This Week in Bun
This Week
in Bun
Three hundred and eighty pull requests merged into Bun in the last seven days. Here is what actually changed for you, in about two minutes.
bun pm diff
See what changed before you update
bun pm diff
reads the code a new version ships — and folds formatting churn away.
The headline is a brand new command, bun pm diff. Ask it about any dependency and it shows you what the next version actually changes, the code itself, right in your terminal. And it diffs meaning, not bytes. A reformat, a renamed local, a rewrapped call, all folded away, so what you read is the real change.
It reads the diff for you
It flags the release you should not take
It also reads the diff for you. This patch release quietly ships a new install script that grabs your environment and phones home. The summary calls it out. An added install script, a new child process import, a new eval. That is the review that catches a hijacked package before it reaches your machine.
The package manager grew up
Parity with pnpm for monorepo workflows, in one merge.
bun dedupe
collapse duplicate versions onto the smallest set that still satisfies everyone
bun prune
remove everything in node_modules the lockfile doesn't put there
bun audit fix
move each vulnerable package to the lowest safe version its dependents accept
bun update
now refreshes transitive dependencies too — the lockfile stops going stale
The other big one is a single pull request that brings Bun's package manager to parity with pnpm for monorepos. Dedupe collapses duplicate versions in your lockfile. Prune deletes whatever the lockfile does not own. Audit fix moves vulnerable packages to safe versions automatically. And a plain bun update finally refreshes transitive dependencies too, so your lockfile stops quietly going stale.
Faster this week
Faster where it hurts
Speed work shipped too. On Windows, Bun now loads about half as many system libraries before your first line runs. Together with a companion patch, starting an empty script measured at twenty seven milliseconds drops to twenty one. And on every platform, a WebKit upgrade makes URL parsing faster, which sits under every fetch you make.
Compatibility
More of the ecosystem just works
jest
a module-system fix unblocked running Jest on Bun's own runtime
bun init
every template now starts on TypeScript 7 — the new Go-native compiler
bun build --compile
single-file executables now run on Android
Compatibility kept moving. A module system fix unblocked running Jest on Bun's own runtime. A fresh project from bun init now starts on TypeScript seven, the new compiler written in Go. And single file executables built with Bun now run on Android.
Read the week yourself
Every claim is a
merged pull request
Everything you just heard is a merged pull request you can read yourself, at github dot com slash oven dash sh slash bun. That was the week. See you next one.
