Install and lock dependencies

Bun is also a package manager. It reads the same package.json file used by npm.

Install the dependencies declared by the project:

bun install

Bun creates two important things:

• node_modules, containing packages used by the project
• bun.lock, recording the exact dependency versions Bun resolved

Commit bun.lock to Git. Without the lockfile, the version ranges in package.json may resolve to newer packages on another machine.

Use the lockfile in automation

During ordinary development, bun install may update bun.lock when package.json changes.

In CI and deployments, use a frozen install:

bun install --frozen-lockfile

This command fails when package.json and bun.lock disagree. That failure is useful. It tells you someone changed the dependencies without recording a new resolution.

For a production-only install, skip development dependencies:

bun install --frozen-lockfile --production

Moving an existing project to Bun

When a project has no bun.lock, Bun can migrate package-lock.json, yarn.lock, or pnpm-lock.yaml. It preserves the old lockfile.

Do not delete the old file immediately. First install, run the tests, and verify the application with Bun. Then choose one package manager for the project and remove the extra lockfile in a deliberate change.

Two active lockfiles create ambiguity. A teammate should not have to guess which dependency graph is authoritative.