mirror of
https://github.com/oven-sh/bun
synced 2026-02-02 15:08:46 +00:00
0c42b46af3
## Summary Remove outdated version mentions (1.0.x and 1.1.x) from documentation for better consistency. These versions are over a year old - you should be using a recent version of bun :). ## What changed **Removed version mentions from:** - `docs/pm/lifecycle.mdx` - v1.0.16 (trusted dependencies) - `docs/bundler/executables.mdx` - v1.0.23, v1.1.25, v1.1.30 (various features) - `docs/guides/install/jfrog-artifactory.mdx` - v1.0.3+ (env var comment) - `docs/guides/install/azure-artifacts.mdx` - v1.0.3+ (env var comment) - `docs/runtime/workers.mdx` - v1.1.13, v1.1.35 (blob URLs, preload) - `docs/runtime/networking/dns.mdx` - v1.1.9 (DNS caching) - `docs/guides/runtime/import-html.mdx` - v1.1.5 - `docs/guides/runtime/define-constant.mdx` - v1.1.5 - `docs/runtime/sqlite.mdx` - v1.1.31 **Kept version mentions in:** - All 1.2.x versions (still recent, less than a year old) - Benchmark version numbers (e.g., S3 performance comparison with v1.1.44) - `docs/guides/install/yarnlock.mdx` (bun.lock introduction context) - `docs/project/building-windows.mdx` (build requirements) - `docs/runtime/http/websockets.mdx` (performance benchmarks) ## Why The docs lack consistency around version mentions - we don't document every feature's version, so keeping scattered old version numbers looks inconsistent. These changes represent a small percentage of features added recently, and users on ancient versions have bigger problems than needing to know exactly when a feature landed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude Bot <claude-bot@bun.sh> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: RiskyMH <git@riskymh.dev> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
58 lines
2.2 KiB
Plaintext
58 lines
2.2 KiB
Plaintext
---
|
|
title: "Lifecycle scripts"
|
|
description: "How Bun handles package lifecycle scripts securely"
|
|
---
|
|
|
|
Packages on `npm` can define _lifecycle scripts_ in their `package.json`. Some of the most common are below, but there are [many others](https://docs.npmjs.com/cli/v10/using-npm/scripts).
|
|
|
|
- `preinstall`: Runs before the package is installed
|
|
- `postinstall`: Runs after the package is installed
|
|
- `preuninstall`: Runs before the package is uninstalled
|
|
- `prepublishOnly`: Runs before the package is published
|
|
|
|
These scripts are arbitrary shell commands that the package manager is expected to read and execute at the appropriate time. But executing arbitrary scripts represents a potential security risk, so—unlike other `npm` clients—Bun does not execute arbitrary lifecycle scripts by default.
|
|
|
|
---
|
|
|
|
## `postinstall`
|
|
|
|
The `postinstall` script is particularly important. It's widely used to build or install platform-specific binaries for packages that are implemented as [native Node.js add-ons](https://nodejs.org/api/addons.html). For example, `node-sass` is a popular package that uses `postinstall` to build a native binary for Sass.
|
|
|
|
```json package.json icon="file-json"
|
|
{
|
|
"name": "my-app",
|
|
"version": "1.0.0",
|
|
"dependencies": {
|
|
"node-sass": "^6.0.1"
|
|
}
|
|
}
|
|
```
|
|
|
|
---
|
|
|
|
## `trustedDependencies`
|
|
|
|
Instead of executing arbitrary scripts, Bun uses a "default-secure" approach. You can add certain packages to an allow list, and Bun will execute lifecycle scripts for those packages. To tell Bun to allow lifecycle scripts for a particular package, add the package name to `trustedDependencies` array in your `package.json`.
|
|
|
|
```json package.json icon="file-json"
|
|
{
|
|
"name": "my-app",
|
|
"version": "1.0.0",
|
|
"trustedDependencies": ["node-sass"] // [!code ++]
|
|
}
|
|
```
|
|
|
|
Once added to `trustedDependencies`, install/re-install the package. Bun will read this field and run lifecycle scripts for `my-trusted-package`.
|
|
|
|
The top 500 npm packages with lifecycle scripts are allowed by default. You can see the full list [here](https://github.com/oven-sh/bun/blob/main/src/install/default-trusted-dependencies.txt).
|
|
|
|
---
|
|
|
|
## `--ignore-scripts`
|
|
|
|
To disable lifecycle scripts for all packages, use the `--ignore-scripts` flag.
|
|
|
|
```bash terminal icon="terminal"
|
|
bun install --ignore-scripts
|
|
```
|