bun update

To upgrade your Bun CLI version, see bun upgrade.

bun update (alias bun up) updates every dependency — direct and transitive — to the newest version allowed by the ranges that request it, then rewrites package.json and bun.lock. To ignore your declared ranges, use --latest.

terminal

bun update

To update specific packages, pass their names. Names can be glob patterns, and ! excludes:

terminal

bun update zod
bun update jquery@3            # move the package.json entry to the newest 3.x
bun update '@types/*'
bun update '@babel/*' '!@babel/core'

bun update <package> updates <package> everywhere it appears in bun.lock and leaves everything else alone. This works for transitive dependencies too — bun update caniuse-lite picks up a nested fix without adding it to your package.json. A name that isn’t in bun.lock is an error. Updated packages appear in the install summary as ↑ name old → new, with (v3.0.0 available) when a newer major is out of range. Use --dry-run to preview.

How `package.json` is rewritten

^1.1.0 → ^1.2.0, ~1.1.0 → ~1.1.5. The operator is preserved. With install.exact or --exact, an exact version is written instead.
Exact pins, dist-tags ("latest", "next"), and other range forms (*, 1.x, >=1.0.0) are left as written; only bun.lock moves. --latest rewrites them.
catalog: references are never rewritten; the catalog entry in the root package.json is updated instead.
--no-save updates node_modules only, leaving package.json and bun.lock untouched.

What is held back

Ranges are never widened. A package that depends on foo@^1.0.0 never gets foo@2.x.
Versions in patchedDependencies stay put as long as their range allows, and are reported as kept name@version (patched, v1.2.3 available). --latest and bun audit fix do move them; re-create the patch with bun patch afterwards.
If a registry request for a transitive package fails, that package keeps its locked version and a warning is printed. A failed request for a direct dependency is an error.

`--interactive`

Use the --interactive flag to choose which packages to update:

terminal

bun update --interactive
bun update -i

This opens a terminal interface listing every outdated direct dependency. The packages you select are updated as if you had run bun update <name> ...; everything else keeps its locked version.

Interactive Interface

The interface displays packages grouped by dependency type:

? Select packages to update - Space to toggle, Enter to confirm, a to select all, n to select none, i to invert, l to toggle latest

  dependencies                Current  Target   Latest
    □ react                   17.0.2   18.2.0   18.3.1
    □ lodash                  4.17.20  4.17.21  4.17.21

  devDependencies             Current  Target   Latest
    □ typescript              4.8.0    5.0.0    5.3.3
    □ @types/node             16.11.7  18.0.0   20.11.5

  optionalDependencies        Current  Target   Latest
    □ some-optional-package   1.0.0    1.1.0    1.2.0

Sections:

Packages are grouped under section headers: dependencies, devDependencies, peerDependencies, optionalDependencies
Each section shows column headers aligned with the package data

Columns:

Package: Package name (may have a suffix such as dev, peer, or optional)
Current: Currently installed version
Target: Version that would be installed (respects semver constraints)
Latest: Latest available version

Keyboard Controls

Selection:

Space: Toggle package selection
Enter: Confirm selections and update
a/A: Select all packages
n/N: Select none
i/I: Invert selection

Navigation:

↑/↓ Arrow keys or j/k: Move cursor
l/L: Toggle between target and latest version for current package

Exit:

Ctrl+C or Ctrl+D: Cancel without updating

Visual Indicators

■ Selected packages (will be updated)
□ Unselected packages
❯ Current cursor position
Colors: Red (major), yellow (minor), green (patch) version changes
Underlined: Currently selected update target

Package Grouping

Packages are organized in sections by dependency type:

dependencies - Regular runtime dependencies
devDependencies - Development dependencies
peerDependencies - Peer dependencies
optionalDependencies - Optional dependencies

Within each section, individual packages may have a suffix ( dev, peer, optional).

`--recursive` and `--filter`

In a monorepo, bun update only rewrites the package.json of the workspace you run it in (from the root, transitive dependencies of every workspace are still updated in bun.lock).

--recursive (-r) updates every workspace’s package.json.
--filter <pattern> (-F) updates only the matching workspaces, using the filter syntax. Like bun install --filter, only the selected workspaces are linked afterwards.

