robobun 7dcd49f832 fix(install): only apply default trusted dependencies to npm packages (#25163) ...

## Summary
- The default trusted dependencies list should only apply to packages
installed from npm
- Non-npm sources (file:, link:, git:, github:) now require explicit
trustedDependencies
- This prevents malicious packages from spoofing trusted names through
local paths or git repos

## Test plan
- [x] Added test: file: dependency named "esbuild" does NOT auto-run
postinstall scripts
- [x] Added test: file: dependency runs scripts when explicitly added to
trustedDependencies
- [x] Verified tests fail with system bun (old behavior) and pass with
new build
- [x] Build compiles successfully

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Bot <claude-bot@bun.sh>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Jarred Sumner <jarred@jarredsumner.com>
Co-authored-by: Dylan Conway <dylan.conway567@gmail.com>

2025-12-11 17:44:41 -08:00

..

__snapshots__

fix(install): bun pm ls with unresolved dependencies (#24541)

2025-11-10 11:19:57 -08:00

fixtures

fix(install): serialize updated workspaces versions correctly for bun.lockb (#22932)

2025-09-24 02:42:57 -07:00

hosted-git-info

bug(ENG-21501): Fix integer overflow in hosted_git_info.zig (#24561)

2025-11-10 16:30:47 -08:00

migration

fix(install): create bun.lock instead of bun.lockb if npm/yarn/pnpm migration fails (#24494)

2025-11-07 20:58:44 -08:00

registry

Add postinstall optimizer with native binlink support and script skipping (#24283)

2025-11-03 20:36:22 -08:00

actual-package-2.0.0.tgz

implement bunx --package (#21517)

2025-08-12 17:07:46 -07:00

architecture-match.test.ts

Fix edgecase with "os" and "cpu" in bun install (#13848)

2024-09-11 16:47:38 -07:00

bad-workspace.test.ts

fix: prevent crash when workspace includes "./" or ".\" (#23337)

2025-10-07 08:17:13 -07:00

bar-0.0.2.tgz

Reorganize tests (#2332)

2023-03-07 12:22:34 -08:00

baz-0.0.3.tgz

Reorganize tests (#2332)

2023-03-07 12:22:34 -08:00

baz-0.0.5.tgz

Reorganize tests (#2332)

2023-03-07 12:22:34 -08:00

boba-0.0.2.tgz

make peer dependencies install by default (#6396)

2023-10-10 20:05:58 -07:00

bun-add.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

bun-audit.test.ts

bun audit add more filtering options (#21833)

2025-08-14 16:36:44 -07:00

bun-create.test.ts

Use ReadableStream.prototype.* in tests instead of new Response(...).* (#20937)

2025-07-14 00:47:53 -07:00

bun-info.test.ts

Start using test.concurrent in our tests (#22823)

2025-09-22 05:30:34 -07:00

bun-install-cpu-os.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

bun-install-lifecycle-scripts.test.ts

fix(install): only apply default trusted dependencies to npm packages (#25163)

2025-12-11 17:44:41 -08:00

bun-install-native-binlink.test.ts

Add postinstall optimizer with native binlink support and script skipping (#24283)

2025-11-03 20:36:22 -08:00

bun-install-patch.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

bun-install-pathname-trailing-slash.test.ts

Implement isolated event loop for spawnSync (#24436)

2025-11-07 05:28:33 -08:00

bun-install-proxy.test.ts

[publish images] ci: ensure tests that require docker have it available (#22781)

2025-09-25 19:03:22 -07:00

bun-install-registry.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

bun-install-retry.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

bun-install-security-provider.test.ts

Make --linker=isolated the default for bun install (#23311)

2025-10-08 18:00:38 -07:00

bun-install.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

bun-link.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

bun-lock.test.ts

implement pnpm migration (#22262)

2025-09-27 00:45:29 -07:00

bun-lockb.test.ts

implement pnpm migration (#22262)

2025-09-27 00:45:29 -07:00

bun-pack.test.ts

fix(pack): always include bin even if not included by files (#23606)

2025-10-19 23:28:59 -07:00

bun-patch.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

bun-pm-pkg.test.ts

implement bun pm pkg (#21046)

2025-07-15 22:14:00 -07:00

bun-pm-scan.test.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-pm-version.test.ts

followup for bun pm version (#20799)

2025-07-07 11:21:36 -07:00

bun-pm-why.test.ts

Start using test.concurrent in our tests (#22823)

2025-09-22 05:30:34 -07:00

bun-pm.test.ts

Make 'bun list' an alias for 'bun pm ls' (#24159)

2025-10-29 21:05:25 -07:00

bun-publish.test.ts

Fix --tolerate-republish flag in bun publish (continues PR #22107) (#22381)

2025-09-30 13:25:50 -07:00

bun-remove.test.ts

Use ReadableStream.prototype.* in tests instead of new Response(...).* (#20937)

2025-07-14 00:47:53 -07:00

bun-repl.test.ts

Skip failing test on arm64 linux musl caused by third-party dependency

2025-09-26 15:23:32 -07:00

bun-run-bunfig.test.ts

load local bunfig.toml for bun run earlier (for run.bun option) (#16664)

2025-10-08 12:13:06 -07:00

bun-run-dir.test.ts

Unskip some tests (#22116)

2025-08-27 06:39:11 -07:00

bun-run.test.ts

Unskip some tests (#22116)

2025-08-27 06:39:11 -07:00

bun-security-scanner-matrix-runner.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-security-scanner-matrix-with-node-modules.test.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-security-scanner-matrix-without-node-modules.test.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-security-scanner-workspaces.test.ts

fix: collect all dependencies from workspace packages in scanner (#24942)

