What
Some plugins rely on other code packages, called dependencies. Claude Code now installs them from the plugin's package.json and its lockfile, a file that pins the exact version of every package.
- The lockfile can be
package-lock.jsonor a textbun.lock. A binarybun.lockbis not accepted. - The lockfile is checked strictly: packages must come from the registry, versions must be exact, integrity hashes must be present, and overrides and
patchedDependenciesare not allowed. - Installation runs
npm ci --ignore-scriptsor bun in a temporary folder, then moves the result into the plugin's folder. - When several lockfiles are present,
bun.lockbis now checked afternpm-shrinkwrap.jsonandpackage-lock.json, and the npm options come from one shared setting. - Failures appear as "Plugin dependency install failed", and skipped installs say "Skipped installing this plugin's dependencies:".
Why
Plugins that ship dependencies can have them installed without running any package scripts, and only from a lockfile that passes the checks. If a plugin has both bun and npm lockfiles, npm may now be picked.
Names in the bundlepackage-lock.jsonbun.lock
Documented inclaude-code/analytics
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up package-lock.json, on Plugin loading reference.
| `npm-shrinkwrap.json` or `package-lock.json` | npm |plugins/loading see the edit
Confirmed since
Anthropic's documentation has since written up bun.lock, on Plugin loading reference.
| `bun.lock` | Bun |plugins/loading see the edit
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
It is unclear what starts this install and whether anything gates it.
Anthropic's documentation agrees
Anthropic's documentation has since written up bun.lock, on Plugin loading reference.