You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
PluginsArea: what it touches
ImprovementsKind: in v2.1.275,
ImprovementsSection of the release
What
When Claude Code installs a plugin's dependencies, it used to just run bun install. Now, before doing that, it checks whether a bunfig.toml configuration file sits next to the lockfile. If it finds one, it skips the install entirely and shows an explicit security message instead of running bun.
Why
A bunfig.toml file can load and run code during installation through bun's install.security scanner feature. Since a plugin's dependency folder could contain a bunfig.toml crafted by someone else, running bun automatically could execute unexpected code. Skipping the install in that case avoids running code you didn't ask for.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed sinceAnthropic's documentation has since written up bunfig.toml, on Plugins reference.* If a `bunfig.toml` sits beside the bun lockfile, remove the `bunfig.toml`, or replace the bun lockfile with an npm lockfile.plugins-referencesee the edit
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agreesAnthropic's documentation has since written up bunfig.toml, on Plugins reference.
