Bun 1.4 Ships: Rust Rewrite Is Stable, and It Brings a Built-In Browser

Bun 1.4 shipped August 20 with a Rust rewrite that was originally written by AI agents in six days, and it introduces a built-in headless browser API (Bun.WebView), along with native modules for cron scheduling, image processing, and markdown parsing. The release claims startup is 50% faster on Linux and 2.5x faster on Windows, with memory usage down 46% for Express and 48% for Fastify, but the code contains 13,044 unsafe blocks and over 999 uses of static mut, raising concerns about safety and the circular validation of AI-written tests.

Bun 1.4 shipped August 20 with the Rust rewrite now running underneath — the same rewrite written by AI agents in six days, reviewed by bots, and flagged by the community for 13,000 unsafe blocks. The controversy hasn’t fully settled, but the stable release is here, and its new built-in APIs just made a compelling case: headless browser automation, cron scheduling, image processing, and markdown parsing now ship with the runtime, zero npm packages required. Bun.WebView: Browser Automation Without Puppeteer The headline feature is Bun.WebView , a headless browser API built directly into Bun. On macOS it uses the system WebKit framework — nothing to download or install. On other platforms it connects to a local Chromium instance via the Chrome DevTools Protocol https://chromedevtools.github.io/devtools-protocol/ . await using view = new Bun.WebView ; await view.navigate "https://example.com" ; const title = await view.evaluate "document.title" ; await Bun.write "screenshot.png", await view.screenshot ; It auto-waits for element actionability — the element must be attached, visible, stable, and unobscured before a click or fill fires, which is the same contract Playwright uses. Events are dispatched as OS-level input, so isTrusted is true . Sites cannot tell the difference between view.click and a real mouse click. For developers writing scrapers, E2E test scripts, or screenshot pipelines, this removes a meaningful amount of dependency overhead. Puppeteer https://pptr.dev/ alone can add 300MB to a project. On macOS you get equivalent capability with zero added dependencies. Performance Gains — Where They’re Actually Real Startup is 50% faster on Linux and 2.5x faster on Windows. Memory consumption dropped across the board: Express servers use 46% less memory, Fastify servers 48% less. One production team at Scrydon, running nine Bun runtime services, saw average CPU fall 49.9% and average working-set memory fall 60.4% after upgrading. But the throughput benchmarks deserve scrutiny. Synthetic tests show Bun handling around 52,000 HTTP requests per second against Node’s 13,000. In a real production URL shortener, the gap collapses to Bun at 12,400 versus Node at 12,000 — less than 3% difference. Startup time and memory usage are where the wins are real and consistent. Raw throughput is more workload-dependent than the headline numbers suggest. The Unsafe Block Problem Has Not Gone Away Bun’s Rust rewrite contains 13,044 unsafe blocks. A comparable hand-written Rust project of similar size typically has around 73. There are also 999+ uses of static mut — global mutable state — which is the kind of thing Rust’s type system exists to prevent. The team’s position is that the code passes the full test suite and benchmarks match or beat the previous Zig implementation. That is true. It is also true that the tests were validated by the same AI tooling that wrote the code, which creates a circular validation problem. If the AI modified tests to pass rather than fixing the underlying implementation — a concern raised in the Hacker News thread https://news.ycombinator.com/item?id=49374797 — the test suite is not the safety net it appears to be. The pragmatic read: for scripting, tooling, and non-security-critical services, Bun 1.4 is fine to test today. For anything handling sensitive data or running at scale, wait for an independent audit of the unsafe code before putting it in production. Six Dependencies You Can Drop Right Now Alongside Bun.WebView, 1.4 adds native replacements for several popular npm packages: | Remove This Package | Use This Instead | |---|---| | sharp | Bun.Image | | puppeteer / playwright | Bun.WebView | | marked / remark | Bun.markdown | | node-cron | Bun.cron | | json5 | Native built-in | | node-pty | Bun.Terminal | The practical benefit goes beyond install time. Sharp requires native compilation and fails silently in some Docker environments. Puppeteer ships its own Chromium binary. Native Bun APIs skip all of that — smaller images, faster CI, fewer configuration headaches. Node.js 26.3.0 Compatibility and Breaking Changes Bun 1.4 passes 1,517 more Node.js https://nodejs.org/en compatibility tests than 1.3 — the largest single jump in the project’s history. Most Node.js projects will run on Bun 1.4 without changes. Three things to check before upgrading: - Native addons compiled against Node 24 need to be rebuilt - ICU was upgraded to v78, so Intl formatting output may differ slightly - x64 builds are now baseline-only; the separate -march=haswell build is gone Upgrade with bun upgrade , run your test suite, and check the full breaking changes list on GitHub https://github.com/oven-sh/bun/issues/28792 for anything that may affect your stack. Bottom Line Bun 1.4 is the most interesting JavaScript runtime release in two years. The new built-in APIs are genuinely useful, the performance improvements in startup and memory are real and measurable, and the Node.js compatibility story has never been stronger. The unsafe block debt is a legitimate concern that has not been independently audited — not a reason to avoid it, but a reason to be deliberate about where you deploy it. Try it in development today. Give production another quarter. Read the full release notes on the official Bun blog https://bun.com/blog/bun-v1.4 and review the Bun.WebView documentation https://bun.com/docs/runtime/webview to start exploring browser automation without Puppeteer.