{"version":"2.1.275","anchor":"plugin-dependency-install-refuses-to-run-bun-when-a-bunfigt","canonical_anchor":"plugin-dependency-install-refuses-to-run-bun-when-a-bunfigt","heading":"Plugin dependency install refuses to run bun when a bunfig.toml is present","tier":"notice","area":"Plugins","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.275\/e\/plugin-dependency-install-refuses-to-run-bun-when-a-bunfigt","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.275","markdown":"### Plugin dependency install refuses to run bun when a bunfig.toml is present\n\nPlugin dependency installer now refuses to run bun if a bunfig.toml file is found\n\n**What**\n\nWhen Claude Code installs a plugin's dependencies, it used to just run `bun install`. Now, before doing that, it checks whether a `bunfig.toml` configuration file sits next to the lockfile. If it finds one, it skips the install entirely and shows an explicit security message instead of running bun.\n\n**Why**\n\nA `bunfig.toml` file can load and run code during installation through bun's `install.security` scanner feature. Since a plugin's dependency folder could contain a `bunfig.toml` crafted by someone else, running bun automatically could execute unexpected code. Skipping the install in that case avoids running code you didn't ask for.\n\n- Area: Plugins\n- Names: `bunfig.toml`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}