← All reportsPublic report

oven-sh/bun

Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one

96k stars Rust View on GitHubprofiled 11d ago
Try GitZoid
400PRs this week
8Contributors
11Deps scanned
0Issues found
01 · Repo overview

How bun is put together

oven-sh/bun is the monorepo for Bun, an all-in-one JavaScript/TypeScript toolkit shipped as a single executable. The core is a large Rust Cargo workspace (~100 crates under src/) covering the parser/AST, bundler, CSS engine, module resolver, package manager (install/patch/semver), HTTP/event-loop, DNS (c-ares), TLS (BoringSSL), SQLite/Postgres/Valkey/S3 clients, and crash handling, all linked together with a JavaScriptCore (WebKit) engine layer to form the `bun` binary. A set of TypeScript/JavaScript packages (bun-types, bun-error, bun-inspector-protocol, bun-debug-adapter-protocol, bun-lambda, loader plugins) provides type definitions, the browser error overlay, debugger protocol clients, and ecosystem integrations. Data flow is CLI invocation -> Rust crate graph -> JSC-bound runtime APIs, with distribution via npm, Docker images (dockerhub/), and AWS-hosted canary/release builds orchestrated by Buildkite.

Languages

RustJavaScriptTypeScriptC/C++ (JavaScriptCore bindings)Shell

Frameworks

JavaScriptCore (WebKit)preactnapi-rs (Node-API)lol_html

Infrastructure

Buildkite CI (.buildkite/)Docker images (dockerhub/alpine|debian|debian-slim|distroless)AWS EC2 test machines (scripts/machine.mjs)Nix flake (flake.nix)AWS Lambda bootstrap (packages/bun-lambda)

Major components

Rust workspace core crates (src/*)

~100 internal crates implementing AST/parser (bun_ast, js_parser), bundler, CSS, sourcemaps, resolver, paths, collections, allocators (mimalloc-based bun_alloc), and sys abstractions that compose into one binary.

Package manager (src/install, install_jsc, patch, semver)

Implements bun install/add/remove/update/publish/audit including lockfiles, workspaces, catalogs, lifecycle scripts, Windows shims, and registry auth.

Runtime & JSC integration (src/runtime, src/bun.js.rs, src/jsc, src/runtime.bun.js)

Embeds JavaScriptCore, exposes Bun/Web/Node-compatible globals and APIs (Bun.serve, file I/O, workers, FFI, sqlite, redis, S3) to executed JavaScript.

Networking stack (src/http, uws, cares_sys/dns, boringssl, lsquic_sys, s3_signing)

HTTP server/client, WebSockets, TLS via BoringSSL, async DNS via c-ares, QUIC (lsquic), and SigV4 signing for S3.

CLI & shell (src/cli, clap crates, shell_parser, dotenv)

Argument parsing, subcommand dispatch (run/test/install/build/x), $ shell interpreter parsing, and .env loading.

packages/bun-types

Ships the published TypeScript type definitions (@types/bun) for all Bun APIs including devserver/HMR (devserver.d.ts), ffi, s3, redis, and security surfaces.

packages/bun-error

Preact-based browser error overlay that renders exceptions, source lines fetched from the dev server, and 'open in editor' links.

Debugger/inspector packages (bun-inspector-protocol, bun-debug-adapter-protocol, bun-inspector-frontend)

Client-side implementations of the Chrome DevTools Inspector protocol and Debug Adapter Protocol used by the bundled debugger.

Build & release tooling (scripts/, packages/bun-release, packages/bun-build-mdx-rs)

Zig/Rust/CMake orchestration scripts (build.ts, rust.ts), canary/release publishing, and the napi-based mdxjs native addon.

The last few weeks of Bun development show a heavy focus on making self-contained compiled executables faster and smaller (bytecode prefetching, smarter page layout), while a large cleanup campaign removed unsafe code and dead bindings across the codebase. Reliability was another theme: dozens of crash fixes in fetch, TLS, WebSockets, and the Node.js compatibility layer, plus new linting to catch missed error checks before they become bugs. Compatibility work continued too, with Node's Buffer, http, assert, and worker_threads modules behaving more like the real thing.

Week by week

2026-08-24Compiled executables got a cold-start speedup and smaller embedded bytecode, alongside a wave of crash and correctness fixes across networking, testing, and memory safety.latest6 changes

Refactor

Faster cold start for compiled executables

Standalone bun build --compile apps now prefetch their startup bytecode so they begin running sooner from a cold start.

Refactor

Smaller embedded bytecode

Embedded bytecode is now aliased rather than copied and laid out in page-friendly chunks, shrinking executable size (#40201).

Fix

Fixed a startup crash on very new Linux

A free(NULL) call during allocator startup no longer faults on glibc 2.44 systems (#40409).

Fix

More reliable streaming downloads

fetch and S3 responses now apply one consistent backpressure rule, and Bun.write can stream a response body straight to disk.

Chore

New lint catches missed JavaScript error checks

A new jsc-exception-lint tool found and fixed places where engine errors could silently go unchecked (#40410).

Fix

Ctrl+C behaves better in bun run

Interrupt signals are now handed to the script itself, with its exit code reported, matching expectations on both Windows and Unix (#39729).

2026-08-17This was the biggest week by far, dominated by large-scale removal of unsafe code, a rebuilt compile payload layout, and native-speed Buffer operations.6 changes

Refactor

Big unsafe-code removal campaign

Bun.cron, the static file server routes, the WebSocket client, and many C++ bindings were rewritten to eliminate all unsafe code paths.

Refactor

Buffer reads and writes run natively

Buffer read/write methods became built-in functions the JavaScript engine can optimize at machine level instead of interpreted code.

Refactor

Leaner compiled executables

The --compile output now embeds text imports as pre-encoded strings and lays out its payload by region, dropping unneeded source pages.

Fix

Node-style HTTP and net behavior

Listen() results arrive on the next tick rather than a 1 ms timer, empty Transfer-Encoding headers are ignored, and paused sockets keep the process alive correctly.

Fix

WebSocket server matches the npm package

handleUpgrade() can now be called after an await and fails the same way the popular ws package does, plus ServerWebSocket gained binaryType "blob" support.

Chore

Test suite hygiene

64 stale entries were dropped from an exceptions allowlist, and slow server tests were sped up with tighter assertions.

2026-08-10The week centered on a much faster URL parser (via a WebKit upgrade), cleaner test diffs, and a broad sweep of small API-compatibility and code-quality fixes.6 changes

Refactor

Faster URL parsing

An upgraded WebKit brings SIMD table lookups and fast host:port handling to URL parsing, with less redundant Unicode work (#39368, #39273).

Feature

TypeScript 7 in project templates

Every bun init template now uses TypeScript 7 out of the box (#39341).

Refactor

Better test failure diffs

The test runner replaced diff-match-patch with a bounded Myers diff that produces clearer comparisons without runaway cost.

Fix

Fixed an extreme-input crash

Native error messages longer than 1 GiB of non-ASCII text no longer abort the process (#38982).

Fix

Node-compatible Buffer writes

Writing into a detached Buffer now returns 0 like Node does instead of crashing (#39080).

Fix

Safer streamed HTTP responses

Content-Length is no longer written into close-delimited streamed responses, avoiding malformed replies (#38701).

03 · Security check

Dependencies and code review

11 dependencies scanned

Dependency advisories

Security Watch

No known advisories across 11 scanned dependencies.

No known advisories in the scanned dependencies.

Code review

No concrete code-level issues confirmed.

Get this report every week for your repos.

GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.

$19 a month, flat · First 10 outputs free · No card required