dalao.ai

Bun

All-in-one JavaScript runtime and toolkitOpen source

About Bun

Bun packs a JavaScript runtime, package manager, test runner and bundler into one executable, aiming to replace Node.js and the tools around it. It started in Zig and was rewritten in Rust for 1.4, released 2026-08-20; since 2025-12-02 it has belonged to Anthropic, and Claude Code ships as a Bun executable. As of 2026-10-25: 96,397 stars, version 1.4.4, MIT for Bun itself, free to use. The 1.4 post states that Bun is not yet 100% compatible with Node.js.

EditorialUpdated 11 min read

What it is

Bun is an open-source project maintained by the oven-sh organization. Its GitHub description reads "Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one" (as reported by the vendor). The homepage puts it more plainly: runtime, package manager, test runner and bundler in a single binary; an existing Node.js project can use just bun install or bun test, or run entirely on Bun. On December 2, 2025, the Bun blog announced that Bun had been acquired by Anthropic and stated that it remains open source under the MIT license and developed in public on GitHub.

Its JavaScript engine is JavaScriptCore, the engine behind Safari, which the Rust rewrite post lists alongside V8 as a modern JavaScript engine. LICENSE.md states that Bun statically links JavaScriptCore and WebKit, with the patched WebKit published in the oven-sh/webkit repository along with relinking instructions. Bun also statically links a long list of C/C++ libraries, including BoringSSL, brotli, libarchive, lol-html, lsquic, mimalloc, zstd, simdutf, zlib-ng, c-ares and ICU.

The implementation language changed in 2026: 1.3.14 was the last Zig release, and 1.4.0 onward is Rust. The Rust rewrite post says about 20% of Bun's code is C++ and the rest was originally Zig.

Everyday commands are bun run, bun install, bun test and bun build, and the last two releases added bun fmt (a Prettier-compatible formatter) and bun check (a built-in TypeScript type checker). The runtime ships Bun-specific APIs such as Bun.serve, Bun.sql, Bun.file, Bun.spawn, Bun.RedisClient and Bun.cron, plus Bun.WebView, Bun.Image and Bun.markdown, new in 1.4; it also implements Node.js built-ins such as node:fs, node:http and node:child_process so existing npm packages can call them directly.

The homepage and README list a curl script for macOS and Linux, a PowerShell script for Windows, npm install -g bun, plus Homebrew, Scoop and Docker images. According to the npm downloads API, the bun package on npm was downloaded 15,329,046 times from 2026-09-23 to 2026-10-22 (counted in UTC, as of 2026-10-25).

Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one

oven-sh/bun repository description

Core capabilities

Four tools in one. A single executable acts as runtime, package manager, test runner and bundler. For a team, that removes the version matching and config files spread across node, npm or pnpm, Jest or Vitest, and esbuild or webpack. The 1.0 post (2023-09-08) gives this as the reason the project exists: JavaScript tooling piled up layer on layer and became slow and complex, and Bun wants to remove that weight without giving up the ecosystem.

Speed comparisons (vendor-run). The homepage comparison (as of 2026-10-25; Linux x64, EPYC 9R14, median of three runs) shows Bun 1.4 at 48,243 requests per second on an Express 5.2.1 HTTPS hello-world test, against 25,181 for Node.js 26.7.0 and 19,243 for Deno 2.9.5; a warm-cache install of a Next.js project with about 220 packages takes 0.21 seconds with Bun 1.4, 1.92 seconds with pnpm 11.21.0 and 4.45 seconds with npm 12.0.2. These results are as reported by the vendor; the Bun team designed and ran the tests.

Built-in database and service clients. Bun.sql covers PostgreSQL and MySQL, and there are Redis and S3 clients, none of which need an extra npm package. In the same homepage comparison, Bun.sql handles 20,243 queries per second with 100 queries in flight, against 10,000 for Node.js with postgres.js; the 1.4.4 notes say Bun.sql uses up to 48% less CPU. Both figures are vendor-run too.

