn instead of failing when minimum-release-age blocks a peer dependency
• semver: record cloned prerelease/build tag offsets against the whole destination buffer #38687 semver: record cloned prerelease/build tag offsets against the whole destination buffer
• auto-install: report why a root dependency could not be resolved #38180 auto-install: report why a root dependency could not be resolved
• install: only open package.json for writing in the commands that rewrite it #38745 install: only open package.json for writing in the commands that rewrite it
• install: filter optionalDependencies by libc and record it in the lockfile #38797 install: filter optionalDependencies by libc and record it in the lockfile

Test-only changes (13)

• test(install): serve URL tarball dependencies locally in bun-install.test.ts #37919 test(install): serve URL tarball dependencies locally in bun-install.test.ts
• test(install): keep bun-update-security-provider on the dummy registry, assert the update, run concurrently #38185 test(install): keep bun-update-security-provider on the dummy registry, assert the update, run concurrently
• test(install): give each long-label bun patch test its own install cache #38255 test(install): give each long-label bun patch test its own install cache
• test(bunx): install fixture packages from a local registry instead of real ones #38467 test(bunx): install fixture packages from a local registry instead of real ones
• test(install): don't require the refetched manifest to be cached before install exits #38580 test(install): don't require the refetched manifest to be cached before install exits
• test(install): normalize the registry URL, not the bare port, in the lockb print snapshot #38627 test(install): normalize the registry URL, not the bare port, in the lockb print snapshot
• test(harness): let verdaccio pick its own port and fail start() when it exits early #38891 test(harness): let verdaccio pick its own port and fail start() when it exits early
• test(install): run overrides.test.ts against the local registry #39022 test(install): run overrides.test.ts against the local registry
• test(install): serve GitHub tarball fixtures locally in the GHSA-pfwx-36v6-832x and lifecycle script tests #39115 test(install): serve GitHub tarball fixtures locally in the GHSA-pfwx-36v6-832x and lifecycle script tests
• test: add a harness isRoot and skip the chmod-based ls and Bun.file cases as root #39232 test: add a harness isRoot and skip the chmod-based ls and Bun.file cases as root
• test(install): speed up bun-install.test.ts and tighten its assertions #38464 test(install): speed up bun-install.test.ts and tighten its assertions
• test(install): run bun-install-registry.test.ts concurrently and tighten its assertions #38504 test(install): run bun-install-registry.test.ts concurrently and tighten its assertions
• test/docker: wait for the docker daemon in the coordinator instead of failing on a one-shot probe #39243 test/docker: wait for the docker daemon in the coordinator instead of failing on a one-shot probe

Platform-specific (5)

• install: schedule the Windows hardlink task through the allocation's own pointer #37865 install: schedule the Windows hardlink task through the allocation's own pointer
• install.ps1: make the "another bun.exe is already in PATH" check work #38567 install.ps1: make the "another bun.exe is already in PATH" check work
• install: don't issue openat2/fchmodat2 on Android (seccomp SIGSYS) #39084 install: don't issue openat2/fchmodat2 on Android (seccomp SIGSYS)
• bunx: serialize concurrent installs into the shared cache dir with a file lock #37851 bunx: serialize concurrent installs into the shared cache dir with a file lock
• Fix bun install through subst drives, cross-drive junctions, and symlinked package.json #39361 Fix bun install through subst drives, cross-drive junctions, and symlinked package.json

Verification

• cargo check --workspace
• cargo clippy --workspace --no-deps
• debug build (Linux x64, ASAN)
• test/cli/install/**, test/cli/run/**, test/regression/issue/*install* locally with the debug build. Remaining local-only failures are environmental and reproduce on main in this sandbox: bun-pm.test.ts read-only package.json cases (run as root; nobody cannot exec a binary under /root), thread-spawn-failure (LD_PRELOAD shim vs ASAN).
• CI (first run on the pre-simplification head: 3 failing files, all addressed above — thread-spawn shim under ASAN, pnpm read-only package.json wording, update-security-provider range)

[alii]

Went through the fold with the head built locally and CI build 99835 pulled apart. Leaving these as comments, not a block, since the shape is Jarred's call.

