最新のセキュリティ情報
10月22日(木)昨日
Bun v1.4.4
To install Bun v1.4.4 curl -fsSL https://bun.com/install | bash # or you can use npm # npm install -g bun Windows: powershell -c " irm bun.com/install.ps1|iex " To upgrade to Bun v1.4.4: bun upgrade Read Bun v1.4.4's release notes on Bun's blog Thanks to 39 contributors! @0xh3x @1cedsoda @alex-mextner @alii @Artoria2e5 @bompus @C0casio45 @cirospaciari @davidhevn @deepshekhardas @Dex4Sure @dylan-conway @EffortlessSteven @eriklangille @filipesarturi @fredluz @gerardp @gohryt @himself65 @hughescr @Jarred-Sumner @jdjkelly @jecquas @jobansd @kernoeb @KilianB @MarshallOfSound @Neekoras @nikeee @nik…
Bun v1.4.4
Fixes 271 issues, addressing 544 👍. bun fmt, a Prettier-compatible formatter built into Bun that is 3x to 6x faster than oxfmt, bun check is 1.4x to 7.8x faster on large projects, bun install migrates Yarn Berry lockfiles, retries with exponential backoff and closes 133 issues, up to 3.2x faster hoisted installs from a warm cache on Linux, bun pm fetch, bun publish --recursive, packageExtensions, Bun.SQL uses up to 48% less CPU per query, query.cancel(), COPY streams, column name transforms, user-defined functions and update hooks in bun:sqlite, ws rewritten to behave like npm ws on Node.js,…
10月10日(土)
Bun v1.4.3
To install Bun v1.4.3 curl -fsSL https://bun.sh/install | bash # or you can use npm # npm install -g bun Windows: powershell -c " irm bun.sh/install.ps1|iex " To upgrade to Bun v1.4.3: bun upgrade Read Bun v1.4.3's release notes on Bun's blog Thanks to 8 contributors! @alii @cirospaciari @dylan-conway @eastlondoner @jarred-sumner @robobun @sosukesuzuki @steipete
Bun v1.4.3
Fixes 166 issues, addressing 122 👍. bun check, a TypeScript type checker built into Bun that is 3x to 6.4x faster than tsc 7, --check for bun run, bun build and bun test, 67–89% less idle CPU, Bun.FetchSession, experimental Bun.ModuleGraph, --disallow-code-generation-from-strings, up to 2.7x faster large node:http responses, a JavaScriptCore upgrade with faster JSON.parse, faster rejected-promise handling, CompressionStream compression levels, If-Range support in Bun.serve, bun install skips tarballs it won't install, lower bun build memory with many entry points, [hashN] output names, profi…
9月5日(土)
Bun v1.4.2
To install Bun v1.4.2 curl -fsSL https://bun.sh/install | bash # or you can use npm # npm install -g bun Windows: powershell -c " irm bun.sh/install.ps1|iex " To upgrade to Bun v1.4.2: bun upgrade Read Bun v1.4.2's release notes on Bun's blog Thanks to 3 contributors! @dylan-conway @jarred-sumner @robobun
Bun v1.4.2
This release fixes two regressions impacting Elysia and AsyncLocalStorage, a hang in @discordjs/ws, CMYK JPEG decoding in Bun.Image, a rare JIT crash, and a GC crash on musl.
9月4日(金)
Bun v1.4.1
To install Bun v1.4.1 curl -fsSL https://bun.sh/install | bash # or you can use npm # npm install -g bun Windows: powershell -c " irm bun.sh/install.ps1|iex " To upgrade to Bun v1.4.1: bun upgrade Read Bun v1.4.1's release notes on Bun's blog Thanks to 7 contributors! @alii @dylan-conway @jarred-sumner @jvitormelo @marshallofsound @robobun @sosukesuzuki
Bun v1.4.1
Fixes 202 issues, addressing 236 👍. HTTP/2 in Bun.serve, Bun.write() streams Response bodies to disk, self-contained workspace node_modules, bun install --offline and --prefer-offline, WebSocket pause() and resume(), crypto.argon2, tree-shaking through dynamic import(), smarter CommonJS to ESM conversion for default imports, --compile --bytecode when cross-compiling, smaller and faster-starting compiled executables, up to 9x faster Buffer reads and writes, 2x faster AsyncLocalStorage, faster startup, and many bugfixes and Node.js compatibility improvements.