What 1.4 added. Bun 1.4, released 2026-08-20, adds Bun.WebView (headless browser control), Bun.Image, Bun.markdown, JSON5 and JSONL parsing, and terminal and cron APIs; bun test and bun run can run in parallel; there are new Windows ARM64 builds; and bun install gains an opt-in global virtual store that the post says makes installs up to 7x faster. The post also says the release fixes over 2,900 issues, cuts idle CPU use by 5x, uses up to 35% less memory and starts 50% faster on Linux, all as reported by the vendor.

Node.js compatibility progress. 1.4 adds 1,517 newly passing tests from the official Node.js test suite to CI on every commit and publishes per-module pass counts, such as 105/116 for child_process and 22/110 for inspector. The same post states that Bun is not yet 100% compatible with Node.js.

Single-file executables. bun build --compile bundles an app and the runtime into one executable. The Anthropic acquisition post says Claude Code ships to users as a Bun executable.

Who it's for / Not for

For: TypeScript or JavaScript teams that want one tool instead of npm, Jest, tsx, esbuild and the rest, especially on new projects that can start from bun init without assembling a toolchain.

For: developers who ship command-line tools as single files. The Anthropic acquisition post says Claude Code ships as a Bun executable, OpenCode is built on Bun, and Tailwind's standalone CLI is also built with Bun.

For: Node.js projects that only want to speed up one step first. The homepage states support for using just bun install or bun test in an existing Node.js project while still running on Node.js, so migration can go in stages.

For: teams that reinstall dependencies constantly in CI. The homepage has an install-speed comparison (vendor-run), and 1.4 adds an opt-in global virtual store.

Not for: projects deeply tied to Node.js internals, such as heavy use of the node:inspector debugging API, or code that depends on V8-specific interfaces. Bun runs on JavaScriptCore, and the 1.4 post lists 22/110 passing for the inspector module, 98/101 for vm and 105/116 for child_process.

Not for: enterprise environments that need long-term support. 1.4 (2026-08-20) is a full rewrite from Zig to Rust.

Not for: teams wary of vendor ownership. Since 2025-12-02 the project has belonged to Anthropic; the announcement promises it stays MIT and built in public.

How it compares

Against Node.js. As of 2026-10-25 the nodejs/node repository has 123,071 stars and an MIT license (the LICENSE file also carries terms for bundled libraries); the current version is 26.12.1 (2026-10-21), and the latest on the 24.x long-term support line is 24.22.1 (2026-10-21). Node.js itself is just the runtime; package management, testing and bundling usually go to npm, pnpm, Vitest, esbuild and other tools. Node.js's GitHub release titles give long-term support versions a codename, Krypton for 24.x. Bun puts these tools into one executable.

Against Deno. Deno is another JavaScript runtime, described in its repository as "A modern runtime for JavaScript and TypeScript", written mainly in Rust and MIT-licensed; as of 2026-10-25 denoland/deno has 108,753 stars, and the latest version, 2.9.8, came out 2026-10-21 23:28 (UTC+8). Deno has a commercial host, Deno Deploy, whose pricing (as of 2026-10-25) lists Free at $0/month, Pro at $20/month, Builder at $200/month and custom Enterprise; Bun has no equivalent hosted product. On 2026-10-09, Ryan Dahl announced on the Deno blog that the whole Deno team is joining Cloudflare.

Against single-purpose tools such as pnpm and Vitest. pnpm and Vitest both run on Node.js, so the package manager or test framework can be swapped on its own. In Bun's install comparison, pnpm 11.21.0 takes 1.92 seconds and Bun 0.21 seconds (homepage, vendor-run).

Getting started

Install. On macOS and Linux the install command is curl -fsSL https://bun.com/install | bash; on Windows it is powershell -c "irm bun.com/install.ps1|iex"; with Node.js already present, npm install -g bun also works. The homepage and release posts still show the bun.sh domain. The upgrade command is bun upgrade.

New projects. bun init sets up a project, and bun run index.ts runs TypeScript directly with no separate transpile step; an HTTP service can start from the built-in Bun.serve.

Trying it in an existing Node.js project. Step one is swapping only npm install for bun install, which involves the lockfile migration and install time; since 1.4.4 Bun can migrate from Yarn Berry lockfiles. Step two is switching the test command to bun test, which the 1.0 post describes as Jest-compatible with snapshot testing, mocking and code coverage. The last step is starting the app with bun run.

