Bun 1.4 ships the Rust rewrite: 15 npm deps now built in
A headless browser, image, and cron now ship built in; idle CPU falls 5x — but TLS is enforced and writeHeader() is gone. Plus Vercel tracing.
Copy markdown
The Rust rewrite finally ships
Bun's first stable release since the Zig-to-Rust port cuts idle CPU 5x, memory up to 35%, and Linux startup from 10.9ms to 5.1ms. Binaries shrink up to 17%, and 2,900+ issues were fixed with 1,517 tests pulled from Node's own suite.
15 npm dependencies are now the runtime
Image processing (Bun.Image), a headless browser (Bun.WebView, driving WebKit or Chromium over CDP), markdown, cron (Bun.cron()), and terminal UIs are built in — no installs. Simon Willison rebuilt a shot-scraper-style JSON scraper on Bun.WebView in a ~192-256MB container.
What silently breaks on upgrade
TLS certificate verification is now enforced by default, res.writeHeader() is gone (use res.writeHead()), .env files no longer load when Bun runs as `node`, and new monorepos default to the isolated linker. Bun now targets Node 26 (NODE_MODULE_VERSION 147).
Vercel now traces production traffic by default
Vercel turned on always-on tracing: it samples traces from live production and preview requests so you can debug what actually happened without reproducing the bug. No per-incident instrumentation to flip on.