The Bun Dependabot Gap: Dependabot Alerts Don't See bun.lock

by Nicolas Charpentier on charpeni.comArticle

GitHub's dependency graph doesn't read bun.lock yet, so in Bun projects Dependabot alerts only cover what's written in package.json, and never a transitive dependency. Here's how to check if you're affected, and how I closed the gap with a GitHub Action.