Bun package manager support

[MarkLyck]

What would you like Renovate to be able to do?

I'm switching my package manager from pnpm to bun, since it runs much faster.

However it looks like mendRenovate doesn't support bun or it's lockfile bun.lockb

Please add support for bun install

https://github.com/oven-sh/bun#bun-install

Is this a feature you are interested in implementing yourself?

No

[github-actions[bot]]

Hi there,

You're asking us to support a new package manager. We need to know some basic information about this package manager first. Please copy/paste the new package manager questionnaire, and fill it out in full.

Once the questionnaire is filled out we'll decide if we want to support this new manager.

Good luck,

The Renovate team

[rarkins]

It's not using package.json, right? This would make it easier to implement as we can separate it from our npm manager (which covers npm, yarn, pnpm)

[viceice]

needs an installer in containerbase image like:
https://github.com/containerbase/base/blob/main/src/usr/local/buildpack/tools/v2/pnpm.sh

so renovate can update the lockfile

[MarkLyck]

It's not using package.json, right? This would make it easier to implement as we can separate it from our npm manager (which covers npm, yarn, pnpm)

it does use package.json. In my project it replaces npm, yarn, pnpm

[Jarred-Sumner]

It's not using package.json, right? This would make it easier to implement as we can separate it from our npm manager (which covers npm, yarn, pnpm)

bun install uses package.json. Instead of yarn.lock, bun.lockb, or pnpm-lock.yml, bun uses bun.lockb.

[floydjones1]

@rarkins bun just reached v1.0.0 can we add this in? It uses package.json and bun.lockb

[LZL0]

It would be a really nice addition.

[rarkins]

Nobody has filled out the questionnaire above so this is going nowhere without it

[renchap]

New package manager questionnaire

Did you read our documentation on adding a package manager?

• I've read the adding a package manager documentation.

Basics

Name of package manager

Bun built-in package manager (https://bun.sh/docs/cli/install)

What language does this support?

Javascript / Typescript running with the Bun environment

How popular is this package manager?

Bun recently reached out version 1.0, and is gaining popularity quickly

Does this language have other (competing?) package managers?

• Yes (npm / yarn / pnpm / … can be considered competing package managers as they work with package.json, but they are not intended to be ran with Bun)
• No

---

Package File Detection

What type of package files and names does it use?

It uses NPM packages as input

What fileMatch pattern(s) should be used?

["^bun.lockb$", ""] (plus package.json?)

Is it likely that many users would need to extend this pattern for custom file names?

• Yes
• No

Is the fileMatch pattern likely to get many "false hits" for files that have nothing to do with package management?

No

---

Parsing and Extraction

Can package files have "local" links to each other that need to be resolved?

Yes, it uses the package.json definitions

Is there a reason why package files need to be parsed together (in serial) instead of independently?

Not sure, I guess the algorithm here will be the same as for the other JS package managers, but using Bun's lockfile

What format/syntax is the package file in?

• JSON
• TOML
• YAML
• Custom (explain below)

Bun uses a binary lockfile for speed, with an optional flag to have it handle an additional yarn.lock text file to make it easier to diff.

Details are here: https://bun.sh/docs/install/lockfile

How do you suggest parsing the file?

• Off the shelf parser
• Using regex
• Custom-parsed line by line
• Other

Bun is written in Zig, and the lockfile-related code is here: https://github.com/oven-sh/bun/blob/main/src/install/lockfile.zig

I think the easiest way to integrate with Renovate is to have bun generate the yarn.lock file (if it is not yet committed in the repo), then parse it using the existing Yarn lockfile parser.

Does the package file structure distinguish between different "types" of dependencies? e.g. production dependencies, development dependencies, etc?

• Yes, production and development dependencies
• No, all dependencies are treated the same

Standard JS package manager

List all the sources/syntaxes of dependencies that can be extracted

Same as other JS package managers

Describe which types of dependencies above are supported and which will be implemented in future

Same as other JS package managers

---

Versioning

What versioning scheme does the package file(s) use?

Same as other JS package managers

Does this versioning scheme support range constraints, e.g. ^1.0.0 or 1.x?

• Supports range constraints (e.g ^1.0.0 or 1.x)
• No

Same as other JS package managers

---

Lookup

Is a new datasource required? Provide details

• Yes, provide details.
• No (uses NPM)

Will users need the capability to specify a custom host/registry to look up? Can it be found within the package files, or within other files inside the repository, or would it require Renovate configuration?

Same as other JS package managers for package.json.

Note that Bun does not support reading from .npmrc, and custom registry config needs to be read from Bun's config: https://bun.sh/docs/install/registries

Do the package files have any "constraints" on the parent language (e.g. supports only v3.x of Python) or platform (Linux, Windows, etc.) that should be used in the lookup procedure?

Yes for platforms (it uses NPM packages), not sure about the language.

Will users need the ability to configure language or other constraints using Renovate config?

Like for the other NPM-based package managers?

---

Artifacts

Are lock files or checksum files used? Are they mandatory?

Yes

If so, what tool and exact commands should be used if updating one or more package versions in a dependency file?

bun add <package> (with --exact if you want to pin it to the exact version), or updating the package.json and running bun install

If applicable, describe how the tool maintains a cache and if it can be controlled via CLI or environment variables? Do you recommend the cache be kept or disabled/ignored?

