What
Some plugins rely on other code packages, called dependencies. Claude Code now installs them from the plugin's package.json and its lockfile, a file that pins the exact version of every package.
- The lockfile can be
package-lock.jsonor a textbun.lock. A binarybun.lockbis not accepted. - The lockfile is checked strictly: packages must come from the registry, versions must be exact, integrity hashes must be present, and overrides and
patchedDependenciesare not allowed. - Installation runs
npm ci --ignore-scriptsor bun in a temporary folder, then moves the result into the plugin's folder. - When several lockfiles are present,
bun.lockbis now checked afternpm-shrinkwrap.jsonandpackage-lock.json, and the npm options come from one shared setting. - Failures appear as "Plugin dependency install failed", and skipped installs say "Skipped installing this plugin's dependencies:".
Why
Plugins that ship dependencies can have them installed without running any package scripts, and only from a lockfile that passes the checks. If a plugin has both bun and npm lockfiles, npm may now be picked.
Names in the bundlebun.lockb
Documented inclaude-code/plugins/loading
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up bun.lockb, on Plugin loading reference.
* **`bun.lockb`**: Bun's binary lockfile can't be checked. Ship a text `bun.lock` or an npm lockfile insteadplugins/loading see the edit
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
The arguments npm now receives are not shown, so it is not clear whether they are still `ci --ignore-scripts`.
Anthropic's documentation agrees
Anthropic's documentation has since written up bun.lockb, on Plugin loading reference.