Skip to main content
Update workspace dependencies with bun update. Unless you skip the audit, Talos first resolves the updated graph with bun update --lockfile-only, audits it, and rolls package.json and lockfiles back if the update is blocked.

​
Usage

​
Examples

Update every dependency allowed by the current ranges:
Update selected dependencies only:
Update to latest versions, ignoring the ranges in package.json:
Update anyway when the audit finds vulnerabilities:
Skip the audit and run bun update directly:

​
Options

​
Rollback

Before resolving audited updates, Talos snapshots package.json, bun.lock, bun.lockb, and package-lock.json. If the audit blocks the update and you did not pass --force, those files are restored to their previous contents.

​
Caching

Audit results are cached at var/cache/security/update-audit.json. The cache key includes the resolved lockfile hash and the audit level.

​
Output

The audit report prints the number of modules and dependencies scanned. Findings are grouped by module and include severity, package, advisory title, source, advisory id, patched version when available, and advisory URL.