node-to-bun — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited node-to-bun (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are assisting with migrating an existing Node.js project to Bun. This involves analyzing dependencies, updating configurations, and ensuring compatibility.
Check if Bun is installed:
bun --versionAnalyze current project:
# Check Node.js version
node --version
# Check package manager
ls -la | grep -E "package-lock.json|yarn.lock|pnpm-lock.yaml"Read package.json to understand the project structure.
Read and analyze all dependencies from package.json:
cat package.jsonCheck for known incompatible native modules:
Common problematic packages (check against current dependencies):
bcrypt → Use bcryptjs or @node-rs/bcrypt insteadsharp → Bun has native support, but may need version checknode-canvas → Limited support, check version compatibilitysqlite3 → Use bun:sqlite insteadnode-gyp dependent packages → May require alternative pure JS versionsfsevents → macOS-specific, usually optional dependencyesbuild → Bun has built-in bundler, may be redundantCheck workspace configuration (for monorepos):
# Check if workspaces are defined
grep -n "workspaces" package.jsonCreate a migration report file BUN_MIGRATION_REPORT.md:
# Bun Migration Analysis Report
## Project Overview
- **Name**: [project name]
- **Current Node Version**: [version]
- **Package Manager**: [npm/yarn/pnpm]
- **Project Type**: [app/library/monorepo]
## Dependency Analysis
### ✅ Compatible Dependencies
[List dependencies that are Bun-compatible]
### ⚠️ Potentially Incompatible Dependencies
[List dependencies that may have issues]
**Recommended Actions:**
- [Specific migration steps for each incompatible dependency]
### 🔄 Recommended Replacements
[List suggested package replacements]
## Configuration Changes Needed
### package.json
- [ ] Update scripts to use `bun` instead of `npm`/`yarn`
- [ ] Review and update `engines` field
- [ ] Check `type` field (ESM vs CommonJS)
### tsconfig.json
- [ ] Update `moduleResolution` to `"bundler"`
- [ ] Add `bun-types` to types array
- [ ] Set `allowImportingTsExtensions` to `true`
### Build Configuration
- [ ] Review webpack/rollup/esbuild config (may use Bun bundler)
- [ ] Update test runner config (use Bun test instead of Jest)
## Migration Steps
1. Install Bun dependencies
2. Update configuration files
3. Run tests to verify compatibility
4. Update CI/CD pipelines
5. Update documentation
## Risk Assessment
**Low Risk:**
[List low-risk changes]
**Medium Risk:**
[List items needing testing]
**High Risk:**
[List critical compatibility concerns]Before making changes:
# Create backup branch if in git repo
git branch -c backup-before-bun-migration
# Or suggest user commits current state
git add -A
git commit -m "Backup before Bun migration"Read current package.json:
// Read and parse package.jsonUpdate scripts to use Bun:
{
"scripts": {
"dev": "bun run --hot src/index.ts",
"start": "bun run src/index.ts",
"build": "bun build src/index.ts --outdir=dist",
"test": "bun test",
"typecheck": "bun run --bun tsc --noEmit",
"lint": "bun run --bun eslint ."
}
}Update engines field:
{
"engines": {
"bun": ">=1.0.0"
}
}For libraries, add exports field if not present:
{
"type": "module",
"exports": {
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"require": "./dist/index.cjs"
}
}
}Read current tsconfig:
cat tsconfig.jsonApply Bun-specific updates:
{
"compilerOptions": {
"target": "ES2022",
"module": "ESNext",
"moduleResolution": "bundler",
"types": ["bun-types"],
"lib": ["ES2022"],
"jsx": "react-jsx",
"strict": true,
"esModuleInterop": true,
"skipLibCheck": true,
"resolveJsonModule": true,
"allowImportingTsExtensions": true,
"noEmit": true
}
}Key changes explained:
moduleResolution: "bundler" → Uses Bun's module resolutiontypes: ["bun-types"] → Adds Bun's TypeScript definitionsallowImportingTsExtensions: true → Allows importing .ts files directlynoEmit: true → Bun runs TypeScript directly, no compilation neededFor monorepos with workspaces:
Verify workspace configuration is compatible:
{
"workspaces": [
"packages/*",
"apps/*"
]
}Bun supports the same workspace syntax as npm/yarn/pnpm.
