> ## Documentation Index
> Fetch the complete documentation index at: https://docs.talosjs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# install

> Install Bun dependencies after a cached OSV vulnerability audit.

Install the workspace dependencies with `bun install`. Unless you skip the audit, Talos first runs `bun install --lockfile-only`, audits the resolved dependency graph with the same audit engine used by `security:check`, and blocks the install when matching vulnerabilities are found.

## Usage

```bash theme={null}
talos install [options]
```

## Examples

Install dependencies after auditing for high and critical vulnerabilities:

```bash theme={null}
talos install
```

Block only critical vulnerabilities:

```bash theme={null}
talos install --audit-level=critical
```

Install anyway when the audit finds vulnerabilities:

```bash theme={null}
talos install --force
```

Skip the audit and run `bun install` directly:

```bash theme={null}
talos install --skip-audit
```

Run from another workspace directory:

```bash theme={null}
talos install --cwd=../app
```

## Options

| Option          | Description                                                                                     | Default           |
| --------------- | ----------------------------------------------------------------------------------------------- | ----------------- |
| `--force`       | Install anyway when the audit finds vulnerable dependencies, or when the audit cannot complete. | `false`           |
| `--audit-level` | Minimum severity that blocks the install: `low`, `moderate`, `high`, or `critical`.             | `high`            |
| `--skip-audit`  | Skip the vulnerability audit and install directly.                                              | `false`           |
| `--no-cache`    | Bypass the cached audit result and re-query OSV.dev.                                            | `false`           |
| `--cwd`         | Working directory to install in.                                                                | Current directory |

## Audit flow

Without `--skip-audit`, the command resolves the dependency graph with `bun install --lockfile-only`, then audits dependencies through OSV.dev before running the final `bun install`.

If vulnerabilities at or above `--audit-level` are found, the install is blocked. Use `--force` to continue anyway.

## Caching

Audit results are cached at `var/cache/security/install-audit.json`. The cache key includes the first lockfile found from `bun.lock`, `bun.lockb`, or `package-lock.json`, plus the audit level. Cached audits expire after 24 hours.

## Output

The audit report prints the number of modules and dependencies scanned. Findings are grouped by module and include severity, package, advisory title, source, advisory id, patched version when available, and advisory URL.