Shipping a single-file program. bun build --compile ./cli.ts --outfile mycli bundles the code and the runtime into one executable. According to the table in the 1.4 post, Bun 1.4 itself is about 77.0 MB on Linux x64, down from 88.5 MB for 1.3.14.

Pricing & license

Bun itself is free, with no paid tier and no official hosting. GitHub shows the repository license as Other because LICENSE.md is not in the standard MIT license format: it opens with "Bun itself is MIT-licensed" and then lists the statically linked third-party libraries and their licenses.

The license can be traced to specific commits. At 2021-08-22 10:32 (UTC+8), Jarred Sumner's commit 2d67691 (message: Readme) added a License section to the README, first stating "Bun itself is MIT-licensed" and noting that JavaScriptCore and WebKit are LGPL-2 and statically linked by Bun. At 2023-02-24 09:13 (UTC+8), commit f543005 moved that text into docs/project/licensing.md; at 2024-05-16 18:49 (UTC+8), commit d55ac0f moved it to a root LICENSE file; at 2024-06-22 06:14 (UTC+8), commit 19bed6e renamed it to today's LICENSE.md.

The LGPL part. LICENSE.md says JavaScriptCore and WebKit are licensed under LGPL-2 and tinycc under LGPL 2.1; to meet LGPL relinking requirements, Bun publishes its patched WebKit source and relinking instructions.

Risks & limits

Node.js compatibility. The 1.4 post states that Bun is not yet 100% compatible with Node.js and gives per-module pass counts.

The Rust rewrite. 1.4 is a full rewrite from Zig to Rust. The Rust rewrite post says Claude did most of the port; the Zig code was about 535,496 lines excluding comments, and about 4% of the resulting ~780,000 lines of Rust sits inside unsafe blocks. The post also says the merge bar was the existing TypeScript test suite passing in full, and Claude Code has used the Rust build since 2.1.181. 1.4.0 came out on 2026-08-20, and the latest version as of 2026-10-25 is 1.4.4.

Issues and PRs. As of 2026-10-25, GitHub search shows 3,566 open issues and 5,782 open PRs, and 18,976 issues and 26,525 PRs across all states; the GitHub API's open_issues_count (which includes open issues and PRs) is 9,348.

Committers. The GitHub contributors API (anon=0) shows 8,684 default-branch commits for Jarred-Sumner, and the bot account robobun is second with 3,087 (as of 2026-10-25).

Downloads. The acquisition post cites 7.2 million monthly downloads in October 2025, the Rust rewrite post says the CLI gets over 22 million monthly downloads, and the npm downloads API shows 15,329,046 downloads of the bun package from 2026-09-23 to 2026-10-22 (counted in UTC, as of 2026-10-25). The three count different things.

Ownership. Bun has belonged to Anthropic since December 2025, and the team works at Anthropic. The announcement promises MIT licensing, the same team and development in public.

Benchmarks are vendor-run. All performance numbers on the homepage and in release posts are vendor-run, with hardware, versions and scenarios chosen by the Bun team; the homepage install chart reads 0.21 seconds, and the table on the same page reads 210 s.

How it got here

It began as a port. In the Rust rewrite post, Jarred Sumner recalls that Bun started as a line-for-line port of esbuild's JavaScript and TypeScript transpiler from Go to Zig, with the first line of Zig written on 2021-04-16. The GitHub repository was created at 2021-04-14 08:48 (UTC+8); the README commit of 2021-08-22 already states the MIT license and credits esbuild's author, evanw.

Launch and funding. According to the acquisition post, v0.1.0 came out in July 2022 and drew about 20,000 stars in its first week; the Oven company followed, with a $7 million seed round led by Kleiner Perkins, then after 1.0 a $19 million Series A led by Khosla Ventures; the post puts funding at $26 million and the team at 14 at that point.

