Skip to main content
Run the command in a project with a bun.lock file:
terminal
Bun reads the package list from bun.lock (no node_modules required), sends it to the npm advisory endpoint, and prints a report. Packages from a scoped registry are sent to that registry instead; if it has no advisory endpoint, those packages are listed as skipped and don’t affect the exit code. bun audit never modifies package.json, bun.lock, or node_modules. To apply fixes, use bun audit fix. If no vulnerabilities are found, the command prints:
Otherwise, Bun lists each affected package with its severity, a short description, and a link to the advisory, followed by a summary:

​
Filtering options

--audit-level=<low|moderate|high|critical> - Only report vulnerabilities at this severity or higher:
terminal
--prod (-p, -P, --production) - Only audit packages reachable through dependencies, optionalDependencies, or peerDependencies:
terminal
--omit=<dev|optional|peer> - Skip packages only reachable through the given dependency type. Repeatable. --omit=dev is the same as --prod:
terminal
--ignore <id> - Ignore an advisory by GHSA ID or numeric ID. Repeatable. (CVE IDs are not in the registry data and won’t match.)
terminal
These options are CLI-only; to apply them on every run, put them in a package.json script.

​
--json

Print the raw JSON response from the registry instead of the formatted report:
terminal
The JSON is unfiltered — --audit-level and --ignore only affect the exit code.

​
bun audit fix

terminal
Runs the audit, then upgrades each vulnerable package to the lowest non-vulnerable version that every dependent’s range allows, and installs. Only bun.lock and node_modules change, with one exception: a direct dependency pinned to an exact version is treated as ^version, and the pin in package.json (or the catalog entry) is rewritten if a fix is found.
  • blocked by a dependent’s range — no safe version fits a dependent’s declared range. If the range is in your own package.json or catalog, bun audit fix --latest gets past it. Otherwise, update the dependent or add an overrides entry.
  • no published version fixes — every published version is vulnerable. Replace the package, or silence the advisory with the printed --ignore command.
  • If no newer version is safe but an older one is, Bun downgrades and marks the row (downgrade).
  • A safe version newer than --minimum-release-age is still installed, marked (newer than --minimum-release-age).
  • Patched dependencies (patchedDependencies) are upgraded like any other package; re-create the patch afterwards with bun patch.
  • After installing, Bun re-audits the new lockfile. The remaining count and exit code reflect that second audit, so they match what a follow-up bun audit would report.
  • --dry-run prints the plan without installing.
  • --json prints a single JSON object describing the plan and result (fixes, blocked, unfixable, unmatched, unaudited, vulnerableAfterInstall, fixed, remaining, dryRun). Pass --ignore-scripts if lifecycle scripts might write to stdout.
  • A security scanner configured in bunfig.toml runs on the packages about to be installed, as with bun update.
  • --prod, --frozen-lockfile, and --no-save are rejected since they prevent writing bun.lock.

​
bun audit fix --latest

terminal
Same as bun audit fix, but ranges in your own package.json files and catalogs no longer block a fix — they are rewritten to accept the new version, keeping their style (^5.0.0 → ^6.3.1, ~5.7.1 → ~6.3.1, exact stays exact). Ranges declared by third-party packages still block; use overrides for those.

​
Exit code

0 if no vulnerabilities remain after --audit-level and --ignore are applied, 1 otherwise. For bun audit fix, this is based on the re-audit after installing (or the plan, with --dry-run). If the registry request fails, both commands print audit request failed to stderr and exit 1.