{"version":"2.1.286","anchor":"dependency-install-detection-bunlockb-ordered-last-npm-us","canonical_anchor":"plugin-dependency-install-from-lockfiles-npm-ci-bun-with","heading":"Plugin dependencies installed from checked lockfiles with scripts turned off","tier":"notice","area":"Plugins","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.286\/e\/dependency-install-detection-bunlockb-ordered-last-npm-us","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.286","markdown":"### Plugin dependencies installed from checked lockfiles with scripts turned off\n\nClaude Code installs plugin dependencies from a checked package-lock.json or bun.lock using `npm ci --ignore-scripts` or bun, preferring npm lockfiles\n\n**Unclear.** The arguments npm now receives are not shown, so it is not clear whether they are still `ci --ignore-scripts`.\n\n**What**\n\nSome plugins rely on other code packages, called dependencies. Claude Code now installs them from the plugin's `package.json` and its lockfile, a file that pins the exact version of every package.\n\n- The lockfile can be `package-lock.json` or a text `bun.lock`. A binary `bun.lockb` is not accepted.\n\n- The lockfile is checked strictly: packages must come from the registry, versions must be exact, integrity hashes must be present, and overrides and `patchedDependencies` are not allowed.\n\n- Installation runs `npm ci --ignore-scripts` or bun in a temporary folder, then moves the result into the plugin's folder.\n\n- When several lockfiles are present, `bun.lockb` is now checked after `npm-shrinkwrap.json` and `package-lock.json`, and the npm options come from one shared setting.\n\n- Failures appear as \"Plugin dependency install failed\", and skipped installs say \"Skipped installing this plugin's dependencies:\".\n\n**Why**\n\nPlugins that ship dependencies can have them installed without running any package scripts, and only from a lockfile that passes the checks. If a plugin has both bun and npm lockfiles, npm may now be picked.\n\n- Area: Plugins\n- Names: `bun.lockb`\n- Tier: You'll notice\n- Useful: 4\/5\n- Signal: 2\/5"}