Release line. 1.0 shipped on 2023-09-08, declared stable and production-ready; 1.1 added Windows support; 1.2 added built-in PostgreSQL and S3 clients, and companies such as X and Midjourney began using Bun in production; 1.3 added a frontend dev server and Redis and MySQL clients. The earliest entry on the GitHub releases list is bun-build-8 at 2021-09-14 17:48 (UTC+8).

Joining Anthropic. On 2025-12-02, Jarred Sumner announced that Anthropic had acquired Bun. The post says Bun had $0 in revenue at the time and more than four years of runway; the reason for joining was that AI coding tools such as Claude Code, FactoryAI and OpenCode are built on Bun, and the GitHub account with the most merged PRs in Bun's repository was already a Claude Code bot. The post promises Bun stays MIT, maintained by the same team and built in public.

From Zig to Rust. The 2026-07-08 post "Rewriting Bun in Rust" explains the motive: many crashes fixed in 1.3.14 came from use-after-free, double-free and forgotten frees on error paths; Zig has no destructors, and style guides were hard to enforce; in Rust most of these become compile errors. The port had Claude translate mechanically along the structure of the existing Zig code, with each piece reviewed adversarially by two more Claude instances, producing 6,502 commits over 11 days at a peak of about 1,300 lines per minute. The post reports a 6.8 MB smaller Linux binary and a 2% to 5% speedup (as reported by the vendor). 1.3.14 was the last Zig release, and 1.4.0, released 2026-08-20 22:07 (UTC+8), became the first Rust release.

Recent months. Two October 2026 releases kept adding tools: 1.4.3 (2026-10-10) added bun check, which the notes say is 3x to 6.4x faster than tsc 7; 1.4.4, released 2026-10-22 18:11 (UTC+8), added the Prettier-compatible bun fmt, fixed 271 issues and thanked 39 contributors.

Our verdict

Bun puts a runtime, package manager, test runner and bundler in one executable; Claude Code and OpenCode use it as their runtime; as of 2026-10-25, the npm downloads API shows 15,329,046 downloads of the bun package from 2026-09-23 to 2026-10-22 (counted in UTC); and since 2025-12-02 it has belonged to Anthropic while staying open source under the MIT license.

Its limits: the 1.4 post states that Bun is not yet 100% compatible with Node.js; the 1.4.0 Rust rewrite shipped on 2026-08-20; and the two accounts with the most default-branch commits are Jarred-Sumner and the bot account robobun (as of 2026-10-25).

Why it stands out

Bun set out to replace Node, npm, webpack, and Jest with one binary, and got most of the way there before most people believed it was possible. Jarred Sumner wrote it in Zig on top of JavaScriptCore, and the install and startup numbers changed how people think about JavaScript tooling.

The interesting story is the compatibility work: reimplementing thousands of Node APIs precisely enough that existing packages just run. That is unglamorous, long, and the reason Bun is trusted in production today.

One binary covers the runtime, package manager, bundler and test runner, and it reimplements Node APIs closely enough that existing packages run.

Sources

Official

  1. oven-sh/bun on GitHubGitHub · Accessed Oct 26, 2026
  2. Bun READMEGitHub · Accessed Oct 26, 2026
  3. Bun LICENSE.mdGitHub · Accessed Oct 26, 2026
  4. Bun LICENSE.md history on mainGitHub · Accessed Oct 26, 2026
  5. Bun commit 2d67691: Readme (adds the MIT license section)GitHub · Accessed Oct 26, 2026
  6. Bun commit f543005: Add documentation (#2148)GitHub · Accessed Oct 26, 2026
  7. Bun commit d55ac0f: Move docs/project/licensing.md to LICENSEGitHub · Accessed Oct 26, 2026
  8. Bun commit 19bed6e: Made the LICENCE a markdown fileGitHub · Accessed Oct 26, 2026

Updates & reading

NewsX

Bun publishes three security advisories, all fixed in Bun 1.4.4

Bun disclosed three security advisories affecting Bun 1.4.3 and earlier: compromised eMudhra certificates, a brotli decoder bug known as HTTP2Shell, and the HTTP/3 "Header Accordions" attack. All three are fixed in Bun 1.4.4. The team asks users to run `bun upgrade` and to rebuild anything made with `bun build --compile`.

1 post on X