8月20日(木)
Bun v1.4
To install Bun v1.4 curl -fsSL https://bun.com/install | bash # or you can use npm # npm install -g bun Windows: powershell -c " irm bun.com/install.ps1|iex " To upgrade to Bun v1.4.0: bun upgrade Read the blog post : Thank you Bun is free, open source, and MIT-licensed. We receive a lot of contributions from the community, and we'd like to thank everyone who fixed a bug or contributed since Bun v1.3. @190n @alanstott @alii @alinalihassan @amdad121 @ant-kurt @anthonybaldwin @avarayr @baboon-king @billywhizz @bmwalters @Boshen @braden-w @c-stoeckl @carlsmedstad @chrislloyd @cirospaciari @colel…
Bun 1.4
Bun 1.4 rewrites Bun in Rust, ships built-in headless browser automation (Bun.WebView), Bun.Image, Bun.markdown, JSON5, JSONL, Terminal and cron APIs, Node.js 26.3.0 compatibility with 1,517 newly passing tests, parallel test and run, Windows ARM64, and an opt-in global virtual store for up to 7× faster installs.
7月18日(土)
consolidation-step-7-green
step 7.sweep-wip2: snapshot before cap-raise resume
consolidation-step-5-green
step 5.fix0: route bun_s3_signing::error/Error via s3_signing mount path
consolidation-step-4-green
step 4.fix0: drop package-rename deps; apply 4.2/4.4/4.5/4.6 seds
consolidation-step-3-green
step 3.fix0: drop package-rename deps; apply 2.4/2.5/3.6 seds
consolidation-step-1-green
step 1.fix0: regenerate stale build/debug/codegen rust outputs
7月9日(木)
Rewriting Bun in Rust
Why & how we rewrote Bun from Zig to Rust
5月13日(水)
Bun v1.3.14
Fixes 92 issues (addressing 380 👍). Bun.Image — a built-in image processing API, 7x faster warm installs with the isolated linker's global store, experimental HTTP/2 and HTTP/3 clients for fetch(), HTTP/3 (QUIC) in Bun.serve(), rewritten fs.watch() on Linux and macOS, --no-orphans CLI flag, process.execve(), Bun.Terminal on Windows via ConPTY, FreeBSD and Android builds, shared SSL_CTX cache, smaller binaries, and many bugfixes and Node.js compatibility improvements.
4月20日(月)
Bun v1.3.13
Fixes 82 issues (addressing 381 👍). bun test --parallel, --isolate, --shard, and --changed, bun install streams tarballs to disk using 17x less memory, source maps use 8x less memory, 5.5x faster gzip with zlib-ng, Range request support in Bun.serve(), SHA3 in node:crypto and WebCrypto, ws+unix:// WebSocket client, and many bugfixes and Node.js compatibility improvements
4月9日(木)
Bun v1.3.12
Fixes 120 issues (addressing 219 👍). Render Markdown in the terminal with bun ./file.md, Bun.WebView headless browser automation, in-process Bun.cron() scheduler, async stack traces for native errors, 2.3x faster URLPattern, 2x faster Bun.Glob.scan, cgroup-aware parallelism on Linux, and many bugfixes and Node.js compatibility improvements.
3月18日(水)
Bun v1.3.11
Fixes 105 issues (addressing 307 👍). 4 MB smaller on Linux. x64 Bun.cron for OS-level cron jobs and expression parsing, Bun.sliceAnsi for ANSI/grapheme-aware string slicing, richer Bun.markdown list metadata; bun test --path-ignore-patterns; native Windows ARM64 .bin shim; dgram UDP fixed on macOS, fs.openSync numeric flags fixed on Windows (unbreaks tar@7), http2 WINDOW_UPDATE fix; bundler --bytecode/barrel/import-attribute fixes; CSS unicode-range/mask/border-radius fixes; Proxy-array crash fixes, CRLF injection fix, bun install hang fixes, and many Node.js compatibility improvements.