2025-11-21 18:31:45 -08:00

bun-update-security-edge-cases.test.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-update-security-provider.test.ts

Make --linker=isolated the default for bun install (#23311)

2025-10-08 18:00:38 -07:00

bun-update-security-scan-all.test.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-update-security-simple.test.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-update.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

bun-upgrade.test.ts

Use ReadableStream.prototype.* in tests instead of new Response(...).* (#20937)

2025-07-14 00:47:53 -07:00

bun-workspaces.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

bun.lockb.bin-linking

Make bun.lock the default for new projects (#16540)

2025-01-20 23:17:52 -08:00

bunx.test.ts

implement bunx --package (#21517)

2025-08-12 17:07:46 -07:00

catalogs.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

config-version.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

dep-arm64-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-arm64-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-arm64-darwin-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-arm64-linux-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-arm64-linux-4.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-both-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-darwin-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-darwin-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-darwin-arm64-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-darwin-arm64-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-darwin-only-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-linux-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-linux-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-linux-only-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-linux-only-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-linux-x64-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-linux-x64-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-multi-cpu-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-multi-cpu-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-not-arm64-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-not-arm64-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-not-linux-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-not-linux-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-ppc64-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-ppc64-3.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-universal-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-universal-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-universal-3.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-win32-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-win32-3.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-x64-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-x64-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-x64-darwin-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-x64-darwin-3.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-x64-linux-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-x64-only-1.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

dep-x64-only-2.0.0.tgz

feat: add --cpu and --os flags to bun install for filtering optional dependencies (#22850)

2025-09-22 03:27:09 -07:00

depends-on-monkey-0.0.2.tgz

bun install Security Scanner API (#21183)

2025-08-21 14:53:50 -07:00

dummy.registry.ts

Make --linker=isolated the default for bun install (#23311)

2025-10-08 18:00:38 -07:00

generate-scanner-tarballs.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

hoist.test.ts

fix #24510 (#24563)

2025-11-14 16:49:21 -08:00

is-even-1.0.0.tgz

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

is-odd-1.0.0.tgz

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

isolated-install.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

left-pad-1.3.0.tgz

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

loader-runner-4.3.0.tgz

fix install test

2023-10-12 15:17:03 -07:00

lockfile-only.test.ts

Make --linker=isolated the default for bun install (#23311)

2025-10-08 18:00:38 -07:00

migrate-bun-lockb-v2.test.ts

fix(install): fix optional peer resolving (#24272)

2025-11-01 22:38:36 -07:00

minimum-release-age.test.ts

test: add security scanner integration tests for minimum-release-age (#24944)

2025-11-22 15:08:12 -08:00

missing-directory-bin-1.1.1.tgz

start verdaccio in multiple test files (#16118)

2025-01-03 08:21:00 -08:00

monkey-0.0.2.tgz

bun install Security Scanner API (#21183)

2025-08-21 14:53:50 -07:00

moo-0.1.0.tgz

[install] fix re-run of tarball URL from lockfile (#2507)

2023-03-29 20:38:19 -07:00

moo-0.2.0.tgz

fix installing dependencies that match workspace versions (#6494)

2023-10-13 20:37:48 -07:00

multi-tool-pkg-1.0.0.tgz

Add postinstall optimizer with native binlink support and script skipping (#24283)

2025-11-03 20:36:22 -08:00

my-special-pkg-1.0.0.tgz

implement bunx --package (#21517)

2025-08-12 17:07:46 -07:00

npmrc.test.ts

Add email field support to .npmrc for registry authentication (#23709)

2025-10-20 16:32:04 -07:00

overrides.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

peer-0.0.1.tgz

make peer dependencies install by default (#6396)

2023-10-10 20:05:58 -07:00

peer-0.0.2.tgz

make peer dependencies install by default (#6396)

2023-10-10 20:05:58 -07:00

pkg-only-owner-2.2.2.tgz

fix(install): ensure read permissions when extracting files (#14511)

2024-10-12 02:37:51 -07:00

print-pm-1.0.0.tgz

fix(bun_shim_impl): pass env to CreateProcessW (#11817)

2024-06-12 16:50:57 -07:00

public-hoist-pattern.test.ts

add "configVersion" to bun.lock(b) (#24236)

2025-11-03 22:20:07 -08:00

qux-0.0.2.tgz

add default trustedDependencies and run lifecycle scripts during installation (#7132)

2023-12-11 22:08:25 -08:00

redacted-config-logs.test.ts

Implement isolated event loop for spawnSync (#24436)

2025-11-07 05:28:33 -08:00

runner-pkg-3.0.0.tgz

implement bunx --package (#21517)

2025-08-12 17:07:46 -07:00

semver-fixture.js

install: dont crash in debug mode when a semver has a build tag and multiple hyphens in the pre-release tag (#9288)

2024-03-06 20:38:49 -08:00

semver.test.ts

fix(install): semver tag parsing bugfix (#11387)

2024-05-27 02:17:43 -07:00

shebang-normalize.test.ts

Fix bin linking to atomically normalize CRLF in shebang lines (#23360)

2025-10-08 01:51:25 -07:00

simple-dummy-registry.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

test-dev-peer-dependency-priority.test.ts

fix(install): fix resolving duplicate dependencies (#21059)

2025-07-16 01:01:10 -07:00

test-security-scanner-1.0.0-clean.tgz

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

test-security-scanner-1.0.0-fatal.tgz

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

test-security-scanner-1.0.0-warn.tgz

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

vendor-baz-0.0.1.tgz

fix: install vendored node_modules when using hardlinks (#9007)

2024-02-19 22:50:24 -08:00