HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
oven-sh
bun
Rust2022–2026
oven-sh / bun

bun

Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one

204Distinct people
267Mentions
2Explicit recommenders
96.7KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one

GitHub

Where it is used

  • Netlify Builds — Netlify Builds exposes the Bun executable during builds so developers can run their build commands with the Bun runtime. This provides out-of-the-box Bun support in the build environment. Source
  • Vercel Functions — Vercel Functions uses Bun as a runtime option to run functions. Teams can choose Bun instead of Node.js for their projects. Source

What people are saying

I love your work on bun. How do you feel about all the constant concerns being raised about the quality of the project lately? I understand some of them might just be typical…

weli used a recommendation phrase. 2 indexed comments match. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year267 dated mentions

Observed mentions: 2022-07-12 10:17:18 UTC to 2026-10-24 19:16:24 UTC.

0501001502022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 25 mentions; 6 submissions, 19 comments20222023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 37 mentions; 0 submissions, 37 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 25 mentions; 1 submissions, 24 comments20242025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 43 mentions; 3 submissions, 40 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 137 mentions; 29 submissions, 108 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC25619
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC37037
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC25124
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC43340
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC13729108

What Hacker News says

267 sources
I debated putting this editorializing in the title, but: At $work we've been refreshing the Bun release page for days, wondering when they would push the fix. The PR with the change merged over 72 hours ago: https://github.com/oven-sh/bun/commit/ea6a2c7b7c98862627760d... I'm not a security expert, but package managers seem uniquely vulnerable to MITM attacks. I don't really see the point of spending $MM in tokens to create a software factory if you can't push security releases out in a timely fashion.
In Bun 1.4.4 removes compromised eMudhra certs
> Development stalled? Here are the stats on commits to Bun in the past six months You know you're putting up bullshit metrics, not much different than counting lines of code touched by commits. If you were forthcoming and showed relevant metrics such as release cadence (i.e., what projects declare to be relevant units of work to be delivered to their userbase) you'd be faced with the realization that since march (bun v1.13.14) Bun only managed to put together 4 meager releases: * Bun v1.14.0 - Aug 20 (first release in 5 whopping months?) * Bun v1.14.1 - Sep 4 * Bun v1.14.2 - Sep 5 (emergency regression fix) * Bun v1.14.3 - Oct 10 (just a few hours ago) This means in the last half year, following the rewrite the project barely managed to put together 3 patch releases. In semver terms this means no feature work, mind you. Is this what you
Read the rest
In Cloudflare acquires Deno
I think that the bun rewrite actually supports the oppposite conclusion in a lot of ways: 1. The resulting code was of pretty low quality. Others that bothered to put it through Miri and the like found many soundness issues, but my personal favorite example is this example which is trivially and locally (meaning that someone who has the most basic understanding of unsafe in rust can see it's obviously wrong just by looking at the specific function) incorrect example [0]. This particular example was removed in an apparently unrelated refactor after spending well over a month in the code base without any of the bun maintainers or their agents detecting it, and a quick grep found hundreds of potential similar issues (although many of those are false positives). 2. More generally, it's not clear to me that there was any technical benefit to
Read the rest
the rewrite in the first place. The stated reason was for memory safety, but replacing Zig with unsafe rust doesn't actually get you memory safety, and removing the unsafe blocks often requires more extensive refactors to fit within rust's model. > If you can reduce a problem to a clearly verifiable end state, provide the necessary context, and equip a model with the necessary tools it can usually get to a good solution. As others have pointed out (and you acknowledge), "reducing a problem to a clearly verifiable end state" is just "programming". What you don't seem to understand is that actually doing that is made harder by using AI, not easier. A sufficiently detailed spec is called "code" [1], the question is what language/notation is best to write it in. The answer is almost never "whatever is closest to what the computer actually executes", as assemblers and later compilers and interpreters demonstrated. But it also isn't several of the things that AI proponents have suggested to replace the latter with. Take natural language, for example. As Dijkstra pointed out, we've been through this already with math. It used to be that all math was expressed in a way closer to what we'd now call "word problems", but this turned out to be bad. The specialized language of e.g. algebra isn't something mathematicians use to gate-keep, it's way easier to reason in the domain that way than it is in English (or other natural languages). The same is true for programming, once you actually specify what you want to do with enough rigor. It's generally easier to read and reason about code than to do so with natural language specifications. Another proposal is to use tests and similar automatic verification to specify the program. I suspect that anyone with much experience can already tell whether it's preferable to specify a program through code or through tests, but thankfully we have empirical evidence on this for anyone who has any doubts in the form of e.g. sqlite. Sqlite is probably one of if not the closest any piece of software comes to being fully specified by it's tests. To do that takes almost 600 times as much test code as there is "regular" code. Dr. Hipp even personally weighed in on the implications this has on AI recently [3] . The reason to do testing is that it provides a second independent check for correctness, if you're using it as the *only* check that advantage disappears. [0] https://github.com/oven-sh/bun/blob/fc865b398e51de8a95ddde4b... [1] https://haskellforall.com/2026/03/a-sufficiently-detailed-sp... [2] https://www.cs.utexas.edu/~EWD/transcriptions/EWD06xx/EWD667... [3] https://youtu.be/V_qzqY1bb7I?t=2727
In The End of Programming
Here's the most recent nontrivial one as of this comment: https://github.com/oven-sh/bun/commit/d4de65e9a43224a14591ad... The code change makes no sense and should do nothing. The commit message described a very deep investigation into garbage collection on the C++ side. Some object is being kept alive when the test requires it to be collected, and changing the code in this way allegedly prevents that. But wouldn't you think there would be a better way to ensure an object gets collected, like setting the variable to null? The comments in the code don't make a lot of sense either. Something so obscure and brittle has to be explained extremely clearly. While the issue might be real, this commit is so far away from the locus of normal that it's sending red alert. Plus a hallucination is very likely with such a long investigation - once an LL
Read the rest
M agent starts investigating it just assumes there is a problem. And this is the 1 out of 1 robobun commit that I looked at. Edit: here's the next one: https://github.com/oven-sh/bun/commit/72ec6e2594892455df0090... Make sure the fs module keeps working if someone freezes or seals its exports table. I was wondering who was going around freezing random tables from other modules, so I checked the linked issue - robobun reported the issue, too. Why? I'm skeptical of whatever robobun was doing when it decided that it was necessary for code outside of a module to freeze their export tables. It needs a very good justification.
In The August 17 outage
> I could have accepted people saying "I'm 20% more productive", which is an incredible achievement by itself, but not the 10x, 20x, 100x I keep hearing about. I think I've read 200x this week. The ratios are factual though. Just look at the "Insights" tab of any LLM written project. https://github.com/oven-sh/bun/pulse This kind of velocity is impossible to achieve manually.
In The August 17 outage

Showing the 15 most recent of 267 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.