Skip to content
Navigation Menu
Sign in
Appearance settings
Platform
AI CODE CREATION
GitHub Copilot
Write better code with AI
GitHub Copilot app
Direct agents from issue to merge
MCP Registry
Integrate external tools
DEVELOPER WORKFLOWS
Actions
Automate any workflow
Codespaces
Instant dev environments
Issues
Plan and track work
Code Review
Manage code changes
Code Quality
Enforce quality at merge
APPLICATION SECURITY
GitHub Advanced Security
Find and fix vulnerabilities
Code security
Secure your code as you build
Secret protection
Stop leaks before they start
EXPLORE
Why GitHub
Documentation
Blog
Changelog
Marketplace
View all features
Solutions
BY COMPANY SIZE
Enterprises
Small and medium teams
Startups
Nonprofits
BY USE CASE
App Modernization
DevSecOps
DevOps
CI/CD
View all use cases
BY INDUSTRY
Healthcare
Financial services
Manufacturing
Government
View all industries
View all solutions
Resources
EXPLORE BY TOPIC
AI
Software Development
DevOps
Security
View all topics
EXPLORE BY TYPE
Customer stories
Events & webinars
Ebooks & reports
Business insights
GitHub Skills
SUPPORT & SERVICES
Documentation
Customer support
Community forum
Trust center
Partners
View all resources
Open Source
COMMUNITY
GitHub Sponsors
Fund open source developers
PROGRAMS
Security Lab
Maintainer Community
GitHub Stars
Archive Program
REPOSITORIES
Topics
Trending
Collections
Enterprise
ENTERPRISE SOLUTIONS
Enterprise platform
AI-powered developer platform
AVAILABLE ADD-ONS
GitHub Advanced Security
Enterprise-grade security features
Copilot for Business
Enterprise-grade AI features
Premium Support
Enterprise-grade 24/7 support
Pricing
Search
/
Sign in
Sign up
Appearance settings
You signed in with another tab or window.
Reload
to refresh your session.
You signed out in another tab or window.
Reload
to refresh your session.
You switched accounts on another tab or window.
Reload
to refresh your session.
Dismiss alert
{{ message }}
oven-sh
/
bun
Public
Notifications
You must be signed in to change notification settings
Fork
5.1k
Star
96.1k
Code
Issues
3.7k
Pull requests
5k+
Discussions
Actions
Security and quality
0
Insights
Additional navigation options
Code
Issues
Pull requests
Discussions
Actions
Security and quality
Insights
install: refuse link: targets that leave the project when a package from the cache declares them, at resolve and install time
- #39023
#39023
Open
robobun
wants to merge 11 commits into
main
oven-sh/bun:main
from
farm/a8fa2871/reject-remote-escaping-links
oven-sh/bun:farm/a8fa2871/reject-remote-escaping-links
Copy head branch name to clipboard
Conversation
Commits
11
(11)
Checks
Files changed
Open
install: refuse link: targets that leave the project when a package from the cache declares them, at resolve and install time
#39023
robobun
wants to merge 11 commits into
main
oven-sh/bun:main
from
farm/a8fa2871/reject-remote-escaping-links
oven-sh/bun:farm/a8fa2871/reject-remote-escaping-links
Copy head branch name to clipboard
Commits
Commits on Sep 30, 2026
install: refuse link: paths with .. or an absolute path declared by packages installed from the cache
Show description for 0fb3d72
robobun
committed
0fb3d72
View commit details
Copy full SHA for 0fb3d72
Browse repository at this point
test: do not pipe the stdout of bun pm pack in packDeclarer
robobun
committed
5a08b0a
View commit details
Copy full SHA for 5a08b0a
Browse repository at this point
install: shorten the doc comment on reject_escaping_link_of_remote_package
robobun
committed
bc214ff
View commit details
Copy full SHA for bc214ff
Browse repository at this point
Commits on Oct 1, 2026
install: check escaping link: targets with the file: trust rule, in the resolver and both linkers
Show description for 52509aa
robobun
committed
52509aa
View commit details
Copy full SHA for 52509aa
Browse repository at this point
install: shorten the comments on the install-time link: checks
robobun
committed
6426ffc
View commit details
Copy full SHA for 6426ffc
Browse repository at this point
install: do not resolve the replaced root rows again after an override or catalog edit
Show description for 06574ca
robobun
committed
06574ca
View commit details
Copy full SHA for 06574ca
Browse repository at this point
install: shorten the comment on replaced_root_rows
robobun
committed
90d3931
View commit details
Copy full SHA for 90d3931
Browse repository at this point
install: check bun.lock link: rows in the isolated linker before the first task starts
Show description for 5b4c969
robobun
committed
5b4c969
View commit details
Copy full SHA for 5b4c969
Browse repository at this point
install: shorten the comment on the isolated link: check
robobun
committed
3938a02
View commit details
Copy full SHA for 3938a02
Browse repository at this point
install: refuse bun.lock link: rows in the isolated linker before node_modules is touched
Show description for 4535b32
robobun
committed
4535b32
View commit details
Copy full SHA for 4535b32
Browse repository at this point
install: shorten the doc comment on refuse_escaping_links
robobun
committed
fbeccf7
View commit details
Copy full SHA for fbeccf7
Browse repository at this point
You can’t perform that action at this time.