Two things exist only because of the fold and are worth knowing before anything else: the isolated linker now panics on any link: dependency (#38045 x #38369, thread below), and lifecycle script counting on relink hits ENOENT (#38780 x #38783). Both reproduce with two-line projects on this head and neither reproduces on main or in the source PRs.

The "stays bisectable" claim does not hold today. 297ed01bf5 (the last folded PR before the fixups) does not compile: src/install/pnpm.rs has the same use crate::package_manager_real::update_package_json_and_install::print_package_json_into_cache_entry; twice and calls &mut lockfile.catalogs on an Option<&mut Lockfile>. The duplicate enters at e2cf8c4305 (#38804) and only leaves in 0adcafaf8b, so at least the last ~40 commits before the fixups do not build.

CI: build 99835 has 92 failed test-bun jobs on every Linux lane plus Windows, about 148 distinct failing assertion sites in ~25 files under test/cli/install; main's 99833 has none. Roughly a third are lockfileVersion 2 snapshots written after #38741, a handful are test-merge errors from the #38504 re-port, and the rest need a run to classify (bun update rows, peer binding in bun-lock.test.ts:2377/2757, minimum-release-age.test.ts:2344, the yarn migration warn lines).

If the goal is to land these, the shape I would push for is: the ~39 PRs whose own CI is green and which touch nothing another folded PR touches go in one by one; the peer-binding/bun.lock-load set, the yarn migrator set, the pnpm migrator set and pack/publish become one stack each with the reconciliation hunks moved into the stack that owns them; #38741, #38797, #38923 and #38813 stay out as their own maintainer-decision PRs. Happy to help cut the stacks.

[alii]

This is a ResolutionTag::Symlink entry, and after #38369 append_store_path hits unreachable!("link: packages have no store path; see append_dependency_path") (Installer.rs:3138) for exactly that tag. Every isolated install with a link: dependency now aborts:

panic: internal error: entered unreachable code: link: packages have no store path; see append_dependency_path

Reproduced on this head with {"dependencies":{"lib":"link:../lib"}} and bun install --linker=isolated; main installs it. It is what takes down isolated-install.test.ts:508/4674/4714/4735/4759, bun-pm-licenses.test.ts:1083 and yarn-lock-migration.test.ts:2357 on every lane. Neither #38045 nor #38369 has this alone. The target check here wants the link target path (append_dependency_path builds it, and returns the ENAMETOOLONG error #38369 added), not the store path.

[Jarred-Sumner]

Fixed in e4a0624: the symlink-entry check builds its target with installer.append_dependency_path(&mut link_target, entry_id) (which now joins with the ..-normalising checked join, so a link:/file: target that only overflows once joined reports LinkPathTooLong), never append_store_path. {"lib":"link:../lib"} with --linker=isolated installs on the current head; isolated-install.test.ts (111), bun-pm-licenses.test.ts (81) and yarn-lock-migration.test.ts (43) all pass.

[alii]

On the relink path nothing was copied into the staging dir, so Which::Staging names a directory that does not exist and get_list fails with ENOENT. Reproduces with isolated-relink.test.ts on this head:

error: failed to fill lifecycle scripts for uses-what-bin: ENOENT

Also behind bun-prune.test.ts:155 and the harness.ts:1578 hits in isolated-install.test.ts. #38780 was written against the pre #38783 layout, where the package was already at its final path when this ran; folded together the assumption in the comment above only holds for a fresh copy.

[Jarred-Sumner]

Fixed in 0ac90d6: count_blocked_scripts reads from Which::Final unless the entry lives in the global store, so the relink path (nothing staged) reads the package where it already is. isolated-relink, bun-prune and isolated-install pass on the current head.

