Bun Blog

And yet, there's still room for people who love to code to do great work. Look at bun for instance https://bun.com/. It's a JavaScript runtime that dramatically improves on the performance of node.js to the point where it will likely completely deprecate it in the coming years. It does so many things right out of the box, but it's essentially just an incremental improvement in the development world. I think AI-augmented development will lead to faster and vastly improved software over the years. This isn't just a space that's being disrupted on the maker/creator side of developing software. And from a makers/creators point of view, you wouldn't even need to keep up with the latest trends like performance, AI should just know which libraries are the best to use to develop your solutions.

> Bun has no REPL Bun has a really nice REPL, can recommend https://bun.com/docs/runtime/repl

"Bun is a new JavaScript runtime built from scratch to serve the modern JavaScript ecosystem. It has three major design goals: Speed. Bun starts fast and runs fast. It extends JavaScriptCore, the performance-minded JS engine built for Safari. Fast start times mean fast apps and fast APIs. Elegant APIs. Bun provides a minimal set of highly-optimized APIs for performing common tasks, like starting an HTTP server and writing files. Cohesive DX. Bun is a complete toolkit for building JavaScript apps, including a package manager, test runner, and bundler. Bun is designed as a drop-in replacement for Node.js. It natively implements thousands of Node.js and Web APIs, including fs, path, Buffer and more." - From the homepage[1] - it's a shame they use semantic html but no anchors for direct linking. 1. https://bun.com/

Not aware of any NPM native ways but here are few community tools: - https://socket.dev/blog/introducing-socket-firewall - https://github.com/lirantal/npq - https://bun.com/docs/pm/security-scanner-api source: https://github.com/bodadotsh/npm-security-best-practices?tab=readme-ov…

Hi HN, I built this fun little site that generates a collage of your Steam library where each header image tile is sized by the playtime. It's unfortunately not scaled linearly, I couldn't get it to look nice enough (the larger games would dominate the medium and small ones into obscurity). I would love any suggestions for improving the packing logic. Source code: https://github.com/obviyus/playtime-panorama It was inspired by a Reddit post [1] + Bun 1.3's changelog [2] introducing a "Full-stack JavaScript runtime". It was really fun to build this out without relying on any external dependencies. [1]: https://www.reddit.com/r/Steam/comments/1oe9tiw/steam_profile_visualiz… [2]: https://bun.com/blog/bun-v1.3

I disagree, since there's Bun also to exemplify real, popular, tools are being created. https://bun.com

> What are you missing? Everything else needed to make a backend app. At the very least, Node should provide fundamental pieces like database drivers. Currently the best PG driver[1] depends on a single guy. Bun already provides its own PG driver [2] and Jarred has written they will keep investing into more built-in APIs. [1] https://github.com/porsager/postgres [2] https://bun.com/docs/api/sql

Bun has been nothing but amazing wins for me, and I really like what it enabled me to do. Two examples: - I have a couple of projects that handle images. I was including Sharp, but since these are side projects in a small VM, often a redeploy that recompiled Sharp just crashed the full VM (out of memory). Bun includes Bun.Image[1] natively, which is built around Sharp's API, so swapping Sharp out was very easy, and now deploys are a breeze (and swapping it in would be just as easy). - Bun's JSX support is a godsend. I've replaced almost all my side projects that were backend rendered from Pug, Handlebars, and other various templates I used to have to just pure JSX. Heck, this made it trivial to make a side projects where the Favicon was a dynamic SVG [2] [1] https://bun.com/docs/runtime/image [2] https://stocksreader.com/portfolio?%5Egspc=10&amzn=10&msft=12&…

> I don't believe the LLM port makes the full transition any easier than doing things the old fashioned way: a dual lang code base like Linux ... how so? let's say Linus opens a branch, rust-temp, and in 2 weeks pushes ~15 million lines of code deleting most of the old C code. and then it gets merged in a few weeks. and then there's still a few months of the "merge window" and RC process. and each day folks report bugs, and automatic fuzzers make sure that both versions "behave the same". I was pretty skeptical (still am), but what the Bun team did is pretty great so far. https://bun.com/blog/bun-in-rust details the process, we see the results (Node.js compat [0], more than 3 thousand of issues fixed since since 1.3 [1], more than 900 issues fixed in ~24 hours [2], and it's live/in-prod [3]) > 50 dynamic workflows in Claude Code run continuously over the course of 11 days. so let's say 500 workflows could do something similar for the kernel. the reported cost is 165K USD, so let's say this would cost 1.65M USD, plus CI costs [4] (which is ~200K/year for bun, so let's say it's 2M USD for the kernel) How much the world is spending on kernel bug bounties and various security programs each year? The bar is not perfect. The bar is something better. [0] https://xcancel.com/bunjavascript/status/2087436767054213517#m [1] https://xcancel.com/bunjavascript/status/2082298681223680002#m [2] https://xcancel.com/bunjavascript/status/2080882189663907859#m [3]…

