bun-pm-diff

Compare dependency versions between two bun.lock revisions and run bun pm diff for every dependency whose version changed.

This is useful when reviewing a Git commit, branch, pull request, or local working tree and you want to see the package-level source diff for dependency upgrades recorded in Bun's text lockfile.

Requirements

• Bun installed and available as bun
• Git
• A project using bun.lock

Install

Install globally with Bun:

bun add -g bun-pm-diff

Or run it without a permanent global install:

bunx bun-pm-diff <ref>

Usage

bun-pm-diff <hash>                 [-- <bun pm diff flags>]
bun-pm-diff <hash1> <hash2>        [-- <bun pm diff flags>]
bun-pm-diff <hash1>...<hash2>      [-- <bun pm diff flags>]
bun-pm-diff <hash1>..<hash2>       [-- <bun pm diff flags>]
bun-pm-diff . <hash>               [-- <bun pm diff flags>]
bun-pm-diff <hash> .               [-- <bun pm diff flags>]

A single Git ref is compared against the current working-copy bun.lock.

Compare a commit with the working copy

bun-pm-diff HEAD

Compare two commits

bun-pm-diff HEAD~1 HEAD

You can also use Git-style range syntax:

bun-pm-diff HEAD~1...HEAD

or:

bun-pm-diff HEAD~1..HEAD

For this CLI, both range forms mean "compare the lockfile at the first ref with the lockfile at the second ref". It does not apply Git's merge-base semantics to ....

Explicitly compare the working copy

Working copy against a commit:

bun-pm-diff . HEAD

Commit against working copy:

bun-pm-diff HEAD .

The direction matters because it determines the from → to version shown and the direction passed to bun pm diff.

Passing flags to bun pm diff

Place flags after -- and they will be forwarded to each bun pm diff invocation.

bun-pm-diff HEAD~1 HEAD -- --color=always

Conceptually, when react changed from 19.1.0 to 19.2.0, the command runs:

bun pm diff [email protected] 19.2.0 --color=always

Example output

=== react: 19.1.0 → 19.2.0 ===
...output from bun pm diff...

=== typescript: 5.8.3 → 5.9.2 ===
...output from bun pm diff...

Only dependencies that exist in both lockfiles and whose resolved versions changed are diffed. Added and removed dependencies are currently skipped.

How it works

1. Reads the working-copy bun.lock, or obtains a historical copy with git show <ref>:bun.lock.
2. Parses the lockfiles and builds a map of package names to resolved versions.
3. Finds packages whose resolved version changed.
4. Runs bun pm diff <package>@<old-version> <new-version> for each change.

Development

Clone or unpack the project and run the CLI directly with Bun:

bun src/cli.ts HEAD~1 HEAD

To inspect what npm would publish:

npm pack --dry-run

To create the npm package tarball:

npm pack

To publish after updating the version and package metadata as needed:

npm publish

You must be logged in to npm and have permission to publish the bun-pm-diff package name.

License

MIT