2月26日(木)
Bun v1.3.10
Fixes 155 issues (addressing 642 👍). New native REPL, --compile --target=browser for self-contained HTML, TC39 standard ES decorators, Windows ARM64 support, barrel import optimization, and a faster event loop. structuredClone up to 25x faster for arrays, Buffer.slice() 1.8x faster, path.parse() up to 7x faster, fewer closures in bundled output, and upgraded JavaScriptCore with 168x faster deep rope string slicing. Fixes Python asyncio-based MCP servers breaking with Bun.spawn(), plus numerous bugfixes across Node.js compatibility, bun install, the bundler, shell, and Windows.
2月8日(日)
Bun v1.3.9
Fixes 23 issues (addressing 13 👍). Run multiple scripts in --parallel or --sequential. bun:test mock & spyOn get Symbol.dispose support. ESM bytecode compilation. Faster Bun.markdown. Faster RegExp, String.prototype.trim, String.prototype.startsWith.
1月29日(木)
Bun v1.3.8
Fixes 8 issues (addressing 6 👍). Bun.markdown is a builtin CommonMark-compliant Markdown parser written in Zig. Bun's bundler gets bun build --metafile-md to write LLM-friendly module graph metadata. Fixes a regression in 'npm install -g bun' on Windows.
1月27日(火)
Bun v1.3.7
Fixes 91 issues (addressing 243 👍). 50% faster `Buffer.from(array)`, 35% faster async/await, 3x faster `array.flat()`, 90% faster `padStart`/`padEnd` via JSC upgrade. New: `Bun.JSON5`, `Bun.JSONL`, `Bun.wrapAnsi()` (33-88x faster than wrap-ansi npm), `--heap-prof-md`, `--cpu-prof-md`, `node:inspector` Profiler API, `replMode` for `Bun.Transpiler`. Fetch now preserves header casing. HTTP/2 fixes for AWS ALB/gRPC/Fauna.
1月13日(火)
Bun v1.3.6
Fixes 45 issues (addressing 125 👍). Bun.Archive API for creating & extracting tarballs with gzip compression, Bun.JSONC for parsing JSON with comments, metafile & files options in Bun.build for bundle analysis and virtual files, Response.json() 3.5x faster, 15% faster async/await, 30% faster Promise.race, 20x faster Bun.hash.crc32, faster Buffer.indexOf/includes with SIMD, HTTP/HTTPS proxy support for WebSocket, S3 Requester Pays support, --grep flag for bun test, fake timers now work with @testing-library/react, SQLite updated to 3.51.2, and numerous Node.js compatibility improvements.
12月17日(水)
Bun v1.3.5
Fixes 32 issues (addressing 25 👍). Bun.Terminal API, compile-time feature flags, improved Bun.stringWidth accuracy, V8 C++ value type checking APIs, Content-Disposition support for S3 uploads, environment variable expansion in .npmrc quoted values, and numerous bug fixes & node.js compatibility improvements
12月6日(土)
Bun v1.3.4
Fixes 194 issues (addressing 412 👍). URLPattern API, Fake Timers for bun:test, Custom Proxy Headers in fetch(),console.log %j format, http.Agent connection pooling fix, Standalone executable config loading changes, SQLite 3.51.1, and numerous bugfixes for bun:test, Node.js compatibility, Windows, Web APIs, bun install, and more
12月2日(火)
Bun is joining Anthropic
Bun has been acquired by Anthropic. Anthropic is betting on Bun as the infrastructure powering Claude Code, Claude Agent SDK, and future AI coding products & tools.
11月21日(金)
Bun v1.3.3
Fixes 95 issues (addressing 348 👍). CompressionStream and DecompressionStream, Control .env and bunfig.toml loading in standalone executables, `retry` and `repeats` in `bun:test`, --no-env-file, SQLite 3.51.0, Upgraded to Zig 0.15.2, Bugfixes for bundler, bun install, Windows, Node.js compatibility, Web APIs, Bun.serve, networking, Bun.YAML, Bun.Transpiler, Bun.spawn & TypeScript definitions
11月8日(土)
Bun v1.3.2
Fixes 287 issues (addressing 324 👍). Hoisted installs restored as default for backward compatibility. CPU profiling with --cpu-prof, faster installs for packages with post-install scripts, bun:test onTestFinished hook, ServerWebSocket subscriptions getter, Alpine 3.22 in Docker images, improved Git dependency resolution, bun list alias, and numerous bug fixes across install, HTTP/HTTPS, N-API, bun test, bun build, and runtime.
