The Bun CVE Gap: When Your Package Manager Can't Do Surgical Updates

Yarn Berry, pnpm, and npm all support surgical CVE remediation. Bun, today, doesn't. Here's what I found when I tried to apply my own workflow to a Bun project.