bun-types 1.3.2-canary.20251106T140813 → 1.3.2

package/docs/pm/catalogs.mdx

@@ -0,0 +1,292 @@
+---
+title: "Catalogs"
+description: "Share common dependency versions across multiple packages in a monorepo"
+---
+
+Catalogs in Bun provide a straightforward way to share common dependency versions across multiple packages in a monorepo. Rather than specifying the same versions repeatedly in each workspace package, you define them once in the root package.json and reference them consistently throughout your project.
+
+## Overview
+
+Unlike traditional dependency management where each workspace package needs to independently specify versions, catalogs let you:
+
+1. Define version catalogs in the root package.json
+2. Reference these versions with a simple `catalog:` protocol
+3. Update all packages simultaneously by changing the version in just one place
+
+This is especially useful in large monorepos where dozens of packages need to use the same version of key dependencies.
+
+## How to Use Catalogs
+
+### Directory Structure Example
+
+Consider a monorepo with the following structure:
+
+```
+my-monorepo/
+├── package.json
+├── bun.lock
+└── packages/
+    ├── app/
+    │   └── package.json
+    ├── ui/
+    │   └── package.json
+    └── utils/
+        └── package.json
+```
+
+### 1. Define Catalogs in Root package.json
+
+In your root-level `package.json`, add a `catalog` or `catalogs` field within the `workspaces` object:
+
+```json package.json icon="file-json"
+{
+  "name": "my-monorepo",
+  "workspaces": {
+    "packages": ["packages/*"],
+    "catalog": {
+      "react": "^19.0.0",
+      "react-dom": "^19.0.0"
+    },
+    "catalogs": {
+      "testing": {
+        "jest": "30.0.0",
+        "testing-library": "14.0.0"
+      }
+    }
+  }
+}
+```
+
+If you put `catalog` or `catalogs` at the top level of the `package.json` file, that will work too.
+
+### 2. Reference Catalog Versions in Workspace Packages
+
+In your workspace packages, use the `catalog:` protocol to reference versions:
+
+```json packages/app/package.json icon="file-json"
+{
+  "name": "app",
+  "dependencies": {
+    "react": "catalog:",
+    "react-dom": "catalog:",
+    "jest": "catalog:testing"
+  }
+}
+```
+
+```json packages/ui/package.json icon="file-json"
+{
+  "name": "ui",
+  "dependencies": {
+    "react": "catalog:",
+    "react-dom": "catalog:"
+  },
+  "devDependencies": {
+    "jest": "catalog:testing",
+    "testing-library": "catalog:testing"
+  }
+}
+```
+
+### 3. Run Bun Install
+
+Run `bun install` to install all dependencies according to the catalog versions.
+
+## Catalog vs Catalogs
+
+Bun supports two ways to define catalogs:
+
+1. **`catalog`** (singular): A single default catalog for commonly used dependencies
+
+   ```json package.json icon="file-json"
+   "catalog": {
+     "react": "^19.0.0",
+     "react-dom": "^19.0.0"
+   }
+   ```
+
+   Reference with simply `catalog:`:
+
+   ```json packages/app/package.json icon="file-json"
+   "dependencies": {
+     "react": "catalog:"
+   }
+   ```
+
+2. **`catalogs`** (plural): Multiple named catalogs for grouping dependencies
+
+   ```json package.json icon="file-json"
+   "catalogs": {
+     "testing": {
+       "jest": "30.0.0"
+     },
+     "ui": {
+       "tailwind": "4.0.0"
+     }
+   }
+   ```
+
+   Reference with `catalog:<name>`:
+
+   ```json packages/app/package.json icon="file-json"
+   "dependencies": {
+     "jest": "catalog:testing",
+     "tailwind": "catalog:ui"
+   }
+   ```
+
+## Benefits of Using Catalogs
+
+- **Consistency**: Ensures all packages use the same version of critical dependencies
+- **Maintenance**: Update a dependency version in one place instead of across multiple package.json files
