Skip to main content
Install the workspace dependencies with bun install. Unless you skip the audit, Talos first runs bun install --lockfile-only, audits the resolved dependency graph with the same audit engine used by security:check, and blocks the install when matching vulnerabilities are found.

​
Usage

​
Examples

Install dependencies after auditing for high and critical vulnerabilities:
Block only critical vulnerabilities:
Install anyway when the audit finds vulnerabilities:
Skip the audit and run bun install directly:
Run from another workspace directory:

​
Options

​
Audit flow

Without --skip-audit, the command resolves the dependency graph with bun install --lockfile-only, then audits dependencies through OSV.dev before running the final bun install. If vulnerabilities at or above --audit-level are found, the install is blocked. Use --force to continue anyway.

​
Caching

Audit results are cached at var/cache/security/install-audit.json. The cache key includes the first lockfile found from bun.lock, bun.lockb, or package-lock.json, plus the audit level. Cached audits expire after 24 hours.

​
Output

The audit report prints the number of modules and dependencies scanned. Findings are grouped by module and include severity, package, advisory title, source, advisory id, patched version when available, and advisory URL.