Bun uses a global cache so packages are not downloaded multiple times. They are then copied to node_modules (hard linked on Linux) : https://bun.sh/docs/install/cache

There are some commands to manage it (get the caching directory, clear the global cache) : https://bun.sh/docs/install/utilities

I guess it is a good idea to keep it enabled.

If applicable, what command should be used to generate a lock file from scratch if you already have a package file? This will be used for "lock file maintenance"

bun update updates the lockfile to use the latest available packages matching the constraints in package.json.

Other

Is there anything else to know about this package manager?

Ask if you see anything missing :)

[raulfdm]

Please take into account that bun install offers a flag called --yarn that outputs a yarn.lock file (https://bun.sh/docs/install/lockfile#how-do-i-inspect-it). This output is handy for dealing with turbo (while the integration isn't that great yet).

It might be good to handle this case (where we have a bun lock and a yarn lock) to use the right flag.

[aradalvand]

I think most people would prefer to use bun.lockb (over yarn.lock) when switching to Bun so that should probably take priority.

[floydjones1]

Yeah I would do bun.lockb and leave it to the devs to debug. But maybe you can make that optional in renovate where it updates both bun.lockb and yarn.lock? (I also don't want to add complexity)
Also if you run bun ./bun.lockb you can see the output. Alternatively this https://twitter.com/jarredsumner/status/1689732536895946752

[rarkins]

It is highly desirable that we can parse the lock file using JS internal to Renovate. We do not need to "understand" the entire thing - enough to get the locked versions of dependencies. It's ok to run external tools like "bun" when the lock file needs updating, but we avoid it for all other managers when extracting/scanning dependencies.

[rarkins]

Are bun workspaces compatible with Eg yarn workspaces?

[alvarlagerlof]

Are bun workspaces compatible with Eg yarn workspaces?

It seems so https://bun.sh/docs/install/workspaces

[raulfdm]

No need to update both manually. All you need id probably check if the repo have both bun and yarn lock, run the "bun install" command with tje tag "--yarn". Bun will handle everything

[rarkins]

Is it common to check in both files? I think it will be better for Renovate to have only the Bun one

[viceice]

Depends on: containerbase/base#1434

Done

[The-Code-Monkey]

@viceice is there any timeline for bun being added to renovate

[floydjones1]

Oh one thing I was to confirm is that bun in renovate also handles private registries right?
Right now in my renovate.json I populate the npmrc field to make it work with private registries

[The-Code-Monkey]

Oh one thing I was to confirm is that bun in renovate also handles private registries right? Right now in my renovate.json I populate the npmrc field to make it work with private registries

@floydjones1 this would be something you need to check with the Bun team as im not sure.

[renchap]

I covered this when filling the form above:

Will users need the capability to specify a custom host/registry to look up? Can it be found within the package files, or within other files inside the repository, or would it require Renovate configuration?

Same as other JS package managers for package.json.

Note that Bun does not support reading from .npmrc, and custom registry config needs to be read from Bun's config: https://bun.sh/docs/install/registries

[floydjones1]

I covered this when filling the form above:

Will users need the capability to specify a custom host/registry to look up? Can it be found within the package files, or within other files inside the repository, or would it require Renovate configuration?

Same as other JS package managers for package.json.
Note that Bun does not support reading from .npmrc, and custom registry config needs to be read from Bun's config: https://bun.sh/docs/install/registries

Ahh okay. I have a bunfig.toml that should be picked up

[rarkins]

I have split Bun support into multiple issues which can be implemented incrementally, and will convert this issue into a Discussion soon so please follow the others which apply to you:

• bun: single package.json + bun.lockb support #24458
• Bun: support multiple lock files #24593
• bun: workspace support #24459
• bun: support bunfig.toml for custom registry detection #24460
• bun: support bunfig.toml credentials #24461
• bun: support parsing bun.lockb to detect locked versions #24462

[raulfdm]

you ppl rocks! 🤘

[rarkins]

Initial bun support has now been delivered and is live in the app as well as documentation

[woehrl01]

@rarkins the bun.lockb support works great now, thank you!

We detect that the package-lock.json get ignored during update now. This is required for the case where you use bun for your application, but still have node and a package-lock.json for eslint or other tools.

It would be great if renovate would update package-lock.json and bun.lockb at the same time.

[rarkins]

We are not planning to support that use case

[rarkins]

However if you create a reproduction repo demonstrating this need (outdated dependencies in both bun and npm) we can test it

[rarkins]

Added here: #24594

[kranurag78]

Hey, I searched into the repo and found that individual parsing of bun.lockb is tracked here #24462

the bun.lockb support works great now, thank you!

Furthermore, from the comments above, I think complete rewrite of bun.lockb file is already supported.

I would love to have a complete rewrite of bun.lockb file when bun manager updates dependency in my repo, which is package.json variant.

The example repo can be found here:
https://github.com/kranurag78/bun-renovate

[EvHaus]

Bun's text-based lockfile has just shipped. I hope this will make it much easier for Renovate to add support.

[nathankleyn]

I had a go at adding suport for this in #33189.