What version of Bun is running?
1.3.x (reproduces on current main)
What platform is your computer?
macOS arm64 (pure semver logic, hits every platform)
What steps can reproduce the bug?
Any prerelease version validated against a peer range with no prerelease comparator on the same major.minor.patch.
Real-world hit: installing canary/nightly releases of the RN + Expo + React stack together. Verified:
bun add expo@canary react-native@nightly [email protected]
# 21 × warn: incorrect peer dependency ...
# one for each package in the transitive tree whose non-prerelease peer range
# meets a canary/nightly version
Minimal self-contained repro (verified against vanilla oven-sh/bun@main and the fix in #27085):
mkdir -p /tmp/repro-29444/{producer,consumer} && cd /tmp/repro-29444
cat > producer/package.json <<'PKG'
{
"name": "peer-consumer-pkg",
"version": "1.0.0",
"peerDependencies": { "react": ">=18.0.0" }
}
PKG
cat > consumer/package.json <<'PKG'
{
"name": "consumer",
"version": "1.0.0",
"dependencies": {
"peer-consumer-pkg": "file:../producer",
"react": "19.3.0-canary-3e319a94-20260126"
}
}
PKG
cd consumer && bun install
# warn: incorrect peer dependency "[email protected]"
# 19.3.0-canary is clearly > 18.0.0, this is a false positiveWhat is the expected behavior?
19.3.0-canary-3e319a94-20260126 satisfies >=18.0.0. 56.0.0-canary.1 satisfies >=14.0.4. 19.2.0-rc.1 satisfies ^19.0.0. No warning.
Matches yarn v1 (satisfiesWithPrereleases) and node-semver { includePrerelease: true }, which is what every dev on a canary channel expects.
What do you see instead?
incorrect peer dependency warning on every valid prerelease.
List.satisfiesPre in src/semver/SemverQuery.zig gates on pre_matched, which only flips true when a comparator in the range has a prerelease tag on the same major.minor.patch. So 56.0.0-canary fails against >=14.0.4 because the range has no prerelease comparator, even though 56 > 14.
Additional information
Hits every npm package on a -canary/-rc/-next/-nightly channel against a non-prerelease peer range. React Native nightlies, Expo canary packages, any lib shipping prerelease tags that another lib peer-depends on.
Prior art:
Bun auto-installs peer deps, so there's no --include-prerelease escape hatch. Users see the warning and can't silence it.
Fix: #27085 adds List.satisfiesIncludePrerelease / Group.satisfiesIncludePrerelease alongside existing satisfiesPre, and switches resolutionSatisfiesDependency (only called from peer-dep validation) to the new method. Strict semver resolution path stays strict.
What version of Bun is running?
1.3.x (reproduces on current main)
What platform is your computer?
macOS arm64 (pure semver logic, hits every platform)
What steps can reproduce the bug?
Any prerelease version validated against a peer range with no prerelease comparator on the same
major.minor.patch.Real-world hit: installing canary/nightly releases of the RN + Expo + React stack together. Verified:
Minimal self-contained repro (verified against vanilla
oven-sh/bun@mainand the fix in #27085):mkdir -p /tmp/repro-29444/{producer,consumer} && cd /tmp/repro-29444 cat > producer/package.json <<'PKG' { "name": "peer-consumer-pkg", "version": "1.0.0", "peerDependencies": { "react": ">=18.0.0" } } PKG cat > consumer/package.json <<'PKG' { "name": "consumer", "version": "1.0.0", "dependencies": { "peer-consumer-pkg": "file:../producer", "react": "19.3.0-canary-3e319a94-20260126" } } PKG cd consumer && bun install # warn: incorrect peer dependency "[email protected]" # 19.3.0-canary is clearly > 18.0.0, this is a false positiveWhat is the expected behavior?
19.3.0-canary-3e319a94-20260126satisfies>=18.0.0.56.0.0-canary.1satisfies>=14.0.4.19.2.0-rc.1satisfies^19.0.0. No warning.Matches yarn v1 (
satisfiesWithPrereleases) andnode-semver { includePrerelease: true }, which is what every dev on a canary channel expects.What do you see instead?
incorrect peer dependencywarning on every valid prerelease.List.satisfiesPreinsrc/semver/SemverQuery.ziggates onpre_matched, which only flips true when a comparator in the range has a prerelease tag on the samemajor.minor.patch. So56.0.0-canaryfails against>=14.0.4because the range has no prerelease comparator, even though 56 > 14.Additional information
Hits every npm package on a
-canary/-rc/-next/-nightlychannel against a non-prerelease peer range. React Native nightlies, Expo canary packages, any lib shipping prerelease tags that another lib peer-depends on.Prior art:
satisfiesWithPrereleases)node-semverhas{ includePrerelease: true }as a built-in optionBun auto-installs peer deps, so there's no
--include-prereleaseescape hatch. Users see the warning and can't silence it.Fix: #27085 adds
List.satisfiesIncludePrerelease/Group.satisfiesIncludePrereleasealongside existingsatisfiesPre, and switchesresolutionSatisfiesDependency(only called from peer-dep validation) to the new method. Strict semver resolution path stays strict.