oven-sh/bun
Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one
How bun is put together
oven-sh/bun is the monorepo for Bun, an all-in-one JavaScript/TypeScript toolkit shipped as a single executable. The core is a large Rust Cargo workspace (~100 crates under src/) covering the parser/AST, bundler, CSS engine, module resolver, package manager (install/patch/semver), HTTP/event-loop, DNS (c-ares), TLS (BoringSSL), SQLite/Postgres/Valkey/S3 clients, and crash handling, all linked together with a JavaScriptCore (WebKit) engine layer to form the `bun` binary. A set of TypeScript/JavaScript packages (bun-types, bun-error, bun-inspector-protocol, bun-debug-adapter-protocol, bun-lambda, loader plugins) provides type definitions, the browser error overlay, debugger protocol clients, and ecosystem integrations. Data flow is CLI invocation -> Rust crate graph -> JSC-bound runtime APIs, with distribution via npm, Docker images (dockerhub/), and AWS-hosted canary/release builds orchestrated by Buildkite.
Languages
Frameworks
Infrastructure
Major components
Rust workspace core crates (src/*)
~100 internal crates implementing AST/parser (bun_ast, js_parser), bundler, CSS, sourcemaps, resolver, paths, collections, allocators (mimalloc-based bun_alloc), and sys abstractions that compose into one binary.
Package manager (src/install, install_jsc, patch, semver)
Implements bun install/add/remove/update/publish/audit including lockfiles, workspaces, catalogs, lifecycle scripts, Windows shims, and registry auth.
Runtime & JSC integration (src/runtime, src/bun.js.rs, src/jsc, src/runtime.bun.js)
Embeds JavaScriptCore, exposes Bun/Web/Node-compatible globals and APIs (Bun.serve, file I/O, workers, FFI, sqlite, redis, S3) to executed JavaScript.
Networking stack (src/http, uws, cares_sys/dns, boringssl, lsquic_sys, s3_signing)
HTTP server/client, WebSockets, TLS via BoringSSL, async DNS via c-ares, QUIC (lsquic), and SigV4 signing for S3.
CLI & shell (src/cli, clap crates, shell_parser, dotenv)
Argument parsing, subcommand dispatch (run/test/install/build/x), $ shell interpreter parsing, and .env loading.
packages/bun-types
Ships the published TypeScript type definitions (@types/bun) for all Bun APIs including devserver/HMR (devserver.d.ts), ffi, s3, redis, and security surfaces.
packages/bun-error
Preact-based browser error overlay that renders exceptions, source lines fetched from the dev server, and 'open in editor' links.
Debugger/inspector packages (bun-inspector-protocol, bun-debug-adapter-protocol, bun-inspector-frontend)
Client-side implementations of the Chrome DevTools Inspector protocol and Debug Adapter Protocol used by the bundled debugger.
Build & release tooling (scripts/, packages/bun-release, packages/bun-build-mdx-rs)
Zig/Rust/CMake orchestration scripts (build.ts, rust.ts), canary/release publishing, and the napi-based mdxjs native addon.
Compiled executables got a cold-start speedup and smaller embedded bytecode, alongside a wave of crash and correctness fixes across networking, testing, and memory safety.
3 weeksWeek of 2026-08-24
Week of 2026-08-24latest
Compiled executables got a cold-start speedup and smaller embedded bytecode, alongside a wave of crash and correctness fixes across networking, testing, and memory safety.
Week of 2026-08-17
This was the biggest week by far, dominated by large-scale removal of unsafe code, a rebuilt compile payload layout, and native-speed Buffer operations.
Week of 2026-08-10
The week centered on a much faster URL parser (via a WebKit upgrade), cleaner test diffs, and a broad sweep of small API-compatibility and code-quality fixes.
The last few weeks of Bun development show a heavy focus on making self-contained compiled executables faster and smaller (bytecode prefetching, smarter page layout), while a large cleanup campaign removed unsafe code and dead bindings across the codebase. Reliability was another theme: dozens of crash fixes in fetch, TLS, WebSockets, and the Node.js compatibility layer, plus new linting to catch missed error checks before they become bugs. Compatibility work continued too, with Node's Buffer, http, assert, and worker_threads modules behaving more like the real thing.
Week by week
2026-08-24Compiled executables got a cold-start speedup and smaller embedded bytecode, alongside a wave of crash and correctness fixes across networking, testing, and memory safety.latest6 changes
Refactor
Faster cold start for compiled executables
Standalone bun build --compile apps now prefetch their startup bytecode so they begin running sooner from a cold start.
Refactor
Smaller embedded bytecode
Embedded bytecode is now aliased rather than copied and laid out in page-friendly chunks, shrinking executable size (#40201).
Fix
Fixed a startup crash on very new Linux
A free(NULL) call during allocator startup no longer faults on glibc 2.44 systems (#40409).
Fix
More reliable streaming downloads
fetch and S3 responses now apply one consistent backpressure rule, and Bun.write can stream a response body straight to disk.
Chore
New lint catches missed JavaScript error checks
A new jsc-exception-lint tool found and fixed places where engine errors could silently go unchecked (#40410).
Fix
Ctrl+C behaves better in bun run
Interrupt signals are now handed to the script itself, with its exit code reported, matching expectations on both Windows and Unix (#39729).
2026-08-17This was the biggest week by far, dominated by large-scale removal of unsafe code, a rebuilt compile payload layout, and native-speed Buffer operations.6 changes
Refactor
Big unsafe-code removal campaign
Bun.cron, the static file server routes, the WebSocket client, and many C++ bindings were rewritten to eliminate all unsafe code paths.
Refactor
Buffer reads and writes run natively
Buffer read/write methods became built-in functions the JavaScript engine can optimize at machine level instead of interpreted code.
Refactor
Leaner compiled executables
The --compile output now embeds text imports as pre-encoded strings and lays out its payload by region, dropping unneeded source pages.
Fix
Node-style HTTP and net behavior
Listen() results arrive on the next tick rather than a 1 ms timer, empty Transfer-Encoding headers are ignored, and paused sockets keep the process alive correctly.
Fix
WebSocket server matches the npm package
handleUpgrade() can now be called after an await and fails the same way the popular ws package does, plus ServerWebSocket gained binaryType "blob" support.
Chore
Test suite hygiene
64 stale entries were dropped from an exceptions allowlist, and slow server tests were sped up with tighter assertions.
2026-08-10The week centered on a much faster URL parser (via a WebKit upgrade), cleaner test diffs, and a broad sweep of small API-compatibility and code-quality fixes.6 changes
Refactor
Faster URL parsing
An upgraded WebKit brings SIMD table lookups and fast host:port handling to URL parsing, with less redundant Unicode work (#39368, #39273).
Feature
TypeScript 7 in project templates
Every bun init template now uses TypeScript 7 out of the box (#39341).
Refactor
Better test failure diffs
The test runner replaced diff-match-patch with a bounded Myers diff that produces clearer comparisons without runaway cost.
Fix
Fixed an extreme-input crash
Native error messages longer than 1 GiB of non-ASCII text no longer abort the process (#38982).
Fix
Node-compatible Buffer writes
Writing into a detached Buffer now returns 0 like Node does instead of crashing (#39080).
Fix
Safer streamed HTTP responses
Content-Length is no longer written into close-delimited streamed responses, avoiding malformed replies (#38701).
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 11 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required