oven-sh/bun

It's a canary releasing directly from main: https://github.com/oven-sh/bun We have run it in production for a month: https://www.prisma.io/blog/bun-rust-rewrite-prisma-compute

Claude Code is entirely vibe-coded for a long time. Bun isn't. You go read and compare the actual Bun code; it reads reasonably well [1]. [1] For example, as a random sample, https://github.com/oven-sh/bun/blob/bun-v1.3.14/src/css/media_query.zig -> https://github.com/oven-sh/bun/blob/4924862cffbf671792d47c92b1b615186b3e7a30/src/css/media_query.rs

We have hundreds of projects that run on Bun. (Some are Bun-specific for whatever reason, but most are "runtime-agnostic TypeScript code that runs on Bun, Node 24.2+, and Deno, but that means they run their test suites on Bun, in addition to the other two.) Out of curiosity, I installed the canary Bun and just ran a bunch of them. It didn't take me long to find one that works on stable Bun and crashes on "canary" Bun. schematic git:(main) bun upgrade --canary [1.55s] Upgraded. Welcome to Bun's latest canary build! Report any bugs: https://github.com/oven-sh/bun/issues Changelog: https://github.com/oven-sh/bun/compare/0d9b296af...19d8ade2c schematic git:(main) bun run main.ts serve Sc…

I love your work on bun. How do you feel about all the constant concerns being raised about the quality of the project lately? I understand some of them might just be typical twitter hate but some of them are real. And I think people are right to question why you are adding image processing or web views inside a javascript runtime when there are bugs affecting production that sit unaddressed. For example on of our biggest blockers right now is https://github.com/oven-sh/bun/issues/6608 which was reported in 2023, still affecting us 3 years later.

Amazing news, congrats! Been using Bun for a long while now and I love it. Is there anything I could do to improve this PR/get a review? I understand you are def very busy right now with the acquisition, but wanted to give my PR the best shot: https://github.com/oven-sh/bun/pull/24514

My team has been using it in prod for about a year now. There were some minor bugs in the runtime's implementation of buffers in 1.22 (?), but that was about the only issue we ran into. The nice things: 1. It's fast. 2. The standard library is great. (This may be less of an advantage over Deno.) 3. There's a ton of momentum behind it. 4. It's closer to Node.js than Deno is, at least last I tried. There were a bunch of little Node <> Deno papercuts. For example, Deno wanted .ts extensions on all imports. 5. I don't have to think about JSR. The warts: 1. The package manager has some issues that make it hard for us to use. I've forgotten why now, but this in particular bit us in the ass…

Well, technically bun doesnt _prevent_ hooks. It just requires opting into them. And even that also includes a default set of pre-whitelisted packages. A much better system, but not perfect. And actually just looking this up, it appears claude-code itself was just added to that whitelist : D https://github.com/oven-sh/bun/commit/5c59842f78880a8b5d9c2eb99c8928fc2ec50a2d#diff-7e3eaf75f193213fd44b6999d829204afa092994d80807c890bb5b578d0ae95d

I debated putting this editorializing in the title, but: At $work we've been refreshing the Bun release page for days, wondering when they would push the fix. The PR with the change merged over 72 hours ago: https://github.com/oven-sh/bun/commit/ea6a2c7b7c98862627760d429aa2d92221e88b0c I'm not a security expert, but package managers seem uniquely vulnerable to MITM attacks. I don't really see the point of spending $MM in tokens to create a software factory if you can't push security releases out in a timely fashion.

… 10 (just a few hours ago) This means in the last half year, following the rewrite the project barely managed to put together 3 patch releases. In semver terms this means no feature work, mind you. Is this what you call productive. https://github.com/oven-sh/bun/releases

I think that the bun rewrite actually supports the oppposite conclusion in a lot of ways: 1. The resulting code was of pretty low quality. Others that bothered to put it through Miri and the like found many soundness issues, but my personal favorite example is this example which is trivially and locally (meaning that someone who has the most basic understanding of unsafe in rust can see it's obviously wrong just by looking at the specific function) incorrect example [0]. This particular example was removed in an apparently unrelated refactor after spending well over a month in the code base without any of the bun maintainers or their agents detecting it, and a quick grep found hundreds of p…

Here's the most recent nontrivial one as of this comment: https://github.com/oven-sh/bun/commit/d4de65e9a43224a14591ad75fd2258649141ab31 The code change makes no sense and should do nothing. The commit message described a very deep investigation into garbage collection on the C++ side. Some object is being kept alive when the test requires it to be collected, and changing the code in this way allegedly prevents that. But wouldn't you think there would be a better way to ensure an object gets collected, like setting the variable to null? The comments in the code don't make a lot of sense either. Something so obscure and brittle has to be explained extremely clearly. While the issue might b…

> could you link me to the release / tag on github? https://github.com/oven-sh/bun/releases/tag/canary (I'm not a fan of how they reuse that single tag rather than putting out version-numbered alphas, but they do at least update the description to include the commit hash - "canary" is basically a pointer to the most recent commit hash that they have judged worthy of distributing to their canary users.)