Claude Bot 563fbbb416 fix(install): reject unsupported integrity hash algorithms in lockfiles ...

Previously, if a lockfile contained an integrity hash with an
unrecognized algorithm (e.g., "md5-AAAA"), the tag would parse as
unknown and the integrity verification would be silently skipped. This
meant a tampered lockfile could disable integrity checking entirely.

Now all lockfile parsers (bun.lock, yarn.lock, pnpm-lock.yaml,
package-lock.json) reject non-empty integrity strings with unsupported
hash algorithms. As defense-in-depth, the tarball extraction step also
errors when an npm package lacks a supported integrity hash.

Co-Authored-By: Claude <noreply@anthropic.com>

2026-02-12 04:48:27 +00:00

..

__snapshots__

refactor(test): migrate bun-install tests to concurrent execution (#25895)

2026-01-08 01:06:03 -08:00

fixtures

fix(install): serialize updated workspaces versions correctly for bun.lockb (#22932)

2025-09-24 02:42:57 -07:00

hosted-git-info

bug(ENG-21501): Fix integer overflow in hosted_git_info.zig (#24561)

2025-11-10 16:30:47 -08:00

migration

fix(install): create bun.lock instead of bun.lockb if npm/yarn/pnpm migration fails (#24494)

2025-11-07 20:58:44 -08:00

registry

Add postinstall optimizer with native binlink support and script skipping (#24283)

2025-11-03 20:36:22 -08:00

actual-package-2.0.0.tgz

implement bunx --package (#21517)

2025-08-12 17:07:46 -07:00

architecture-match.test.ts

Fix edgecase with "os" and "cpu" in bun install (#13848)

2024-09-11 16:47:38 -07:00

bad-workspace.test.ts

fix: prevent crash when workspace includes "./" or ".\" (#23337)

2025-10-07 08:17:13 -07:00

bar-0.0.2.tgz

…

baz-0.0.3.tgz

…

baz-0.0.5.tgz

…

boba-0.0.2.tgz

…

bun-add.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

bun-audit.test.ts

bun audit add more filtering options (#21833)

2025-08-14 16:36:44 -07:00

bun-create.test.ts

fix(create): crash when running postinstall task with --no-install (#25616)

2025-12-19 23:17:51 -08:00

bun-info.test.ts

Start using test.concurrent in our tests (#22823)

2025-09-22 05:30:34 -07:00

bun-install-cpu-os.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

bun-install-lifecycle-scripts.test.ts

fix(install): only apply default trusted dependencies to npm packages (#25163)

2025-12-11 17:44:41 -08:00

bun-install-native-binlink.test.ts

Add postinstall optimizer with native binlink support and script skipping (#24283)

2025-11-03 20:36:22 -08:00

bun-install-patch.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

bun-install-pathname-trailing-slash.test.ts

Implement isolated event loop for spawnSync (#24436)

2025-11-07 05:28:33 -08:00

bun-install-proxy.test.ts

[publish images] ci: ensure tests that require docker have it available (#22781)

2025-09-25 19:03:22 -07:00

bun-install-registry.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

bun-install-retry.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

bun-install-security-provider.test.ts

Make --linker=isolated the default for bun install (#23311)

2025-10-08 18:00:38 -07:00

bun-install.test.ts

refactor(test): migrate bun-install tests to concurrent execution (#25895)

2026-01-08 01:06:03 -08:00

bun-link.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

bun-lock.test.ts

implement pnpm migration (#22262)

2025-09-27 00:45:29 -07:00

bun-lockb.test.ts

implement pnpm migration (#22262)

2025-09-27 00:45:29 -07:00

bun-pack.test.ts

fix(pack): always include bin even if not included by files (#23606)

2025-10-19 23:28:59 -07:00

bun-patch.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

bun-pm-pkg.test.ts

implement bun pm pkg (#21046)

2025-07-15 22:14:00 -07:00

bun-pm-scan.test.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-pm-version.test.ts

followup for bun pm version (#20799)

2025-07-07 11:21:36 -07:00

bun-pm-why.test.ts

Start using test.concurrent in our tests (#22823)

2025-09-22 05:30:34 -07:00

bun-pm.test.ts

Make 'bun list' an alias for 'bun pm ls' (#24159)

2025-10-29 21:05:25 -07:00

bun-publish.test.ts

Fix --tolerate-republish flag in bun publish (continues PR #22107) (#22381)

2025-09-30 13:25:50 -07:00

bun-remove.test.ts

Use ReadableStream.prototype.* in tests instead of new Response(...).* (#20937)

2025-07-14 00:47:53 -07:00

bun-repl.test.ts

Skip failing test on arm64 linux musl caused by third-party dependency

2025-09-26 15:23:32 -07:00

bun-run-bunfig.test.ts

load local bunfig.toml for bun run earlier (for run.bun option) (#16664)

2025-10-08 12:13:06 -07:00

bun-run-dir.test.ts

Unskip some tests (#22116)

2025-08-27 06:39:11 -07:00

bun-run.test.ts

fix(cli): show helpful error for unsupported file types instead of "File not found" (#26126)

