Bun 1.4 Absorbs Image Processing, Browser Automation, and Cron Into the Runtime
Every dependency removed from `package.json` is one less supply-chain surface, one less native-addon build failure, and one less version-conflict headache. Bun 1.4 makes the runtime absorb enough of the ecosystem that a new project’s dependency tree can shrink by a dozen packages before writing a single line of application code.
Bun 1.4 continues collapsing the JavaScript toolchain into a single binary. New built-in APIs replace `sharp` for image resizing, `Playwright` for browser automation, `node-cron` for scheduled tasks, and `node-pty` for terminal emulation. Configuration parsers for JSON5, JSONL, JSONC, XML, and TOML are now native, and `Bun.serve()` can serve a static directory with automatic ETag and Range handling — no `express.static` needed. The package manager gains `bun pm diff` for inspecting dependency changes before upgrading, nested overrides for surgical version pinning, and an opt-in isolated linker that can make installs up to 7× faster in CI.
Testing gets parallel workers, per-file isolation, sharding with timing-based balancing, and `--changed` to run only tests affected by Git diffs. The bundler now includes the React Compiler, build-time feature flags via `bun:bundle`, in-memory file inputs, and single-file HTML output. Code splitting link time drops from 4.65 seconds to 320 milliseconds on a 20,000-module diamond graph.
Under the hood, Bun 1.4 is the first release after a full Rust rewrite. Official benchmarks show Claude Code’s CPU p99 falling from 24% to 10%, HTTP service memory dropping 13–48%, and Linux startup time halving to 5.1 ms. Security tightens with certificate pinning hooks that execute before any request bytes leave the socket, default `rejectUnauthorized` enforcement, and tar path-traversal protection. Windows ARM64 and FreeBSD gain native builds, while Android remains experimental.
Bun’s strategy is not to beat every tool on performance but to make the tool disappear — when image processing, cron, and a PTY ship in the binary, the install step and the native-addon build step both vanish.
The backpressure fix is the kind of unglamorous change that determines whether a runtime survives production: Bun 1.3 would silently accumulate memory until OOM, and 1.4 turns that into a proper pause.
Certificate pinning that executes before the first request byte leaves the socket is a stronger primitive than most Node.js TLS setups offer out of the box; it closes the window where a compromised CA could intercept a payload.
Making the isolated linker opt-in rather than default is a pragmatic choice — it avoids breaking every existing `node_modules` layout on upgrade, but it also means the 7× install speedup only reaches teams that read the changelog.
The breadth-first code-splitting rewrite is a reminder that algorithmic complexity still matters in bundlers: a 14× speedup came from changing the traversal order, not from adding cache layers or parallelism.
Bun’s growing list of built-in parsers (JSON5, JSONL, JSONC, XML, TOML) signals that the runtime sees configuration and log processing as core infrastructure, not as userland concerns to be left to npm.
The `--changed` test flag tracing imports backward from Git diffs is a more accurate “affected tests” strategy than file-name matching, but it still has a blind spot for dynamic imports and runtime dependency injection.