bun add
Add packages to your project with Bun's fast package manager
To add a particular package:
bun add preactTo specify a version, version range, or tag:
bun add [email protected]
bun add zod@^3.0.0
bun add zod@latest--dev
--development, -d, -DTo add a package as a dev dependency ("devDependencies"):
bun add --dev @types/react
bun add -d @types/react--optional
To add a package as an optional dependency ("optionalDependencies"):
bun add --optional lodash--peer
To add a package as a peer dependency ("peerDependencies"):
bun add --peer @types/bun--exact
-ETo pin a package to the resolved version, use --exact. Bun writes the exact version number to your package.json instead of a version range.
bun add react --exact
bun add react -EThe difference in package.json:
{
"dependencies": {
// without --exact
"react": "^18.2.0", // this matches >= 18.2.0 < 19.0.0
// with --exact
"react": "18.2.0" // this matches only 18.2.0 exactly
}
}To view a complete list of options for this command:
bun add --help--global
bun add --global, bun add -g, bun install --global and bun install -gTo install a package globally, use the -g/--global flag. This does not modify the package.json of your current project. Use it to install command-line tools.
bun add --global cowsay # or `bun add -g cowsay`
cowsay "Bun!" ______
< Bun! >
------
\ ^__^
\ (oo)\_______
(__)\ )\/\
||----w |
|| ||Trusted dependencies
Unlike other npm clients, Bun does not execute arbitrary lifecycle scripts for installed dependencies, such as postinstall. These scripts represent a potential security risk, as they can execute arbitrary code on your machine.
To tell Bun to allow lifecycle scripts for a particular package, add the package to trustedDependencies in your package.json.
{
"name": "my-app",
"version": "1.0.0",
"trustedDependencies": ["my-trusted-package"]
}Bun reads this field and runs lifecycle scripts for my-trusted-package.
Git dependencies
To add a dependency from a public or private git repository:
bun add [email protected]:moment/moment.gitTo install private repositories, your system needs the appropriate SSH credentials to access the repository.
Bun supports a variety of protocols, including github, git, git+ssh, and git+https.
{
"dependencies": {
"dayjs": "git+https://github.com/iamkun/dayjs.git",
"lodash": "git+ssh://github.com/lodash/lodash.git#4.17.21",
"moment": "[email protected]:moment/moment.git",
"zod": "github:colinhacks/zod"
}
}Tarball dependencies
A package name can correspond to a publicly hosted .tgz file. Bun downloads and installs the package from that tarball URL rather than from the package registry.
bun add zod@https://registry.npmjs.org/zod/-/zod-3.21.4.tgzbun add writes the URL to your package.json:
{
"dependencies": {
"zod": "https://registry.npmjs.org/zod/-/zod-3.21.4.tgz"
}
}CLI Usage
bun add <package> <@version>Dependency Management
--productionbooleanDon’t install devDependencies. Alias: -p
--omitstringExclude dev, optional, or peer dependencies from install
--globalbooleanInstall globally. Alias: -g
--devbooleanAdd dependency to devDependencies. Alias: -d
--optionalbooleanAdd dependency to optionalDependencies
--peerbooleanAdd dependency to peerDependencies
--exactbooleanAdd the exact version instead of the ^ range. Alias: -E
--only-missingbooleanOnly add dependencies to package.json if they are not already present
Project Files & Lockfiles
--yarnbooleanWrite a yarn.lock file (yarn v1). Alias: -y
--no-savebooleanDon’t update package.json or save a lockfile
--savebooleandefault: trueSave to package.json
--frozen-lockfilebooleanDisallow changes to lockfile
--trustbooleanAdd to trustedDependencies in the project’s package.json and install the package(s)
--save-text-lockfilebooleanSave a text-based lockfile
--lockfile-onlybooleanGenerate a lockfile without installing dependencies
Installation Control
--dry-runbooleanDon’t install anything
--forcebooleanAlways request the latest versions from the registry & reinstall all dependencies. Alias: -f
--no-verifybooleanSkip verifying integrity of newly downloaded packages
--ignore-scriptsbooleanSkip lifecycle scripts in the project’s package.json (dependency scripts are never run)
--analyzebooleanRecursively analyze & install dependencies of files passed as arguments (using Bun’s bundler). Alias:
-a
Network & Registry
--castringProvide a Certificate Authority signing certificate
--cafilestringSame as --ca, but as a file path to the certificate
--registrystringUse a specific registry by default, overriding .npmrc, bunfig.toml, and environment
variables
--network-concurrencynumberdefault: 48Maximum number of concurrent network requests
Performance & Resource
--backendstringdefault: clonefilePlatform-specific optimizations for installing dependencies. One of clonefile, hardlink,
symlink, or copyfile
--concurrent-scriptsnumberMaximum number of concurrent jobs for lifecycle scripts (default: 2x CPU cores)
Caching
--cache-dirstringStore & load cached data from a specific directory path
--no-cachebooleanIgnore manifest cache entirely
Output & Logging
--silentbooleanDon’t log anything
--verbosebooleanExcessively verbose logging
--no-progressbooleanDisable the progress bar
--no-summarybooleanDon’t print a summary
Global Configuration & Context
--configstringSpecify path to config file (bunfig.toml). Alias: -c
--cwdstringSet a specific current working directory
Help
--helpbooleanPrint this help menu. Alias: -h