I believe they use https://bun.com/ Not Node.js

Apparently Claude Code being built on Bun was considered a good enough reason? But it looks more strategic for Bun since they’re VC-backed and get a good exit: > Claude Code ships as a Bun executable to millions of users. If Bun breaks, Claude Code breaks. Anthropic has direct incentive to keep Bun excellent. … > Bun's single-file executables turned out to be perfect for distributing CLI tools. You can compile any JavaScript project into a self-contained binary—runs anywhere, even if the user doesn't have Bun or Node installed. Works with native addons. Fast startup. Easy to distribute. > Claude Code, FactoryAI, OpenCode, and others are all built with Bun. … > Over the last several months, the GitHub username with the most merged PRs in Bun's repo is now a Claude Code bot. We have it set up in our internal Discord and we mostly use it to help fix bugs. It opens PRs with tests that fail in the earlier system-installed version of Bun before the fix and pass in the fixed debug build of Bun. It responds to review comments. It does the whole thing. > This feels approximately a few months ahead of where things are going. Certainly not years. … > We've been prioritizing issues from the Claude Code team for several months now. I have so many ideas all the time and it's really fun. Many of these ideas also help other AI coding products. … > Instead of putting our users & community through "Bun, the VC-backed startups tries to figure out monetization" – thanks to Anthropic,…

Hi! I'm a maintainer of Elysia, the framework you claim to have outperformed. First of all, I admire you for taking the hard way of learning to build your own stuff, especially at your age. However, I have a concern to believe that the benchmark result is a false positive, and inaccurate. From my experience working and maintaining the Bun HTTP framework for 3 years since the first release of Bun 0.1.0. Bun.serve is extremely fast that autocannon (the benchmark tool you're using) cannot keep up with the performance, causing the report to be skewed from hitting the limit of the benchmark tool instead of an actual framework. This is mentioned in Bun documentation. https://bun.com/docs/project/benchmarking#benchmarking-tools - For load testing, you must use an HTTP benchmarking tool that is at least as fast as Bun.serve(), or your results will be skewed. Some popular Node.js-based benchmarking tools like autocannon are not fast enough. It would be nice if you could update the benchmark with the tools that can report is faster than autocannon for the most accurate result. Other than that, I'd say great job!

Hah! Do you have a running search giving you alerts when lmdb is mentioned or something? > How is doxygen a disaster? I've just never read any good, user friendly documentation ever produced by doxygen. Even when I used it myself. It always comes out looking like a pig's breakfast. Like, take the lmdb docs. And I'm sorry for picking on it. But its a good example, because you've clearly put effort into using doxygen to document lmdb. I think the lmdb docs are about the best that doxygen generated documentation gets. Looking at this page: http://www.lmdb.tech/doc/group__mdb.html There's a bunch of concepts here: - Environment (mdb_env) - Database and database (dbi) - Transaction - Cursor - Record - Key But none of those concepts are defined or explained. They're simply referenced without explanation in a big jumble of function names and descriptions, leaving me to figure out how they're supposed to work together. Maybe if those data types were defined up the top of the page? No. Doxygen tries to put some data structures at the top of the page - but for some reason the only documented types are MDB_val, MDB_stat and MDB_envinfo. All terrible places to start reading if you want to understand how to use lmdb. Good documentation would lead with some front matter like: - What does the library do - How does the library sees the world. Here, explain the above concepts and how they relate. (Eg an environment represents a set of files on disk. Each environment contains a…

What are the standards for determining that? The most obvious benefit Rust can give them is being safe from memory leaks. That has been a Zig design choice that memory leaks are the developer/user's responsibility. They have already demonstrated to have fixed several of those [0]. Marketing-wise, it has been an obvious success. Dunno if that matters. [0] https://bun.com/blog/bun-in-rust

Also, access to models the public doesn't have, he had full Fable 5 in May. Jarred spins it as "pre-release" [1] but it was pre-embargo. [1]: https://bun.com/blog/bun-in-rust#loops-that-write-review-code:~:text=I…

