{"slug": "yt-dlp-announcement-bun-support-is-now-limited-and-deprecated", "title": "Yt-dlp – [Announcement] Bun support is now limited and deprecated", "summary": "The yt-dlp project has announced that support for Bun as a JavaScript runtime is being limited and deprecated due to compatibility and security concerns. Effective with the next release, only Bun versions 1.2.11 through 1.3.14 will be supported, with the lower bound raised to address security risks from ignored lockfiles and the upper bound set because Bun was recently rewritten in Rust using AI, moving away from its original Zig codebase. While yt-dlp will continue to support this narrower range of Bun versions for now, the project reserves the right to completely drop Bun support if maintenance becomes too burdensome.", "body_md": "-\n-\nNotifications\nYou must be signed in to change notification settings - Fork 13.8k\n[Announcement] Bun support is now limited and deprecated #16766\nDescription\nDue to foreseeable compatibility and security issues, yt-dlp's support for Bun as an ejs\n-compatible JavaScript runtime is being both limited and deprecated.\nAs of the next yt-dlp and/or ejs release, only Bun versions 1.2.11\nthrough 1.3.14\nwill be supported. The rationale for this change is twofold:\n-\nThe minimum required version is being raised from\n1.0.31\nto1.2.11\nbecause building theejs\npackage with a version earlier than1.2.0\nresults in the ejs lockfile being ignored, which is a significant security concern for users when considering all of the recent npm supply chain attacks. Additionally, the support floor is being bumped to1.2.11\ninstead of1.2.0\nbecause theejs\ntest suite cannot be run with versions of Bun earlier than1.2.11\n. -\nBun was recently rewritten in Rust using Claude, and its development seems to have taken a turn towards being fully vibe-coded. This is alarming and disappointing for a number of reasons, and frankly it seems like a future headache that we'd prefer to avoid. We are adding a support ceiling of version\n1.3.14\n, as that is the last release built from the original zig codebase.\nBun support will also be deprecated. This means that while yt-dlp will continue to support this narrower range of Bun versions for as long as they're able to meet the needs of yt-dlp and ejs, we reserve the right to completely drop support for Bun should it at any point become too burdensome to maintain.\nSee the EJS wiki article for more information about supported JavaScript runtimes, but note that it has not yet been updated to reflect the changes announced in this post.", "url": "https://wpnews.pro/news/yt-dlp-announcement-bun-support-is-now-limited-and-deprecated", "canonical_source": "https://github.com/yt-dlp/yt-dlp/issues/16766", "published_at": "2026-05-22 17:24:12+00:00", "updated_at": "2026-05-22 18:36:00.771563+00:00", "lang": "en", "topics": ["developer-tools", "open-source", "cybersecurity"], "entities": ["yt-dlp", "Bun", "ejs", "Claude", "Zig"], "alternates": {"html": "https://wpnews.pro/news/yt-dlp-announcement-bun-support-is-now-limited-and-deprecated", "markdown": "https://wpnews.pro/news/yt-dlp-announcement-bun-support-is-now-limited-and-deprecated.md", "text": "https://wpnews.pro/news/yt-dlp-announcement-bun-support-is-now-limited-and-deprecated.txt", "jsonld": "https://wpnews.pro/news/yt-dlp-announcement-bun-support-is-now-limited-and-deprecated.jsonld"}}