Check workspace dependencies:
# Verify workspace structure
find . -name "package.json" -not -path "*/node_modules/*"Remove old lockfiles:
rm -f package-lock.json yarn.lock pnpm-lock.yamlInstall with Bun:
bun installThis creates bun.lockb (Bun's binary lockfile).
For workspaces:
bun install --frozen-lockfile # Equivalent to npm ciIf using Jest, migrate to Bun test:
Create bunfig.toml for test configuration:
[test]
preload = ["./tests/setup.ts"]
coverage = true
coverageThreshold = 0.8Update test files:
import { test, expect } from '@jest/globals'import { test, expect } from 'bun:test'Jest compatibility notes:
jest.mock() → Use mock() from bun:testCheck .env files:
ls -la | grep .envBun loads .env files automatically (same as dotenv package).
Update environment loading code:
require('dotenv').config().env by defaultIf using webpack/rollup/esbuild:
Consider replacing with Bun's built-in bundler:
// bun-build.ts
await Bun.build({
entrypoints: ['./src/index.ts'],
outdir: './dist',
minify: true,
splitting: true,
sourcemap: 'external',
target: 'bun',
});Update build script in package.json:
{
"scripts": {
"build": "bun run bun-build.ts"
}
}GitHub Actions example:
name: CI
on: [push, pull_request]
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Setup Bun
uses: oven-sh/setup-bun@v1
with:
bun-version: latest
- name: Install dependencies
run: bun install --frozen-lockfile
- name: Run tests
run: bun test
- name: Type check
run: bun run typecheck
- name: Build
run: bun run buildRun these commands to verify migration:
# 1. Check dependencies installed correctly
bun install
# 2. Run type checking
bun run --bun tsc --noEmit
# 3. Run tests
bun test
# 4. Try development server
bun run dev
# 5. Test production build
bun run buildCreate or update these documentation sections:
README.md:
## Prerequisites
- [Bun](https://bun.sh) 1.0 or higher
## Installation
bun install
## Development
bun run dev
## Testing
bun test
CHANGELOG.md entry:
## [Version] - [Date]
### Changed
- Migrated from Node.js/npm to Bun
- Updated all dependencies to Bun-compatible versions
- Replaced [specific packages] with [alternatives]
- Updated TypeScript configuration for BunSymptoms:
error: Cannot find module "bcrypt"Solution:
# Replace with pure JavaScript alternative
bun remove bcrypt
bun add bcryptjs
# Update imports
# Before: import bcrypt from 'bcrypt';
# After: import bcrypt from 'bcryptjs';Symptoms:
error: require() of ES Module not supportedSolution:
Add to package.json:
{
"type": "module"
}Or use .mts extension for ES modules and .cts for CommonJS.
Symptoms:
error: Cannot resolve "@/components"Solution:
Verify tsconfig.json paths match:
{
"compilerOptions": {
"baseUrl": ".",
"paths": {
"@/*": ["./src/*"]
}
}
}Bun respects TypeScript path aliases automatically.
Symptoms:
error: jest is not definedSolution:
Update test imports:
// Before
import { describe, it, expect } from '@jest/globals';
// After
import { describe, it, expect } from 'bun:test';Present this checklist to the user:
package.json scripts updatedtsconfig.json configured for Bunbun installbun testAfter migration, help user verify performance improvements:
# Compare install times
time bun install # Should be 3-10x faster than npm
# Compare test execution
time bun test # Should be faster than Jest
# Compare startup time
time bun run src/index.ts # Should be 90% faster than ts-nodeIf migration encounters critical issues:
# Return to backup branch
git checkout backup-before-bun-migration
# Or restore original state
git reset --hard HEAD~1
# Reinstall original dependencies
npm install # or yarn/pnpmOnce migration is complete, provide summary:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.