Bun 1.4 released: https://bun.com/blog/bun-v1.4 and https://github.com/oven-sh/bun/releases/tag/bun-v1.4.0

From the release video, something catching my attention: > In Bun 1.4, I rewrote Bun in Rust. [...] I did it in 11 days, using Claude Code, and wrote about how, in our blog. Everything else in the video is phrased as "we", and even the section in the blog post is "We rewrote Bun in Rust"[1]. There's no question Jarred did the work and deserves enormous credit for it. I just found the contrast interesting, because the video explicitly frames the rewrite as "I", whereas the rest of the release frames it as "we". [1] https://bun.com/blog/bun-v1.4#we-rewrote-bun-in-rust

Jarred wrote a lengthy blog about the rewrite a little while ago and IIRC the token burn numbers were in there (or at least the burn up to that point in time). https://bun.com/blog/bun-in-rust

Agree. If you really want to know what's used here: probably uses bun single-file executables[0] so shouldn't clash with anything else on your system. [0] https://bun.com/docs/bundler/executables

> Most likely next Tuesday we’ll do the release of 1.4. Next Tuesday, otherwise known as last Tuesday. Still no 1.4 at https://bun.com/blog. I'm very curious to see what happens when 1.4 does get released for real. Releasing Claude Code on it is much easier as they own Claude Code and can get Claude to work on Bun with fixing some specific behaviour in Claude Code as an objective. Releasing it for the world, and doing it well enough that it doesn't result in everyone pinning on the old version and forks springing up, involves reproducing all the behaviours of the old version, documented/tested and otherwise, that projects are relying on - which, by Hyrum's law, is all of them.

The eleven day figure features in multiple animated infographics in Jarred's blog post; https://bun.com/blog/bun-in-rust, including a calendar that shows commits over 11 days. > I rewrote Bun in Rust using about 50 dynamic workflows in Claude Code run continuously over the course of 11 days.

The rust version is being used by Claude Code though - which is a fairly large product! I was hoping for more push back against https://bun.com/blog/bun-in-rust - which is pretty thorough and has some decent arguments and reasoning for why they did the rewrite.

If you look at the reasons for rewriting Bun [0], they weren’t about efficiency and they don’t apply to Claude Code. It’s already written in a memory-safe language, and doesn’t have to interface to a library with a tricky set of invariants. [0] https://bun.com/blog/bun-in-rust

The Bun author himself writes that the port is not idiomatic Rust: Do the rewrite that looks like we transpiled our Zig code to Rust. We can gradually refactor it to reduce unsafe usage and look more like idiomatic Rust after Bun v1.4 ships. (from: https://bun.com/blog/bun-in-rust) The original version of Bun was already a line-by-line (manual) port of esbuild from Go to Zig (also mentioned in this post), so the Zig code already wasn't "Zig-idiomatic" and apparently riddled with problems. That doesn't inspire much confidende in the Rust LLM-translated Rust version tbh.

https://bun.com/blog/bun-in-rust This is from July 8, 2026. And while you did link it in your article, what else are you expecting?

another use case is getting standalone self-contained binaries which are easier to ship. other projects like claude code use something like `bun build --compile`[^1] for that, which instead of producing a small native binary just bundle the JS runtime into the executable. [^1]: https://bun.com/docs/bundler/executables

You should give the article[0] a read. "A large percentage of bugs from that list are use-after-free, double-free, and "forgot to free" in an error path. In safe Rust, these are compiler errors and RAII-like automatic cleanup with Drop. Compiler errors are a better feedback loop than a style guide." "At the time of writing, about 4% of Bun's Rust code sits inside an unsafe block (~13,000 unsafe keywords across ~27,000 lines / ~780,000 lines), and 78% of those blocks are a single line — a pointer that came from C++, or one call into a C library. I expect this number to go down over time as we refactor from a faithful Zig port (which had no greppable unsafe keyword) to idiomatic Rust, but we are going to continue using C & C++ libraries like JavaScriptCore so it will always have more unsafe than pure Rust projects." [0] https://bun.com/blog/bun-in-rust

Slander? Are you serious? > We wouldn't have gotten this far if not for Zig, and I'll always be grateful. Until very recently, programming language choice was a one-way decision for a project like Bun. https://bun.com/blog/bun-in-rust

It seems they’ve already done analysis over what unsafe usage they can get rid of after the port. https://bun.com/bun-unsafe-audit

This is dupe of an ongoing discussion in [0]. The actual source post of this article can be read here: [1] [0] https://news.ycombinator.com/item?id=48837877 [1] https://bun.com/blog/bun-in-rust