Skip to main content
bun install creates a lockfile called bun.lock.

​
Should it be committed to git?

Yes

​
Generate a lockfile without installing?

To generate a lockfile without installing to node_modules, use the --lockfile-only flag. The lockfile is always saved to disk, even if it is already up to date with your project’s package.json(s), unless --frozen-lockfile (or --production) is set.
terminal
bun add, bun remove, and bun update also accept --lockfile-only.
--lockfile-only still populates the global install cache with registry metadata and git/tarball dependencies.

​
Can I opt out?

To install without creating a lockfile:
terminal
To write a Yarn lockfile in addition to bun.lock:

​
Text-based lockfile

Bun v1.2 changed the default lockfile format to the text-based bun.lock. To migrate an existing binary bun.lockb, run bun install --save-text-lockfile --frozen-lockfile --lockfile-only and delete bun.lockb. For more on the format, see the blog post.

​
Automatic lockfile migration

When running bun install in a project without a bun.lock, Bun automatically migrates existing lockfiles:
  • yarn.lock (v1)
  • package-lock.json (npm, lockfileVersion 2, 3 or 4)
  • pnpm-lock.yaml (pnpm)
A package-lock.json from npm 6 or older (lockfileVersion 1) is not migrated; Bun prints a warning and resolves from package.json instead. The original lockfile is preserved and can be removed manually after verification.