Both combine with package names, --latest, --dry-run, and --interactive (which adds a “Workspace” column).

terminal

bun update --recursive
bun update --filter './packages/*'
bun update -i -r
bun update zod -r
bun update zod --filter '...^ui'

`--dev`, `--prod`, `--no-optional`

Restrict which package.json entries are updated: --dev (-D) for devDependencies only, --prod (-P) for dependencies and optionalDependencies only, --no-optional to skip optionalDependencies. They combine with names, patterns, --latest, and --interactive. These flags only select what to update — bun update --prod still installs devDependencies.

terminal

bun update --dev
bun update --prod --latest
bun update -D '@types/*'
bun update -i --prod

`--global`

bun update -g updates packages installed with bun add -g:

terminal

bun update -g
bun update -g typescript

`--latest`

By default, bun update updates each dependency to the latest version that satisfies the version range in your package.json. To update direct dependencies to the latest version regardless of the declared range, use --latest (-L). The package.json entry is rewritten to a range of the same style on the new version. Transitive dependencies still respect the ranges their dependents declare, and a dependency already ahead of latest (e.g. a prerelease) is not downgraded.

terminal

bun update --latest
bun update -L

In interactive mode, press l to toggle a package between its target version (respecting semver) and the latest version. For example, with the following package.json:

package.json

{
  "dependencies": {
    "react": "^17.0.2"
  }
}

bun update would update to a version that matches 17.x.
bun update --latest would update to a version that matches 18.x or later.

CLI Usage

terminal

bun update [<name>[@<version>] | <pattern>]...
bun up

Update Strategy

boolean

Always request the latest versions from the registry & reinstall all dependencies. Alias: -f

boolean

Update packages to their latest versions. Alias: -L

Dependency Scope

boolean

Only update devDependencies. Alias: -D

boolean

Only update dependencies and optionalDependencies. Aliases: -P, —production

boolean

Don’t update optionalDependencies

boolean

Install globally. Alias: -g

string

Exclude dev, optional, or peer dependencies from install

Project File Management

boolean

Write a yarn.lock file (yarn v1). Alias: -y

boolean

Don’t update package.json or save a lockfile

boolean

default:"true"

Save to package.json (true by default)

boolean

Disallow changes to lockfile

boolean

Save a text-based lockfile

boolean

Generate a lockfile without installing dependencies

Network & Registry

string

Provide a Certificate Authority signing certificate

string

Same as —ca, but as a file path to the certificate

string

Use a specific registry by default, overriding .npmrc, bunfig.toml and environment variables

number

default:"48"

Maximum number of concurrent network requests (default 48)

Caching

string

Store & load cached data from a specific directory path

boolean

Ignore manifest cache entirely

Output & Logging

boolean

Don’t log anything

boolean

Excessively verbose logging

boolean

Disable the progress bar

boolean

Don’t print a summary

Script Execution

boolean

Skip lifecycle scripts in the project’s package.json (dependency scripts are never run)

number

Maximum number of concurrent jobs for lifecycle scripts (default: 2x CPU cores)

Installation Controls

boolean

Skip verifying integrity of newly downloaded packages

boolean

Add to trustedDependencies in the project’s package.json and install the package(s)

string

default:"clonefile"

Platform-specific optimizations for installing dependencies. Possible values: clonefile (default), hardlink, symlink, copyfile

General & Environment

string

Specify path to config file (bunfig.toml). Alias: -c

boolean

Don’t install anything

string

Set a specific cwd

boolean

Print this help menu. Alias: -h

Core Commands

Publishing & Analysis

Workspace Management

Advanced Configuration

bun update

How `package.json` is rewritten

What is held back

`--interactive`

Interactive Interface

Keyboard Controls

Visual Indicators

Package Grouping

`--recursive` and `--filter`

`--dev`, `--prod`, `--no-optional`

`--global`

`--latest`

CLI Usage

Update Strategy

Dependency Scope

Project File Management

Network & Registry

Caching

Output & Logging

Script Execution

Installation Controls

General & Environment

​How package.json is rewritten

​What is held back

​--interactive

​Interactive Interface

​Keyboard Controls

​Visual Indicators

​Package Grouping

​--recursive and --filter

​--dev, --prod, --no-optional

​--global

​--latest

​CLI Usage

​Update Strategy

​Dependency Scope

​Project File Management

​Network & Registry

​Caching

​Output & Logging

​Script Execution

​Installation Controls

​General & Environment

How `package.json` is rewritten

What is held back

`--interactive`

Interactive Interface

Keyboard Controls

Visual Indicators

Package Grouping

`--recursive` and `--filter`

`--dev`, `--prod`, `--no-optional`

`--global`

`--latest`

CLI Usage

Update Strategy

Dependency Scope

Project File Management

Network & Registry

Caching

Output & Logging

Script Execution

Installation Controls

General & Environment