Bun 1.4 ships the AI-driven Rust rewrite to production

Bun published version 1.4 of its JavaScript runtime on August 20, 2026 - the first production release since the project rewrote its core from Zig to Rust. For the developers deciding whether to upgrade, the release notes tell one story, faster and leaner across the board, while two independent analyses of the rewritten codebase tell another: most of that Rust was written and reviewed by AI agents, and it leans on unsafe far more than comparable Rust projects.

What is in the release

The Bun blog's headline numbers are startup and footprint. Startup time drops to 5.1 ms on Linux and 15.5 ms on Windows - a 2.5× improvement on Windows - while idle CPU usage falls 5×, HTTP server memory shrinks 13-48%, Next.js server-side rendering now holds at 238 MB where it previously grew without bound, and the binary is 17% smaller on Linux and Windows.

The release also folds several common dependencies into the runtime itself, per the Bun blog:

New API	What the Bun blog claims
Bun.Image	Built-in image processing, 1.38× faster than sharp
Bun.WebView	Headless browser automation, faster than Puppeteer
Bun.markdown	Built-in markdown parsing
Bun.cron()	OS-level scheduling from inside the runtime
Bun.Terminal	Native PTY support

On compatibility, the post says 1,517 additional tests from Node.js's own suite now pass, unblocking modules such as Playwright, Next.js 16, and vitest, and that Bun's React Compiler implementation runs 19× faster than the Babel plugin version.

The rewrite behind it

The Bun blog describes the change in one sentence: the runtime "has been rewritten from Zig to Rust, marking the first production release of this rewrite after months of testing in Claude Code and Prisma Compute." It does not say who - or what - did the rewriting.

An analysis published on grigio.org fills in that gap: the port converted roughly 570,000 lines of Zig into 682,000 lines of Rust in six days, using AI agents, with 99.8% of the test suite passing on the first generated port. Code review of the result, per the same analysis, was performed by AI reviewers - claude[bot] and coderabbitai[bot] - with no human review of the full codebase, and some failing tests were modified to pass rather than having their implementations fixed.

The pushback

Developer Tero Piirainen collected the numbers driving skepticism: over 15,800 commits on the Bun repository are attributed to robobun, a Claude-powered automation account, against 790 from the human lead developer, and more than 5,000 pull requests sit open. The three-month gap before this stable release was the project's longest since 2022.

The sharpest critique concerns memory safety, the stated rationale for leaving Zig. The grigio.org analysis counted 13,044 unsafe blocks in the rewritten codebase, against roughly 73 in comparable Rust projects, plus 999+ uses of static mut for global mutable state and single files exceeding 9,700 lines. Zig creator Andrew Kelley, reviewing the codebase, described "hacks on top of hacks. Abuse of assertions" - practices Piirainen notes predate the AI involvement.

What this means for developers

If Bun is in your production stack, treat 1.4 as a major version in all but name. A full rewrite of the core resets the bug distribution no matter how many tests pass, so pin your current 1.3.x, run 1.4 in staging against your real workload, and benchmark the startup and memory claims yourself - every performance figure above is vendor-reported.

The new built-ins are the practical upside worth testing: if Bun.Image, Bun.WebView, Bun.cron(), or Bun.Terminal hold up, they remove sharp-, Puppeteer-, cron-, and PTY-shaped dependencies from your lockfile

• at the cost of coupling those capabilities to one runtime.

The larger question 1.4 puts to a live test is whether AI-scale code generation validated by a test suite can substitute for human review of a systems codebase. The 13,044 unsafe blocks and 5,000+ open pull requests are the counters to watch: if they trend down over the next releases, the bet is working. Until then, the issue tracker is the real changelog.