[alii]

This makes every optionalDependencies resolve on every OS refetch the full packument: PackageManifestMap.rs:181-184 marks the cached abbreviated doc unusable when needs_extended is set, and the exact-version fast path is skipped too, so even a pinned optional dep goes back to the network with Accept: application/json and no conditional headers. On macOS and Windows the libc field is never consulted. There is no measurement in #38797. Worth timing a cold bun add vite on main vs this head, and gating on the host actually filtering by libc.

[Jarred-Sumner]

Confirmed the premise: npm's abbreviated document has no libc (@rollup/rollup-linux-x64-musl corgi keys are cpu, dist, name, os, version; the full doc has libc: ["musl"]), so #38797 has to read the full document to filter at all. Measured the delta for the packages this actually hits: @esbuild/linux-x64 43 KB → 54 KB gzipped, @rollup/rollup-linux-x64-gnu 40 KB → 58 KB. The refetch is one-time per package per manifest cache (the full doc is stored with has_extended_manifest and revalidated with conditional headers afterwards, same path minimumReleaseAge already uses), in exchange for not downloading the other libc's multi-MB tarball on Linux. Gating on the host having a concrete libc would make bun.lock's libc meta depend on which OS resolved the package, which I think is worse than the ~15 KB. I've left #38797 as written and moved it into the "needs a maintainer decision" list in the description next to #38741 rather than change its semantics inside the fold.

[alii]

#38484 changed serveManifest to take { integrity, shasum }, but these three calls from #38310 (here, :890, :914) still pass the bare string, so the spread produces {"0":"s","1":"h",...} and the manifest carries no integrity at all. The =1 case then passes for the wrong reason and BUN_CONFIG_NO_VERIFY=0 keeps the integrity check enabled fails on every lane. The runtime side is fine (checked by hand on this head: unset and 0 fail closed on a bad hash, 1 skips), it is the fixture that broke in the merge. Should be serveManifest({ integrity: other.sha512 }, real.tgz).

[Jarred-Sumner]

Fixed in 4cd0c85: all three calls pass { integrity: other.sha512 }; the =0 case fails closed and =1 skips for the right reason now (tarball-integrity 33/33).

[alii]

Flipping new lockfiles back to v1 is a release decision that #38741's own status comment defers to a maintainer, and it obsoletes the open #36464 (its has_scoped && !loaded.at_least(V3) hunk no longer exists) without saying so. It is also the single biggest source of red in 99835: about 15 inline snapshots written by PRs folded after this one still pin "lockfileVersion": 2 (bun-lock.test.ts:1022/2302, catalogs.test.ts:287, overrides.test.ts:247, nested-overrides.test.ts:1481/1513, bun-install-registry.test.ts:1293/1360/6264, migrate.test.ts:2330, minimum-release-age.test.ts:3109, bun-install.test.ts:12035). Either pull this one out and land it or #36464 on its own after the decision, or re-snapshot the siblings inside this commit.

[Jarred-Sumner]

Agreed this is a release decision, not something the fold should make by accident. The sibling snapshots are already re-stamped to 1 inside the fold (that was fixlv in the fixups), so the branch is internally consistent either way; pulling #38741 back out is one revert plus re-stamping. I've called it out at the top of the description as needing a maintainer decision and noted that it obsoletes #36464.

[alii]

entry.name on the line above is not escaped (the version is). Same drop as why_command.rs:479.

[Jarred-Sumner]

Fixed in 9f1c929.

[alii]

With the write result discarded, bun pm migrate on a read-only package.json exits 0 having written bun.lock but not the workspaces/overrides/catalog it moved out of pnpm-workspace.yaml. The next plain bun install rebuilds those from the package.json it can read (install_with_manager.rs:336-343) and drops the migrated pins without a word. #38754's own test pins the opposite contract (exit 1, no bun.lock). Pick one, and add a test that runs the follow-up bun install and --frozen-lockfile from the half-migrated tree.

