Repository navigation
--no-install flag isn't working for bun x #23673
Description
What version of Bun is running?
1.3.0
What platform is your computer?
macOS 26.0.1
What steps can reproduce the bug?
echo {} > package.json
echo '[install]' > bunfig.toml
echo 'auto = "disable"' >> bunfig.toml
bun x --no-install tsc --project .
What is the expected behavior?
bun x fails.
What do you see instead?
bun x runs a binary that is not installed for the project.
Additional information
It is important for reproducibility and security to be able to ensure that packages used by projects are pinned and loaded from the local repo. I think the --no-install is supposed to do that, but maybe I'm missing something:
> bun x --help
…
--no-install Skip installation if package is not already installed
…
Activity
linear commentedon Oct 14, 2025
ENG-20987
lgarron commentedon Oct 14, 2025
I found this issue because a
bun x tscinvocation in one of my project build scripts was taking a bit extra to start up, and printing dependency resolution messages. (Which means this is also a perf issue.)I realized I forgot to declare TypeScript as a dependency, and was surprised to see the command didn't fail.
lgarron commentedon Dec 20, 2025
I wrote myself a tool to run a dependency binary in a way that enforces that it actually exists: https://github.com/lgarron/bun-dx
I'd still like for
bun xto provide that functionality, either using--no-installor perhaps using a separate command likedx. Or at least a new flag like--locked, if--no-installcan't be changed.lgarron commentedon Dec 20, 2025
Wait, it might be worse than I thought.
Even when a dependency is pinned and installed, if that version of the dependency does not have the invoked binary,
bun xwill run a different version of the dependency than the pinned one. 😳I would consider that a security bug.
Invoke the `bin` path ourselves.
lgarron commentedon Oct 23, 2026
It looks like this is now implemented when the commandline flag is passed. This is great, as at least it makes it possible to perform a safe invocation.
However, it doesn't respect the
bunfig.tomlin a repo. So it still "fails unsafe" rather than having a way to "fail safe".lgarron commentedon Oct 23, 2026
It occurs to me that perhaps others wouldn't want this as a default. Perhaps a middle ground would be something like "bun px" ("project execute") that is the same as
bun xbut with--no-install. This is nearly as ergonomic and much more concise than sprinkling--no-installall throughout a project (which I'm personally fine with doing, but I think would discourage people in general).