+- **Clarity**: Makes it obvious which dependencies are standardized across your monorepo
+- **Simplicity**: No need for complex version resolution strategies or external tools
+
+## Real-World Example
+
+Here's a more comprehensive example for a React application:
+
+**Root package.json**
+
+```json package.json icon="file-json"
+{
+  "name": "react-monorepo",
+  "workspaces": {
+    "packages": ["packages/*"],
+    "catalog": {
+      "react": "^19.0.0",
+      "react-dom": "^19.0.0",
+      "react-router-dom": "^6.15.0"
+    },
+    "catalogs": {
+      "build": {
+        "webpack": "5.88.2",
+        "babel": "7.22.10"
+      },
+      "testing": {
+        "jest": "29.6.2",
+        "react-testing-library": "14.0.0"
+      }
+    }
+  },
+  "devDependencies": {
+    "typescript": "5.1.6"
+  }
+}
+```
+
+```json packages/app/package.json icon="file-json"
+{
+  "name": "app",
+  "dependencies": {
+    "react": "catalog:",
+    "react-dom": "catalog:",
+    "react-router-dom": "catalog:",
+    "@monorepo/ui": "workspace:*",
+    "@monorepo/utils": "workspace:*"
+  },
+  "devDependencies": {
+    "webpack": "catalog:build",
+    "babel": "catalog:build",
+    "jest": "catalog:testing",
+    "react-testing-library": "catalog:testing"
+  }
+}
+```
+
+```json packages/ui/package.json icon="file-json"
+{
+  "name": "@monorepo/ui",
+  "dependencies": {
+    "react": "catalog:",
+    "react-dom": "catalog:"
+  },
+  "devDependencies": {
+    "jest": "catalog:testing",
+    "react-testing-library": "catalog:testing"
+  }
+}
+```
+
+```json packages/utils/package.json icon="file-json"
+{
+  "name": "@monorepo/utils",
+  "dependencies": {
+    "react": "catalog:"
+  },
+  "devDependencies": {
+    "jest": "catalog:testing"
+  }
+}
+```
+
+## Updating Versions
+
+To update versions across all packages, simply change the version in the root package.json:
+
+```json package.json icon="file-json"
+"catalog": {
+  "react": "^19.1.0",  // Updated from ^19.0.0
+  "react-dom": "^19.1.0"  // Updated from ^19.0.0
+}
+```
+
+Then run `bun install` to update all packages.
+
+## Lockfile Integration
+
+Bun's lockfile tracks catalog versions, making it easy to ensure consistent installations across different environments. The lockfile includes:
+
+- The catalog definitions from your package.json
+- The resolution of each cataloged dependency
+
+```json bun.lock(excerpt) icon="file-json"
+{
+  "lockfileVersion": 1,
+  "workspaces": {
+    "": {
+      "name": "react-monorepo",
+    },
+    "packages/app": {
+      "name": "app",
+      "dependencies": {
+        "react": "catalog:",
+        "react-dom": "catalog:",
+        ...
+      },
+    },
+    ...
+  },
+  "catalog": {
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    ...
+  },
+  "catalogs": {
+    "build": {
+      "webpack": "5.88.2",
+      ...
+    },
+    ...
+  },
+  "packages": {
+    ...
+  }
+}
+```
+
+## Limitations and Edge Cases
+
+- Catalog references must match a dependency defined in either `catalog` or one of the named `catalogs`
+- Empty strings and whitespace in catalog names are ignored (treated as default catalog)
+- Invalid dependency versions in catalogs will fail to resolve during `bun install`
+- Catalogs are only available within workspaces; they cannot be used outside the monorepo
+
+Bun's catalog system provides a powerful yet simple way to maintain consistency across your monorepo without introducing additional complexity to your workflow.
+
+## Publishing
+
+When you run `bun publish` or `bun pm pack`, Bun automatically replaces
+`catalog:` references in your `package.json` with the resolved version numbers.
+The published package includes regular semver strings and no longer depends on
+your catalog definitions.

