{"slug": "bun-1-4-ships-rust-rewrite-is-stable-and-it-brings-a-built-in-browser", "title": "Bun 1.4 Ships: Rust Rewrite Is Stable, and It Brings a Built-In Browser", "summary": "Bun 1.4 shipped August 20 with a Rust rewrite that was originally written by AI agents in six days, and it introduces a built-in headless browser API (Bun.WebView), along with native modules for cron scheduling, image processing, and markdown parsing. The release claims startup is 50% faster on Linux and 2.5x faster on Windows, with memory usage down 46% for Express and 48% for Fastify, but the code contains 13,044 unsafe blocks and over 999 uses of static mut, raising concerns about safety and the circular validation of AI-written tests.", "body_md": "Bun 1.4 shipped August 20 with the Rust rewrite now running underneath — the same rewrite written by AI agents in six days, reviewed by bots, and flagged by the community for 13,000 unsafe blocks. The controversy hasn’t fully settled, but the stable release is here, and its new built-in APIs just made a compelling case: headless browser automation, cron scheduling, image processing, and markdown parsing now ship with the runtime, zero npm packages required.\n\n## Bun.WebView: Browser Automation Without Puppeteer\n\nThe headline feature is `Bun.WebView`\n\n, a headless browser API built directly into Bun. On macOS it uses the system WebKit framework — nothing to download or install. On other platforms it connects to a local Chromium instance via the [Chrome DevTools Protocol](https://chromedevtools.github.io/devtools-protocol/).\n\n```\nawait using view = new Bun.WebView();\nawait view.navigate(\"https://example.com\");\nconst title = await view.evaluate(\"document.title\");\nawait Bun.write(\"screenshot.png\", await view.screenshot());\n```\n\nIt auto-waits for element actionability — the element must be attached, visible, stable, and unobscured before a click or fill fires, which is the same contract Playwright uses. Events are dispatched as OS-level input, so `isTrusted`\n\nis `true`\n\n. Sites cannot tell the difference between `view.click()`\n\nand a real mouse click.\n\nFor developers writing scrapers, E2E test scripts, or screenshot pipelines, this removes a meaningful amount of dependency overhead. [Puppeteer](https://pptr.dev/) alone can add 300MB to a project. On macOS you get equivalent capability with zero added dependencies.\n\n## Performance Gains — Where They’re Actually Real\n\nStartup is 50% faster on Linux and 2.5x faster on Windows. Memory consumption dropped across the board: Express servers use 46% less memory, Fastify servers 48% less. One production team at Scrydon, running nine Bun runtime services, saw average CPU fall 49.9% and average working-set memory fall 60.4% after upgrading.\n\nBut the throughput benchmarks deserve scrutiny. Synthetic tests show Bun handling around 52,000 HTTP requests per second against Node’s 13,000. In a real production URL shortener, the gap collapses to Bun at 12,400 versus Node at 12,000 — less than 3% difference. Startup time and memory usage are where the wins are real and consistent. Raw throughput is more workload-dependent than the headline numbers suggest.\n\n## The Unsafe Block Problem Has Not Gone Away\n\nBun’s Rust rewrite contains 13,044 unsafe blocks. A comparable hand-written Rust project of similar size typically has around 73. There are also 999+ uses of `static mut`\n\n— global mutable state — which is the kind of thing Rust’s type system exists to prevent.\n\nThe team’s position is that the code passes the full test suite and benchmarks match or beat the previous Zig implementation. That is true. It is also true that the tests were validated by the same AI tooling that wrote the code, which creates a circular validation problem. If the AI modified tests to pass rather than fixing the underlying implementation — a concern raised in the [Hacker News thread](https://news.ycombinator.com/item?id=49374797) — the test suite is not the safety net it appears to be.\n\nThe pragmatic read: for scripting, tooling, and non-security-critical services, Bun 1.4 is fine to test today. For anything handling sensitive data or running at scale, wait for an independent audit of the unsafe code before putting it in production.\n\n## Six Dependencies You Can Drop Right Now\n\nAlongside Bun.WebView, 1.4 adds native replacements for several popular npm packages:\n\n| Remove This Package | Use This Instead |\n|---|---|\n| sharp | Bun.Image |\n| puppeteer / playwright | Bun.WebView |\n| marked / remark | Bun.markdown |\n| node-cron | Bun.cron |\n| json5 | Native (built-in) |\n| node-pty | Bun.Terminal |\n\nThe practical benefit goes beyond install time. Sharp requires native compilation and fails silently in some Docker environments. Puppeteer ships its own Chromium binary. Native Bun APIs skip all of that — smaller images, faster CI, fewer configuration headaches.\n\n## Node.js 26.3.0 Compatibility and Breaking Changes\n\nBun 1.4 passes 1,517 more [Node.js](https://nodejs.org/en) compatibility tests than 1.3 — the largest single jump in the project’s history. Most Node.js projects will run on Bun 1.4 without changes. Three things to check before upgrading:\n\n- Native addons compiled against Node 24 need to be rebuilt\n- ICU was upgraded to v78, so\n`Intl`\n\nformatting output may differ slightly - x64 builds are now baseline-only; the separate\n`-march=haswell`\n\nbuild is gone\n\nUpgrade with `bun upgrade`\n\n, run your test suite, and check the [full breaking changes list on GitHub](https://github.com/oven-sh/bun/issues/28792) for anything that may affect your stack.\n\n## Bottom Line\n\nBun 1.4 is the most interesting JavaScript runtime release in two years. The new built-in APIs are genuinely useful, the performance improvements in startup and memory are real and measurable, and the Node.js compatibility story has never been stronger. The unsafe block debt is a legitimate concern that has not been independently audited — not a reason to avoid it, but a reason to be deliberate about where you deploy it. Try it in development today. Give production another quarter.\n\nRead the full release notes on the [official Bun blog](https://bun.com/blog/bun-v1.4) and review the [Bun.WebView documentation](https://bun.com/docs/runtime/webview) to start exploring browser automation without Puppeteer.", "url": "https://wpnews.pro/news/bun-1-4-ships-rust-rewrite-is-stable-and-it-brings-a-built-in-browser", "canonical_source": "https://byteiota.com/bun-1-4-rust-rewrite-stable/", "published_at": "2026-09-04 00:22:53+00:00", "updated_at": "2026-09-04 00:53:10.092553+00:00", "lang": "en", "topics": ["developer-tools", "ai-agents", "ai-safety"], "entities": ["Bun", "Bun.WebView", "WebKit", "Chrome DevTools Protocol", "Puppeteer", "Playwright", "sharp", "Scrydon"], "alternates": {"html": "https://wpnews.pro/news/bun-1-4-ships-rust-rewrite-is-stable-and-it-brings-a-built-in-browser", "markdown": "https://wpnews.pro/news/bun-1-4-ships-rust-rewrite-is-stable-and-it-brings-a-built-in-browser.md", "text": "https://wpnews.pro/news/bun-1-4-ships-rust-rewrite-is-stable-and-it-brings-a-built-in-browser.txt", "jsonld": "https://wpnews.pro/news/bun-1-4-ships-rust-rewrite-is-stable-and-it-brings-a-built-in-browser.jsonld"}}