10月29日(水)
Vercel now supports the Bun Runtime
Deploy and run your applications with Bun's fast JavaScript runtime on Vercel Functions, with full access to Bun APIs and improved performance
10月22日(水)
Bun v1.3.1
Fixes 103 issues (addressing 172 👍). 2× faster bun build on macOS for symlink-heavy projects, source maps preserve legal comments, and --format=cjs now inlines import.meta; bun test adds global vi, --pass-with-no-tests, and --only-failures; .npmrc :email auth support, faster installs when no peer deps, selective hoisting for isolated installs (publicHoistPattern/hoistPattern), and fs/promises FileHandle.readLines(); numerous bundler/transpiler fixes (external sourcemaps in Bun.build({ compile:true }), --bytecode with import.meta, Windows react-jsxdev); reliability fixes across install/pm/pac…
10月11日(土)
Bun 1.3
Bun 1.3 introduces zero-config frontend development, unified SQL API, built-in Redis client, security enhancements, package catalogs, async stack traces, VS Code test integration, and Node.js compatibility improvements.
9月28日(日)
Bun v1.2.23
Fixes 119 issues (addressing 412 👍). pnpm-lock.yaml migration for seamless switching from pnpm to bun install, Redis Pub/Sub support, concurrent test execution with configurable parallelism, platform-specific dependency filtering with --cpu and --os flags, system CA certificates support with --use-system-ca, Windows code signing for compiled executables, JSX configuration improvements in Bun.build, sql.array helper for parameterized arrays, randomized test ordering, stricter CI test defaults, process.report.getReport() on Windows, and numerous Node.js compatibility improvements including htt…
9月15日(月)
Bun v1.2.22
Fixes 144 issues (addressing 257 👍). Async stack traces for better debugging, RFC 6455 compliant WebSocket client subprotocol negotiation, MySQL adapter improvements including affectedRows and lastInsertRowid support, JSX side effects preservation during bundling, event loop delay monitoring with perf_hooks, HTTP server idle connection management, --workspaces in bun run, function name removal during minification, and numerous Node.js compatibility fixes including child_process.spawnSync, socket.write with Uint8Array, crypto.verify RSA defaults, N-API improvements, HTMLRewriter error handlin…
9月11日(木)
Behind The Scenes of Bun Install
Learn how Bun is able to cut install times by up to 25×. Bun skips Node.js's overhead with direct system calls, cache-friendly data layouts, OS-level copy-on-write, and full-core parallelism.
8月26日(火)
Bun v1.2.21
Fixes 69 issues (addressing 204 👍). Bun.SQL now supports MySQL and SQLite, alongside PostgreSQL. Native YAML support. 500x faster postMessage(string). Bun.build() compile API, with cross-platform targets. Reduced idle CPU usage. Bun.stripANSI for SIMD-accelerated ANSI escape removal. bunx --package flag support. customizable User-Agent headers. Windows executable metadata embedding. and extensive Node.js compatibility improvements
8月21日(木)
500x faster postMessage(string)
Zero-copy postMessage(string)
8月10日(日)
Bun v1.2.20
Fixes 141 issues (addressing 429 👍). Reduced idle CPU usage. Improved `bun:test` diffing. Automatic `ETag` and `If-None-Match` in static routes for `Bun.serve`. 40x faster `AbortSignal.timeout`. Windows long path support. `WebAssembly.compileStreaming` and `WebAssembly.instantiateStreaming`. Many, many reliability improvements.
7月19日(土)
Bun v1.2.19
Fixes 163 issues (addressing 1,043 👍). Introduces `bun install --linker=isolated` for pnpm-style isolated node_modules, `bun why` for dependency tree understanding, `bun pm pkg` commands for package.json management, enhanced `node:fs.glob()` with array patterns and exclude options, `node:module.SourceMap` class and `findSourceMap()`, smarter `@types/bun` with automatic Node.js compatibility detection, plus numerous Node.js compatibility improvements, runtime bugfixes, bundler enhancements, and bun install optimizations.