package/docs/pm/cli/add.mdx

@@ -0,0 +1,179 @@
+---
+title: "bun add"
+description: "Add packages to your project with Bun's fast package manager"
+---
+
+import Add from "/snippets/cli/add.mdx";
+
+To add a particular package:
+
+```bash terminal icon="terminal"
+bun add preact
+```
+
+To specify a version, version range, or tag:
+
+```bash terminal icon="terminal"
+bun add zod@3.20.0
+bun add zod@^3.0.0
+bun add zod@latest
+```
+
+## `--dev`
+
+<Note>**Alias** — `--development`, `-d`, `-D`</Note>
+
+To add a package as a dev dependency (`"devDependencies"`):
+
+```bash terminal icon="terminal"
+bun add --dev @types/react
+bun add -d @types/react
+```
+
+## `--optional`
+
+To add a package as an optional dependency (`"optionalDependencies"`):
+
+```bash terminal icon="terminal"
+bun add --optional lodash
+```
+
+## `--peer`
+
+To add a package as a peer dependency (`"peerDependencies"`):
+
+```bash terminal icon="terminal"
+bun add --peer @types/bun
+```
+
+## `--exact`
+
+<Note>**Alias** — `-E`</Note>
+
+To add a package and pin to the resolved version, use `--exact`. This will resolve the version of the package and add it to your `package.json` with an exact version number instead of a version range.
+
+```bash terminal icon="terminal"
+bun add react --exact
+bun add react -E
+```
+
+This will add the following to your `package.json`:
+
+```json package.json icon="file-json"
+{
+  "dependencies": {
+    // without --exact
+    "react": "^18.2.0", // this matches >= 18.2.0 < 19.0.0
+
+    // with --exact
+    "react": "18.2.0" // this matches only 18.2.0 exactly
+  }
+}
+```
+
+To view a complete list of options for this command:
+
+```bash terminal icon="terminal"
+bun add --help
+```
+
+## `--global`
+
+<Note>
+  **Note** — This would not modify package.json of your current project folder. **Alias** - `bun add --global`, `bun add
+  -g`, `bun install --global` and `bun install -g`
+</Note>
+
+To install a package globally, use the `-g`/`--global` flag. This will not modify the `package.json` of your current project. Typically this is used for installing command-line tools.
+
+```bash terminal icon="terminal"
+bun add --global cowsay # or `bun add -g cowsay`
+cowsay "Bun!"
+```
+
+```txt
+ ______
+< Bun! >
+ ------
+        \   ^__^
+         \  (oo)\_______
+            (__)\       )\/\
+                ||----w |
+                ||     ||
+```
+
+<Accordion title="Configuring global installation behavior">
+
+```toml bunfig.toml icon="settings"
+[install]
+# where `bun add --global` installs packages
+globalDir = "~/.bun/install/global"
+
+# where globally-installed package bins are linked
+globalBinDir = "~/.bun/bin"
+```
+
+</Accordion>
+
+## Trusted dependencies
+
+Unlike other npm clients, Bun does not execute arbitrary lifecycle scripts for installed dependencies, such as `postinstall`. These scripts represent a potential security risk, as they can execute arbitrary code on your machine.
+
+To tell Bun to allow lifecycle scripts for a particular package, add the package to `trustedDependencies` in your package.json.
+
+```json package.json icon="file-json"
+{
+  "name": "my-app",
+  "version": "1.0.0",
+  "trustedDependencies": ["my-trusted-package"] // [!code ++]
+}
+```
+
+Bun reads this field and will run lifecycle scripts for `my-trusted-package`.
+
+## Git dependencies
+
+To add a dependency from a public or private git repository:
+
+```bash terminal icon="terminal"
+bun add git@github.com:moment/moment.git
+```
+
+<Note>
+  To install private repositories, your system needs the appropriate SSH credentials to access the repository.
+</Note>
+
+Bun supports a variety of protocols, including [`github`](https://docs.npmjs.com/cli/v9/configuring-npm/package-json#github-urls), [`git`](https://docs.npmjs.com/cli/v9/configuring-npm/package-json#git-urls-as-dependencies), `git+ssh`, `git+https`, and many more.
+
+```json package.json icon="file-json"
+{
+  "dependencies": {
+    "dayjs": "git+https://github.com/iamkun/dayjs.git",
+    "lodash": "git+ssh://github.com/lodash/lodash.git#4.17.21",
+    "moment": "git@github.com:moment/moment.git",
+    "zod": "github:colinhacks/zod"
+  }
+}
+```
+
+## Tarball dependencies
+
+A package name can correspond to a publicly hosted `.tgz` file. During installation, Bun will download and install the package from the specified tarball URL, rather than from the package registry.
+
+```sh terminal icon="terminal"
+bun add zod@https://registry.npmjs.org/zod/-/zod-3.21.4.tgz
+```
+
+This will add the following line to your `package.json`:
+
+```json package.json icon="file-json"
+{
+  "dependencies": {
+    "zod": "https://registry.npmjs.org/zod/-/zod-3.21.4.tgz"
+  }
+}
+```
+
+---
+
+<Add />

package/docs/pm/cli/audit.mdx

@@ -0,0 +1,60 @@
+---
+title: "bun audit"
+description: "Check your installed packages for known security vulnerabilities"
+---
+
+Run the command in a project with a `bun.lock` file:
+
+```bash terminal icon="terminal"
+bun audit
+```
+
+Bun sends the list of installed packages and versions to NPM, and prints a report of any vulnerabilities that were found. Packages installed from registries other than the default registry are skipped.
+
+If no vulnerabilities are found, the command prints:
+
+```
+No vulnerabilities found
+```
+
+When vulnerabilities are detected, each affected package is listed along with the severity, a short description and a link to the advisory. At the end of the report Bun prints a summary and hints for updating:
+
+```
+3 vulnerabilities (1 high, 2 moderate)
+To update all dependencies to the latest compatible versions:
+  bun update
+To update all dependencies to the latest versions (including breaking changes):
+  bun update --latest
+```
+
+### Filtering options
+
+**`--audit-level=<low|moderate|high|critical>`** - Only show vulnerabilities at this severity level or higher:
+
+```bash terminal icon="terminal"
+bun audit --audit-level=high
+```
+
+**`--prod`** - Audit only production dependencies (excludes devDependencies):
+
+```bash terminal icon="terminal"
+bun audit --prod
+```
+
+**`--ignore <CVE>`** - Ignore specific CVEs (can be used multiple times):
+
+```bash terminal icon="terminal"
+bun audit --ignore CVE-2022-25883 --ignore CVE-2023-26136
+```
+
+### `--json`
+
+Use the `--json` flag to print the raw JSON response from the registry instead of the formatted report:
+
+```bash terminal icon="terminal"
+bun audit --json
+```
+
+### Exit code
+
+`bun audit` will exit with code `0` if no vulnerabilities are found and `1` if the report lists any vulnerabilities. This will still happen even if `--json` is passed.