devtake.dev
AI Security Hardware Open Source Policy Apple
Product

Bun

RSS
4 articles First covered May 2, 2026, latest May 23, 2026
Figure from a forensic document-examination study used here as visual shorthand for verifying authorship of code.
Open Source·

yt-dlp's maintainer says Bun is now 'fully vibe-coded'. Support is officially deprecated.

yt-dlp's maintainer bashonly says Bun's Rust rewrite 'has taken a turn towards being fully vibe-coded.' The supported window narrowed to four versions.

GitHub Open Graph card for oven-sh/bun pull request #30412, the Rust rewrite merge.
Open Source·

Bun's million-line Rust rewrite is now mainline. 99.8% of tests pass and 13,000 unsafe blocks remain.

Jarred Sumner merged the Bun-in-Rust PR on May 14, ending Zig as Bun's runtime language. Binary shrinks 3-8 MB; one analysis counted 13,000 unsafe blocks.

The Register's coverage of Bun's experimental Zig-to-Rust port
Open Source·

Jarred Sumner rewrote 960,000 lines of Bun from Zig to Rust in six days. He might throw it all away.

Bun's creator used Claude to port the JavaScript runtime from Zig to Rust, hitting 99.8% test compatibility. He says there's a 'very high chance' it gets scrapped.

Lightning AI logo on a dark background, illustrating the PyPI supply chain compromise of the lightning Python package.
Security·

Mini Shai-Hulud hit PyTorch Lightning. The 11.6M-download PyPI package shipped a credential stealer.

Two malicious lightning releases hit PyPI on April 30. The 42-minute window was enough to ship an RSA-encrypted infostealer to ML developers worldwide.