What version of Bun is running?

1.3.3+274e01c73

What platform is your computer?

Darwin 24.6.0 arm64 arm

What steps can reproduce the bug?

• Pick a release age value that downgrades a dependency (e.g. 3000000 today)
• Create fresh project with vitest (or any other project with peer dependency)

$ bun init -m
$ bun add -D vitest
bun add v1.3.3 (274e01c7)

installed vitest@4.0.14 with binaries:
 - vitest

• Update bunfig.toml to contain min age rule

[install]
minimumReleaseAge=3000000 # Use value picked earlier

• Run bun update --latest && bun install

$ bun update --latest && bun install
bun update v1.3.3 (274e01c7)

↑ @types/bun 1.3.3 → 1.3.1
↑ vitest 4.0.14 → 4.0.4

14 packages installed [1.90s]

• Check the version of transient dependecy "vite" in bun.lock

$ grep "vite@" bun.lock
    "vite": ["vite@7.2.6", "", { "dependencies": { "esbuild": "^0.25.0", "fdir": "^6.5.0", "picomatch": "^4.0.3", "postcss": "^8.5.6", "rollup": "^4.43.0", "tinyglobby": "^0.2.15" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "jiti": ">=1.21.0", "less": "^4.0.0", "lightningcss": "^1.21.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-tI2l/nFHC5rLh7+5+o7QjKjSR04ivXDF4jcgV0f/bTQ+OJiITy5S6gaynVsEM+7RqzufMnVbIon6Sr5x1SDYaQ=="],

What is the expected behavior?

• The 1st level dependency "vitest" is downgraded to respect minimum release age
• The 2nd level dependency "vite" is downgraded to respect minimum release age

What do you see instead?

• The 1st level dependency "vitest" is downgraded
• The 2nd level dependency "vite" is NOT downgraded, instead bun.lock uses already existing version which is too new

Additional information

With minimumReleaseAge setting in use, bun update --latest seems to be a nice way to update the whole project. It nicely shows which dependencies were downgraded. However I would expect it to update all dependencies according to release age, not just the 1st level.

Workaround: Delete bun.lock and recreate it to get minimumReleaseAge get respected for all transient dependencies.