7月3日(木)
Bun v1.2.18
Fixes 52 issues (addressing 112 👍). ReadableStream text(), json(), bytes(), blob(), WebSocket client compression with `permessage-deflate`, `bun pm version`, reduced memory usage for large `fetch()` and `S3` uploads, faster `napi_create_buffer`, faster sliced string handling in native addons, `fs.glob` now matches directories by default, `net.createConnection()` now validates `options.host`, `http.ClientRequest#flushHeaders` now correctly sends the request body, `net.connect` `keepAlive` and `keepAliveInitialDelay` options are now correctly handled, `fs.watchFile` emits `stop` on next tick,…
6月22日(日)
Bun v1.2.17
Fixes 50 issues (addressing 80 👍), and adds +24 passing Node.js tests. Ahead-of-time bundling for HTML imports, more reliable Bun Shell, `setTimeout` and `setImmediate` use 8-15% less memory, `columnTypes` & `declaredTypes` in `bun:sqlite`, `bun info` is the new `bun pm view`, Node.js compatibility improvements to `child_process.fork`, `fs.glob` options are now optional, `tls.getCACertificates()` is now implemented, `bun init` generates `CLAUDE.md` when claude code is installed, and more.
6月12日(木)
Bun v1.2.16
Fixes 73 issues (addressing 124 👍), and adds +119 passing Node.js tests. Serve files with `Bun.serve` through `routes`, `install.linkWorkspacePackages` option in `bunfig.toml`, `bun outdated` support for catalogs, `Bun.hash.rapidhash`, `node:net` compatibility, `vm.SyntheticModule` support, `HTTPParser` binding, and memory leak fixes.
5月29日(木)
Bun v1.2.15
Fixes 11 issues (addressing 261 👍). bun audit scans dependencies for security vulnerabilities, bun pm view shows package metadata from npm. bun init adds a Cursor rule to use Bun instead of Node.js/Vite/npm/pnpm, `node:vm SourceTextModule` and `node:perf_hooks createHistogram` are now implemented.
5月21日(水)
Bun v1.2.14
Fixes 39 issues (addressing 179 👍). Adds support for catalogs in bun install, --react flag for bun init, improved HTTP routing with method-specific routes, better TypeScript default module settings, fixes a HTTPS proxy issue impacting Codex, and several Node.js compatibility improvements including worker_threads reliability enhancements and http2 server improvements.
5月9日(金)
Bun v1.2.13
Fixes 17 bugs (addressing 28 👍, adding +28 passing Node.js tests). Improved --hot stability and Node.js compatibility. Better `node:worker_threads` support, environment data, reduced memory usage for child_process IPC and worker_threads. Fixes BOM handling in `.npmrc` files. Fixes hot reloading on older versions of chrome
5月4日(日)
Bun v1.2.12
Stream browser console logs to your terminal, dev server uses less memory. Node.js compatibility improvements for timers, vm, net, http, and bugfixes for TextDecoder, hot reloading reliability bugfixes
4月29日(火)
Bun v1.2.11
Fixes 62 bugs (addressing 77 👍). `process.ref` and `process.unref`, `util.parseArgs` negative options, `BUN_INSPECT_PRELOAD`, Highway SIMD, Node.js compatibility improvements for `node:http`, `node:https`, `node:tls`, and `node:readline`
4月17日(木)
Bun v1.2.10
Fixes 33 bugs (addressing 33 👍). setImmediate gets faster. Reliability improvements for filesystem operations. Fixes test.failing with done callbacks. Fixes default idle timeout in Redis client. Fixes importing from 'bun' module with bytecode compilation. Default Docker image updated to Debian Bookworm.
4月9日(水)
Bun v1.2.9
Fixes 48 bugs (addressing 116 👍). Bun.redis is a builtin Redis client for Bun. `ListObjectsV2` support in `Bun.S3Client`, more `libuv` symbols, `require.extensions` & require.resolve paths, bugfixes in `node:http`, `AsyncLocalStorage`, and `node:crypto`. Shell reliability improvements.