bun dedupe

Remove duplicate versions of packages from bun.lock

Over time, bun.lock can accumulate several versions of the same package even though one of them satisfies every range — for example esbuild@0.15.10 and esbuild@0.15.11 when the ranges are ^0.15.7 and ^0.15.8. bun dedupe collapses these onto the smallest set of already-locked versions (preferring newer ones), saves bun.lock, and installs.

terminal
bun dedupe
bun dedupe v1.4.0 (abc12345)

↳ esbuild 0.15.10 → 0.15.11
↳ react 18.2.0 → 18.3.1

2 duplicate versions removed, 3 packages installed (checked 5 packages) [12.00ms]

Each row is a version that was removed and the version its dependents now use.

bun dedupe only chooses between versions already in the lockfile. It never fetches new versions from the registry and never moves a dependency outside its range — use bun update for that. package.json is never modified.

--check and --dry-run#

--check reports what would be removed without changing anything, and exits 1 if there are duplicates. Use it in CI:

terminal
bun dedupe --check
bun dedupe v1.4.0 (abc12345)

↳ esbuild 0.15.10 → 0.15.11
↳ react 18.2.0 → 18.3.1

2 duplicate versions can be removed (checked 5 packages) [9.00ms]
  bun dedupe

--dry-run prints the same output but always exits 0.

--lockfile-only rewrites bun.lock without installing.

Notes#

  • Overrides and catalogs are respected; each dependency is re-pointed using its effective range.
  • A direct dependency may be moved to an older locked version if that's the only way to remove a duplicate (e.g. a transitive dependency pins it exactly). Use bun update or an override if you want the newer one to win.
  • Versions in patchedDependencies are never removed. If that forces another version to be kept too, Bun prints a kept … line explaining why.
  • Dependencies on a dist-tag, git URL, or tarball keep their resolved version.
  • Requires a lockfile that matches package.json. If dependencies changed since the last install, it exits with bun.lock does not match package.json — run bun install first. A package-lock.json, yarn.lock, or pnpm-lock.yaml is migrated automatically.
  • Cannot be combined with --frozen-lockfile, --production, or --no-save; use --check instead.
  • With the isolated linker, several copies of the same version that differ only in peer dependencies are not duplicates and are not reported. Stale store entries are cleaned up by bun prune.