#security
The Bun CVE Gap, Closed: Surgical Updates Land in Bun 1.4
11 min readThree months ago, I wrote that Bun was the only mainstream package manager that couldn't do surgical CVE remediation. Bun 1.4 ships in-place transitive updates, bun audit fix, and nested overrides. Time to re-run the original reproductions.
Surgical Transitive Updates with pnpm: audit --fix
5 min readpnpm's audit --fix can now update vulnerable transitives directly in the lockfile instead of reaching for overrides first, and it even plays nicely with minimumReleaseAge. Let's dig in.
The Bun CVE Gap: When Your Package Manager Can't Do Surgical Updates
10 min readYarn Berry, pnpm, and npm all support surgical CVE remediation. Bun, today, doesn't. Here's what I found when I tried to apply my own workflow to a Bun project.
Stop Using Yarn Classic
5 min readYarn Classic is frozen, and its lack of recursive transitive updates is becoming a real liability in an era where CVEs land weekly. It's time to move on.
Protecting Against Compromised Packages with Minimum Release Age
7 min readLeverage your package manager's minimum release age setting to delay the installation of freshly published versions and reduce the risk of pulling in a compromised package.
Minimizing Risk: Properly and Safely Resolving CVEs in Your Dependencies
10 min readHow to properly and safely update dependencies to resolve CVEs, while also gathering an understanding of how package managers handle dependencies.