Skip to content

fix(install): give bun's global dir its own package.json - #310

Merged
ralyodio merged 1 commit into
masterfrom
fix/install-bun-global-guard
Oct 13, 2026
Merged

ralyodio merged 1 commit into
masterfrom
fix/install-bun-global-guard

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Fixes a bug in the curl installer (public/install.sh, served at /install.sh).

When ${BUN_INSTALL:-$HOME/.bun}/install/global/package.json does not exist, bun add -g walks up from that dir and writes the dependency into the nearest package.json above it, e.g. a user's ~/package.json. The installer now creates an empty {} package.json in bun's global dir first, if there isn't one already.

Tested: sh -n passes. Throwaway layout with DIR/package.json = {"name":"parent"} and HOME=DIR/home BUN_INSTALL=DIR/home/.bun, run from / with bun 1.x:

  • before the fix: the parent package.json got a dependencies entry for the CLI
  • after the fix: the parent package.json is unchanged, and the CLI's bin is in DIR/home/.bun/bin

🤖 Generated with Claude Code

When ${BUN_INSTALL:-$HOME/.bun}/install/global/package.json does not
exist, `bun add -g` walks up from that dir and writes the dependency
into the nearest package.json above it, such as a user's ~/package.json.
Create an empty one first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

13 finding(s)

MEDIUM: 9 | LOW: 4

Severity Rule Location
MEDIUM js-unescaped-html-sink src/app/blog/[slug]/page.jsx:38
MEDIUM js-unescaped-html-sink src/app/blog/[slug]/page.jsx:66
MEDIUM js-unescaped-html-sink src/app/faq/page.jsx:57
MEDIUM js-unescaped-html-sink src/app/layout.jsx:141
MEDIUM js-unescaped-html-sink src/app/layout.jsx:145
MEDIUM js-unescaped-html-sink src/app/page.jsx:47
MEDIUM redos-nested-quantifier src/lib/auth/dns-name.js:88
MEDIUM js-unescaped-html-sink src/lib/components/chat/MessageItem.jsx:85
MEDIUM js-unescaped-html-sink src/lib/components/chat/MessageItem.jsx:130
LOW secret-generic-credential src/app/api/auth/register-anon/route.test.js:32
LOW secret-jwt tests/debug-sms.js:10
LOW secret-generic-credential tests/private-key-import-export.test.js:252
LOW secret-generic-credential tests/private-key-import-export.test.js:264

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 2e7a773 into master Oct 13, 2026
11 checks passed
@ralyodio
ralyodio deleted the fix/install-bun-global-guard branch October 13, 2026 00:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant