Bun install --frozen-lockfile does not lock optional dependencies

Question

When using Bun's --frozen-lockfile flag, the lockfile guarantees that direct and transitive dependencies are installed at the exact versions recorded in bun.lockb. However, the flag does not constrain how Bun handles optional dependencies listed in package.json. Depending on the target platform and the package’s optionalDependencies field, Bun may still resolve and fetch these packages, leading to different installed sets across machines even with an identical lockfile. Additionally, Bun does not provide a built‑in mechanism to block network access during installation, so postinstall scripts or binary downloads can contact external endpoints despite a frozen lockfile.
The Bun team has not yet decided whether to add a lockfile field or a CLI option to lock optional dependencies, leaving this behavior as an open design decision for achieving fully repeatable builds.
What approach should Bun take to ensure optional dependencies are also fixed by the lockfile?Should a dedicated flag be introduced to skip optional dependency resolution when --frozen-lockfile is used?Is there a way to enforce network isolation during install without relying on external tools?

Tasadduq Burney · Answer

Recommended approach
Record the resolved set of optional dependencies in the lockfile, then make --frozen-lockfile fail whenever the lockfile, package.json optionalDependencies, or the target platform disagree. Provide an explicit flag (e.g., --no-optional) to skip optional dependency resolution when desired, rather than changing the meaning of --frozen-lockfile silently.
Steps to achieve reproducible installs

Ensure your project uses a lockfile format that captures optional dependencies (Bun’s bun.lockb can be extended to store resolved optional packages).
  Run bun install --frozen-lockfile; if the lockfile does not contain the exact optional‑dependency versions required for the current platform, the command should exit with an error instead of silently installing a different set.
  When you deliberately want to omit optional dependencies (e.g., for a minimal CI image), use an explicit flag such as bun install --frozen-lockfile --no-optional. This flag should be recorded in your CI configuration so the behavior is reproducible.
  For network isolation, do not rely on the lockfile alone. Run the install in an environment with egress disabled (container, VM, or network policy) and pre‑populate Bun’s cache with all required tarballs and binaries. Any postinstall script or binary download that attempts external access will then fail visibly.

Missing diagnostic detail
To confirm that the above steps apply to your setup, please specify the Bun version you are using (e.g., bun -v). The lockfile format and flag semantics can differ between versions, which would change the exact commands needed.

Bun install --frozen-lockfile does not lock optional dependencies

1 answer

Recommended approach

Steps to achieve reproducible installs

Missing diagnostic detail

Your perspective belongs here.

0 question comments