We published three security advisories for Bun 1.4.3 and earlier: compromised eMudhra certificates, the brotli decoder bug (HTTP2Shell), and the HTTP/3 "Header Accordions" attack.
These are all fixed in Bun 1.4.4. Please upgrade, and rebuild anything made with `bun build --compile`
$ bun upgrade
github.com/oven-sh/bun/se…
These are all fixed in Bun 1.4.4. Please upgrade, and rebuild anything made with `bun build --compile`
$ bun upgrade
github.com/oven-sh/bun/se…
17
46
569
34,634
Bun retweeted
Merging Bun AOT next week, then testing on Claude Code
Expecting 2-3x less memory + CPU & a slightly smaller binary
This is the future of server-side JavaScript
Instead of you rewriting in Rust, we rewrote JavaScript's compiler to emit native code ahead of time
Expecting 2-3x less memory + CPU & a slightly smaller binary
This is the future of server-side JavaScript
Instead of you rewriting in Rust, we rewrote JavaScript's compiler to emit native code ahead of time
4th attempt at Bun AOT. Code quality & design is better. Perf is nearly there. Most importantly though
It’s just TypeScript. Disregard everything I said last week about `as` casts changing runtime behavior and function arguments throwing. None of that is necessary.
115
57
1,580
93,249
Bun retweeted
Bun's now leading the TypeScript checker race!
As always, in @framer's monorepo:
🏆 bun check: 2.42s, 2.0 GB | v1.4.4
🥈 tsrs: 2.50s, 2.6 GB | v0.18
🥉 tsc-ts: 5.9s, 5.3 GB | v0.6
TS 7.1 beta: 13.9s, 8.1 GB
As always, in @framer's monorepo:
🏆 bun check: 2.42s, 2.0 GB | v1.4.4
🥈 tsrs: 2.50s, 2.6 GB | v0.18
🥉 tsc-ts: 5.9s, 5.3 GB | v0.6
TS 7.1 beta: 13.9s, 8.1 GB
Bun v1.4.4
- Fixes 271 issues, addressing 544 👍
- `bun fmt` is a fast Prettier-compatible code formatter
- `bun check` gets 1.4x - 7.8x faster
- New in Bun.SQL & WebSocket
- Security fixes, including for Brotli, TLS certs, HTTP/3, and more
bun.com/blog/bun-v1.4.4
6
12
289
21,943
We needed to get this release out tonight , so we couldn't include `bun lint` yet.
bun lint is available via `bun upgrade --canary` though
bun lint is available via `bun upgrade --canary` though
2
0
71
6,502
Bun v1.4.4
- Fixes 271 issues, addressing 544 👍
- `bun fmt` is a fast Prettier-compatible code formatter
- `bun check` gets 1.4x - 7.8x faster
- New in Bun.SQL & WebSocket
- Security fixes, including for Brotli, TLS certs, HTTP/3, and more
bun.com/blog/bun-v1.4.4
- Fixes 271 issues, addressing 544 👍
- `bun fmt` is a fast Prettier-compatible code formatter
- `bun check` gets 1.4x - 7.8x faster
- New in Bun.SQL & WebSocket
- Security fixes, including for Brotli, TLS certs, HTTP/3, and more
bun.com/blog/bun-v1.4.4
48
75
1,288
89,540
Bun v1.4.4 will be released this evening with a fix for this and for the Brotli issue.
Both fetch() and Bun.serve() did not and continue to not enable HTTP/3 by default.
Both fetch() and Bun.serve() did not and continue to not enable HTTP/3 by default.
Sorry everyone... We're announcing a 0-Day vuln in QUIC that allows anyone to remotely turn off a server running these libraries. I swear we didn't plan this.
foxio.io/blog/header-ac…
16
47
1,266
74,192
@prathamghaywat it’s patched in canary now but not yet in a release
0
0
3
94
@uwukko Co-Authored-By: Bun v1.5.0 (JavaScript runtime, bundler, package manager, test runner, type checker, code formatter, and linter) <bun@localhost>
6
0
211
5,696
In the next version of Bun
`bun lint --staged` is a builtin alternative to lint-staged
`bun lint --staged` is a builtin alternative to lint-staged
![Graphic for bun fmt and bun lint --staged. Format and lint only what you're committing. One line in a git hook, nothing to install. Step 1, create this file: .git/hooks/pre-commit, a plain text file made executable with chmod +x, containing "#!/bin/sh" and "bun fmt --staged && bun lint --staged". Step 2, commit: a terminal runs git commit -m "add cart". bun fmt prints "src/cart.ts" and "Formatted 1 file, 0 unchanged [8.10ms]", with a sticker reading "re-staged". bun lint then prints a code frame pointing at a debugger statement in src/cart.ts line 2, "error: Unexpected 'debugger' statement. no-debugger", "1 problem (1 error, 0 warnings)" and "Linted 1 file [7.94ms]". A stamp reads "commit blocked".](/pic/orig/media%2FHUrPzjragAAAruk.jpg)
23
14
480
16,106
bun lint builds on top of:
- TypeScript’s parser and type checker, ported to Rust
- Lint rules ported from oxlint: unicorn, jest, vitest, jsx-a11y, next and promise
- Lint rules ported from ESLint, typescript-eslint, eslint-plugin-react, -import and -react-hooks
Big thanks to those projects!
- TypeScript’s parser and type checker, ported to Rust
- Lint rules ported from oxlint: unicorn, jest, vitest, jsx-a11y, next and promise
- Lint rules ported from ESLint, typescript-eslint, eslint-plugin-react, -import and -react-hooks
Big thanks to those projects!
0
0
31
3,256
Large production apps often need many custom lint rules, and that’s why bun lint supports eslint plugins.
Under the hood, this is powered by the same parser and AST used by `bun check`, which is designed for TypeScript compatibility with additional performance optimizations.
Under the hood, this is powered by the same parser and AST used by `bun check`, which is designed for TypeScript compatibility with additional performance optimizations.
1
0
78
7,146
