feat: add plugin-bun for Bun configuration

[anupamme]

What this changes

Adds minimumReleaseAge = 604800 to bunfig.toml, requiring Bun to refuse package versions published less than 7 days ago during dependency resolution.

Why

This is a supply-chain hardening measure. Because lockfile = false is already set in this repository, dependencies are re-resolved from the registry on every bun install. Without a minimum release age, a newly published (potentially compromised) package version could be installed immediately. The 7-day window gives the community time to detect and respond to malicious or compromised releases before they land here.

Trade-off

Newly released versions of any dependency (including supertape, madrun, etc.) will not be eligible for installation until they are at least 7 days old — even if package.json explicitly requests them. If an urgent dependency update is needed before the age window expires, Bun supports per-package exemptions:

[install]
minimumReleaseAge = 604800
minimumReleaseAgeExcludes = ["supertape"]

This allows the protection to remain globally active while accommodating exceptional cases.

Severity note

This is preventative hardening, not a fix for an exploitable vulnerability in putout. Severity is low/informational — the risk is a future supply-chain attack, not a current exploit.

[coderaiser]

What if some of dependencies would be updated, for example supertape or madrun I need to wait week so it take into effect? or update package version in package.json?

[anupamme]

Yes — that's the core trade-off of minimumReleaseAge.

With minimumReleaseAge = 604800, a newly published version of supertape, madrun, or any other dependency would not be eligible for Bun to select until it is 7 days old. Updating package.json to explicitly request that version does not bypass the age check — the version itself is still too young.

The intent is supply-chain hardening: because lockfile = false is already set here, dependencies are resolved fresh from the registry on every install, making this project more exposed to newly published compromised packages than one using a committed lockfile.

If an urgent update is needed before the window expires, Bun supports minimumReleaseAgeExcludes for per-package bypasses — so you can keep the global protection active and add a temporary exemption when required:

[install]
minimumReleaseAge = 604800
minimumReleaseAgeExcludes = ["supertape"]

I've updated the PR description to make this trade-off explicit and removed the "exploit primitive" / "input handling" language, which overstated what this change does. This is better characterized as dependency supply-chain hardening rather than a fix for an exploitable vulnerability in putout.

[coderaiser]

It looks like an idea for a new rule

[coderaiser]

It can be something similar to @putout/plugin-goreleaser but for toml instead of yaml and name it @putout/plugin-bun, and all repositories who uses bun, can benefit from this. What do you think?

[coderaiser]

All changes to configuration files made by 🐊plugins, because there is 1000s of repos, and edit this file manually every time not very productive. If you want to proceed, plead re-open.

[anupamme]

Yes, I think that's a better direction.

I initially approached this as a repository-level hardening change, but I agree that the underlying check is more useful as a reusable rule.

I'll rework this into a @putout/plugin-bun, following the structure of @putout/plugin-goreleaser, with TOML parsing and a rule for bunfig.toml. I'll include tests/fixtures for the relevant configurations rather than changing Putout's bunfig.toml directly.

For the initial rule, I'll focus on minimumReleaseAge: detect a missing/insufficient release-age setting and provide an autofix, with the threshold configurable rather than hard-coding 7 days as the only valid value.

I'll update this PR in that direction.