2026-01-15 23:40:45 -08:00

bun-security-scanner-matrix-runner.ts

test(security-scanner): add TTY prompt tests using Bun.Terminal (#25587)

2025-12-19 05:21:44 +00:00

bun-security-scanner-matrix-with-node-modules.test.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-security-scanner-matrix-without-node-modules.test.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-security-scanner-workspaces.test.ts

fix: collect all dependencies from workspace packages in scanner (#24942)

2025-11-21 18:31:45 -08:00

bun-update-security-edge-cases.test.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-update-security-provider.test.ts

Make --linker=isolated the default for bun install (#23311)

2025-10-08 18:00:38 -07:00

bun-update-security-scan-all.test.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-update-security-simple.test.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-update.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

bun-upgrade.test.ts

Speed up some more tests (#25892)

2026-01-07 23:39:10 -08:00

bun-workspaces.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

bun.lockb.bin-linking

Make bun.lock the default for new projects (#16540)

2025-01-20 23:17:52 -08:00

bunx.test.ts

fix(windows): improve bunx metadata validation (#25012)

2025-12-15 18:37:09 -08:00

catalogs.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

config-version.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

dep-arm64-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-arm64-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-arm64-darwin-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-arm64-linux-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-arm64-linux-4.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-both-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-darwin-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-darwin-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-darwin-arm64-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-darwin-arm64-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-darwin-only-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-linux-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-linux-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-linux-only-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-linux-only-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-linux-x64-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-linux-x64-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-multi-cpu-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-multi-cpu-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-not-arm64-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-not-arm64-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-not-linux-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-not-linux-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-ppc64-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-ppc64-3.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-universal-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-universal-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-universal-3.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-win32-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-win32-3.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-x64-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-x64-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-x64-darwin-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-x64-darwin-3.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-x64-linux-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-x64-only-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-x64-only-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

depends-on-monkey-0.0.2.tgz

bun install Security Scanner API (#21183)

2025-08-21 14:53:50 -07:00

dummy.registry.ts

refactor(test): migrate bun-install tests to concurrent execution (#25895)

2026-01-08 01:06:03 -08:00

generate-scanner-tarballs.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

hoist.test.ts

fix #24510 (#24563)

2025-11-14 16:49:21 -08:00

is-even-1.0.0.tgz

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

is-odd-1.0.0.tgz

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

isolated-install.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

left-pad-1.3.0.tgz

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

loader-runner-4.3.0.tgz

…

lockfile-only.test.ts

Make --linker=isolated the default for bun install (#23311)

2025-10-08 18:00:38 -07:00

migrate-bun-lockb-v2.test.ts

fix(install): fix optional peer resolving (#24272)

2025-11-01 22:38:36 -07:00

minimum-release-age.test.ts

test: add security scanner integration tests for minimum-release-age (#24944)

2025-11-22 15:08:12 -08:00

missing-directory-bin-1.1.1.tgz

start verdaccio in multiple test files (#16118)

2025-01-03 08:21:00 -08:00

monkey-0.0.2.tgz

bun install Security Scanner API (#21183)

2025-08-21 14:53:50 -07:00

moo-0.1.0.tgz

…

moo-0.2.0.tgz

…

multi-tool-pkg-1.0.0.tgz

Add postinstall optimizer with native binlink support and script skipping (#24283)

2025-11-03 20:36:22 -08:00

my-special-pkg-1.0.0.tgz

implement bunx --package (#21517)

2025-08-12 17:07:46 -07:00

npmrc.test.ts

Add email field support to .npmrc for registry authentication (#23709)

2025-10-20 16:32:04 -07:00

overrides.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

peer-0.0.1.tgz

…

peer-0.0.2.tgz

…

pkg-only-owner-2.2.2.tgz

fix(install): ensure read permissions when extracting files (#14511)

2024-10-12 02:37:51 -07:00

print-pm-1.0.0.tgz

…

public-hoist-pattern.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

qux-0.0.2.tgz

…

redacted-config-logs.test.ts

Implement isolated event loop for spawnSync (#24436)

2025-11-07 05:28:33 -08:00

runner-pkg-3.0.0.tgz

implement bunx --package (#21517)

2025-08-12 17:07:46 -07:00

semver-fixture.js

…

semver.test.ts

…

shebang-normalize.test.ts

Fix bin linking to atomically normalize CRLF in shebang lines (#23360)

2025-10-08 01:51:25 -07:00

simple-dummy-registry.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

symlink-path-traversal.test.ts

fix(install): prevent symlink path traversal in tarball extraction (#25584)

2026-01-09 16:56:31 -08:00

test-dev-peer-dependency-priority.test.ts

fix(install): fix resolving duplicate dependencies (#21059)

2025-07-16 01:01:10 -07:00

test-security-scanner-1.0.0-clean.tgz

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

test-security-scanner-1.0.0-fatal.tgz

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

test-security-scanner-1.0.0-warn.tgz

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

unsupported-integrity-hash.test.ts

fix(install): reject unsupported integrity hash algorithms in lockfiles

2026-02-12 04:48:27 +00:00

vendor-baz-0.0.1.tgz

…