[Jarred-Sumner]

Went with #38754's contract. 9f1c929: write_migrated_root now runs immediately before the migrated lockfile is saved in all four places (both install_with_manager save paths, bun pm migrate, bun pm trust) and exits 1 if the write fails, so a package.json that cannot take the moved fields fails the command before a bun.lock that depends on them exists. The read-only test asserts exit 1, package.json untouched, no bun.lock, no copied … line, and then chmods back and checks the same bun install completes the move and resolves the workspace link. Verified as a non-root user locally.

[alii]

.bunx-lock lives inside tempdir_name, and delete_tree retries on ENOTEMPTY, so a second bun x that just did O_CREAT on a fresh .bunx-lock in the half-deleted directory passes the identity check and then has its lock file unlinked from under it. Two bun x pkg after the 24h expiry can both install "under lock". Putting the lock next to the cache dir instead of inside it removes the race and the identity check.

[Jarred-Sumner]

9f1c929 moves the lock to <bunx cache dir>.lock (a sibling, so delete_tree never touches it), opens it with O_NOFOLLOW, and on POSIX refuses it unless it is a regular file owned by the current uid; the inode identity re-check and retry loop are gone. bunx / bunx-concurrent pass.

[alii]

Only the default scope's URL and bearer token cross into the nested install. _auth/username:_password basic auth (scope.auth, scope.user), scoped registries, url_auth, ca/cafile, minimumReleaseAge and the security scanner do not, and the child then reads the checkout's own .env/.npmrc/bunfig. So a project on basic auth gets a whole-install failure from the child's 401, and a project with minimumReleaseAge gets devDependencies of the git dep resolved without it. Either forward the install config wholesale or say in the docs exactly what is inherited, with tests for token, _auth, scoped registry and minimumReleaseAge reaching the child.

[Jarred-Sumner]

#38810 is no longer in the fold (dropped at Jarred's request — nested install before prepare is rare to need and a lot of surface); this file is back to its pre-#38810 shape.

[alii]

This is #38047 at head 507c356173, the state I requested changes on 2026-08-14. The two tests asked for there are not in the fold: userconfig pointing at a missing file must end in "missing authentication" rather than falling back to ~/.npmrc, and a relative value run from a workspace member dir must resolve against the member dir. Both fit the existing publishDryRun helper.

[Jarred-Sumner]

Added both in 9f1c929 with the existing publishDryRun helper: NPM_CONFIG_USERCONFIG naming a missing file ends in missing authentication with ~/.npmrc present, and a relative value run from a workspace member resolves against the member dir (root ci.npmrc = registry 1, pkg/ci.npmrc = registry 2, expects 2). Both pass on the folded #38047 code as-is.

[Jarred-Sumner]

@alii thanks for pulling this apart. Status against your summary:

• The two fold-only bugs (isolated link: panic, relink ENOENT) and everything else CI 99835 was red on were fixed in the fixup commits after the head you built; replies are on each thread. The current head also carries a simplification pass (simplify(...) commits) that roughly halves the net src/ addition — details in the description.
• Bisectability: you're right, and I've corrected the description. Cross-PR API reconciliation lives in the mega-merge fixup: commits, so the per-PR commits from e2cf8c4305 (install: write a migrated lockfile and its package.json edits only when the command saves a lockfile #38804) up to 0adcafaf8b don't build on their own; the per-PR commits are there for attribution (git log/blame per hunk), not as bisect points.
• The two release decisions (install: stamp lockfileVersion 1 on new bun.lock files #38741 lockfileVersion 1, install: filter optionalDependencies by libc and record it in the lockfile #38797 full manifests for optional deps) are now called out at the top of the description for Jarred rather than decided inside the fold.
• Local state on the current head: all 94 test/cli/install/** files pass (debug+ASAN, Linux x64), including the read-only package.json cases run as a non-root user.