> ## Documentation Index
> Fetch the complete documentation index at: https://bun-1dd33a4e-farm-de84d354-pm-sbom.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# bun audit

> Check your installed packages for known security vulnerabilities

Run the command in a project with a `bun.lock` file:

```bash terminal icon="terminal" theme={"theme":{"light":"github-light","dark":"dracula"}}
bun audit
```

Bun reads the package list from `bun.lock` (no `node_modules` required), sends it to the npm advisory endpoint, and prints a report. Packages from a scoped registry are sent to that registry instead; if it has no advisory endpoint, those packages are listed as skipped and don't affect the exit code.

`bun audit` never modifies `package.json`, `bun.lock`, or `node_modules`. To apply fixes, use [`bun audit fix`](#bun-audit-fix).

If no vulnerabilities are found, the command prints:

```
No vulnerabilities found
```

Otherwise, Bun lists each affected package with its severity, a short description, and a link to the advisory, followed by a summary:

```
3 vulnerabilities (1 high, 2 moderate)

  bun audit fix           upgrade the vulnerable packages within their ranges
  bun audit fix --latest  also cross major versions
```

### Filtering options

**`--audit-level=<low|moderate|high|critical>`** - Only report vulnerabilities at this severity or higher:

```bash terminal icon="terminal" theme={"theme":{"light":"github-light","dark":"dracula"}}
bun audit --audit-level=high
```

**`--prod`** (`-p`, `-P`, `--production`) - Only audit packages reachable through `dependencies`, `optionalDependencies`, or `peerDependencies`:

```bash terminal icon="terminal" theme={"theme":{"light":"github-light","dark":"dracula"}}
bun audit --prod
```

**`--omit=<dev|optional|peer>`** - Skip packages only reachable through the given dependency type. Repeatable. `--omit=dev` is the same as `--prod`:

```bash terminal icon="terminal" theme={"theme":{"light":"github-light","dark":"dracula"}}
bun audit --omit=optional --omit=peer
```

**`--ignore <id>`** - Ignore an advisory by GHSA ID or numeric ID. Repeatable. (CVE IDs are not in the registry data and won't match.)

```bash terminal icon="terminal" theme={"theme":{"light":"github-light","dark":"dracula"}}
bun audit --ignore GHSA-c2qf-rxjj-qqgw --ignore 1112918
```

These options are CLI-only; to apply them on every run, put them in a `package.json` script.

### `--json`

Print the raw JSON response from the registry instead of the formatted report:

```bash terminal icon="terminal" theme={"theme":{"light":"github-light","dark":"dracula"}}
bun audit --json
```

The JSON is unfiltered — `--audit-level` and `--ignore` only affect the exit code.

### `bun audit fix`

```bash terminal icon="terminal" theme={"theme":{"light":"github-light","dark":"dracula"}}
bun audit fix
```

Runs the audit, then upgrades each vulnerable package to the lowest non-vulnerable version that every dependent's range allows, and installs. Only `bun.lock` and `node_modules` change, with one exception: a direct dependency pinned to an exact version is treated as `^version`, and the pin in `package.json` (or the catalog entry) is rewritten if a fix is found.

```
fixing:
  ms@0.7.0 → 0.7.1
  lodash@4.17.20 → 4.17.21
    package.json: 4.17.20 → 4.17.21

blocked by a dependent's range:
  minimatch@0.3.0 → 3.0.2
    express@3.21.2 depends on minimatch@0.3.0
  semver@5.7.1 → 6.3.1
    my-app depends on semver@^5.0.0
    bun audit fix --latest

no published version fixes:
  left-pad@1.3.0  GHSA-xxxx-xxxx-xxxx
    bun audit fix --ignore GHSA-xxxx-xxxx-xxxx

Fixed 2 vulnerabilities in 2 packages
5 vulnerabilities remaining
```

* **blocked by a dependent's range** — no safe version fits a dependent's declared range. If the range is in your own `package.json` or catalog, `bun audit fix --latest` gets past it. Otherwise, update the dependent or add an [`overrides`](/pm/overrides) entry.
* **no published version fixes** — every published version is vulnerable. Replace the package, or silence the advisory with the printed `--ignore` command.
* If no newer version is safe but an older one is, Bun downgrades and marks the row `(downgrade)`.
* A safe version newer than `--minimum-release-age` is still installed, marked `(newer than --minimum-release-age)`.
* Patched dependencies (`patchedDependencies`) are upgraded like any other package; re-create the patch afterwards with `bun patch`.
* After installing, Bun re-audits the new lockfile. The `remaining` count and exit code reflect that second audit, so they match what a follow-up `bun audit` would report.
* `--dry-run` prints the plan without installing.
* `--json` prints a single JSON object describing the plan and result (`fixes`, `blocked`, `unfixable`, `unmatched`, `unaudited`, `vulnerableAfterInstall`, `fixed`, `remaining`, `dryRun`). Pass `--ignore-scripts` if lifecycle scripts might write to stdout.
* A [security scanner](/pm/security-scanner-api) configured in `bunfig.toml` runs on the packages about to be installed, as with `bun update`.
* `--prod`, `--frozen-lockfile`, and `--no-save` are rejected since they prevent writing `bun.lock`.

### `bun audit fix --latest`

```bash terminal icon="terminal" theme={"theme":{"light":"github-light","dark":"dracula"}}
bun audit fix --latest
```

Same as `bun audit fix`, but ranges in your own `package.json` files and catalogs no longer block a fix — they are rewritten to accept the new version, keeping their style (`^5.0.0` → `^6.3.1`, `~5.7.1` → `~6.3.1`, exact stays exact). Ranges declared by third-party packages still block; use `overrides` for those.

### Exit code

`0` if no vulnerabilities remain after `--audit-level` and `--ignore` are applied, `1` otherwise. For `bun audit fix`, this is based on the re-audit after installing (or the plan, with `--dry-run`).

If the registry request fails, both commands print `audit request failed` to stderr and exit `1`.