How to update a Bolt.new project: GitHub sync and a zip download

Updated 2026-11-03

Bolt keeps the project in its editor and, once you connect GitHub, can create a private repository and sync that branch in both directions. You update the app in Bolt, or by committing to the branch Bolt is on. A zip download is a copy of the files, not a live sync, and a simultaneous edit can leave Bolt’s copy on top of GitHub’s.

You do not need GitHub to change a Bolt project. Edits in the chat stay in Bolt until you connect a repository or download the files. Connect GitHub when you want a copy you own, a pull request, or a deploy that is not Bolt’s. The behavior below is from Bolt’s GitHub guide and the project files guide. The GitHub icon is the sync. Bolt’s GitHub MCP connector searches code and issues. It does not sync commits. A Lovable project’s sync is a different set of rules, in how to update a Lovable project.

Choose GitHub sync or a one-time zip

GitHub sync keeps working after you connect it. Bolt commits changes that do not break the project, and it fetches commits made outside Bolt. Use it if you will update the app more than once.

Download is a zip. Open the project, click the project title at the top left, then click Download. Unzip it. Bolt’s guide says you need Node.js, then:

npm install && npm run dev

That first command installs and starts the dev script. If the zip contains package-lock.json, pnpm-lock.yaml, or yarn.lock, later installs should use the command that respects that file: npm ci, pnpm install --frozen-lockfile, or the Yarn frozen install. npm install can rewrite the tree. The zip is the files Bolt offered for local editing. It is not your Bolt database. Duplicating a project copies a Bolt database’s tables and columns, not its rows, and deleting a project deletes that database. A Supabase database you connected stays in Supabase. Bolt only removes its connection. Before you commit an unzipped folder to a new repository, look for .env files and keys, and keep them out of git.

Opening a public repository with a bolt.new/~/github.com/owner/repo URL loads that repo in Bolt. It is not the same as linking the Bolt project you have been editing. Open in StackBlitz, under the project title’s Export menu, is also not the GitHub sync. Bolt’s project guide says that from April 2026, a project on the newer storage format no longer shows Open in StackBlitz. Code view in Bolt is still there for editing files.

Connect GitHub and create the repository

You need a GitHub account. Only the project owner can connect and manage the integration. A collaborator does not see the GitHub icon, and their edits sync the next time the owner opens the project.

In the project, click the GitHub icon at the top right, then Log in to GitHub. Authorize StackBlitz, which is Bolt’s parent company. Click Install the GitHub App, choose All repositories or Only select repositories, then Install & Authorize. To create the repository, open that GitHub icon again, enter a name, and click Create repository. Bolt starts it as a private repository on main. You can make it public in GitHub’s settings later. The upkeep report reads public repositories only, so leave it private until you want that scan.

To bring a repository you already have into a new Bolt project, use the Bolt homepage, click GitHub under the chat box, pick the repository or Import from URL, and click Choose this repository. That creates a Bolt project from the repo. It does not attach an old Bolt project that you disconnected. Disconnecting is permanent: the project stops syncing, you cannot reconnect it yourself, and Bolt’s guide says to contact support if you need the same repository again. To refresh a broken login, reauthorize instead. From the homepage GitHub option, choose Configure the GitHub App and Install & Authorize again.

Edit on a branch, and merge on GitHub

You can work on main. For a change you want to review, create a branch in Bolt: GitHub icon, Create new branch, enter a name, Create branch. The branch exists on GitHub as well. Switch branches from the same icon. Bolt does not merge branches in the app. Merge on GitHub, with a pull request, so you can read the diff.

The status panel behind the GitHub icon is the check that matters. Syncing to GitHub means Bolt is still sending changes. Synced to GitHub means Bolt has sent what it has. The panel also shows the repository and the branch. If it says Synced and the commit is missing, reauthorize with the steps above rather than disconnecting.

Pull before you edit outside Bolt

Bolt saves by committing when a change does not break the project, and it checks GitHub about every 30 seconds for commits made elsewhere. The warning in Bolt’s guide is the part that deletes work: if Bolt and GitHub both change at nearly the same time, Bolt keeps its changes and overwrites the GitHub version. One writer at a time is the whole discipline.

git status
git pull
git add -p
git commit -m "Update the contact form copy"
git push

Use the branch name from the panel if it is not main. After you push, confirm the expected branch and check that your changed files appear in Bolt’s Code view before you send another prompt. Synced to GitHub confirms outbound changes were sent; it does not prove Bolt has fetched your new commit. A merge into main shows up in Bolt when Bolt is on main. Switch the branch in the GitHub icon if you merged somewhere else.

Update dependencies from the synced repository

A dependency change is still a commit Bolt will fetch. Do it on a branch, and merge on GitHub after the build passes. Commit the lockfile in the same commit as package.json. Identify the lockfile before you install:

ls package-lock.json pnpm-lock.yaml yarn.lock
npm ci
npm test
npm run build

Swap npm ci for the frozen install that matches the file you found. Do not run npm audit fix --force to “update everything”. It moves packages outside the ranges the app was built with. The smaller path is in npm audit fix is not working. A React major is the React 18 to 19 checklist, on a branch, then merged on GitHub. Once the repository is on GitHub, security alerts are a separate pass from the sync. They do not run inside Bolt’s chat.

Syncing files does not publish the site. Bolt’s publish step, or the host you attached, is what updates the live app. Database rows are not in the repository either. Schema changes for a Supabase project you connected belong in migration files, the same habit as running Supabase migrations safely, not in a download of the Bolt project.

For weekly upkeep, you can manually create a recurring dependency-review task with Denly’s task schedules after connecting a project and runner. Configure its instructions and review gates before enabling it. The public report form below creates a report; it does not create a schedule or a pull request.

Commands and product behavior on this page were checked against the vendor documentation linked here on 3 November 2026. Those products change their screens. If a label has moved, follow the linked page rather than a memory of this one.

Read next

How to update a Lovable project: GitHub sync and a one-time export · npm audit fix is not working: why, and what to do instead