Skip to main content
Add one or more dependencies with bun add. Unless you skip the audit, Talos first resolves the new dependency graph with bun add --lockfile-only, audits it, and rolls package.json and lockfiles back if the add is blocked.

Usage

Examples

Add one dependency:
Add multiple dependencies:
Add development dependencies:
Add exact versions instead of ^ ranges:
Skip the audit and run bun add directly:

Options

Rollback

Before resolving audited adds, Talos snapshots package.json, bun.lock, bun.lockb, and package-lock.json. If the audit blocks the add and you did not pass --force, those files are restored to their previous contents.

Caching

Audit results are cached at var/cache/security/add-audit.json. The cache key includes the resolved lockfile hash and the audit level.

Output

The audit report prints the number of modules and dependencies scanned. Findings are grouped by module and include severity, package, advisory title, source, advisory id, patched version when available, and advisory URL.