HTTP/2 support arrives in Bun.serve
Bun.serve({ http2: true }) now negotiates HTTP/2 over TLS on the same fetch handler and routing surface as HTTP/1.1, with fallback controlled by http1. This is the week’s biggest feature, and it ships with the surrounding client/server plumbing and type updates needed to make it usable.
Compiled executables got faster, smaller, and more portable
Bun kept pushing on --compile --bytecode: bytecode is now aliased in place instead of copied, startup bytecode is prefetched, module graphs are laid out in load order, and embedded modules resolve more consistently across import(), require(), and Worker paths. The compiler also picked up cross-platform bytecode support and now embeds lazy builtin dependencies, making standalone binaries more self-contained and less fragile.
TLS and networking correctness were tightened
TLS startup is faster thanks to lazily parsed root CAs and cached system bundles, while fetch now uses the URL hostname for SNI/cert checks instead of Host. Bun also fixed keep-alive reuse with custom checkServerIdentity, coalesced TLS 1.3 handshake writes, improved Unix-socket pooling after cwd changes, and hardened socket close/backpressure behavior in WebSocket and net paths.
Resolver, bundler, and transpiler behavior became more deterministic
The TypeScript resolver now handles more extension rewrite and exports/imports cases, while the runtime transpiler cache now keys on defines and --drop to avoid stale output. Bundling/code-splitting also saw a large correctness pass: chunk naming and folding are more stable, barrel optimizations are safer, and compiled output is laid out more predictably.
Core runtime and platform bugs were fixed across fs, shell, and Windows
Bun fixed several Node-compatibility and crash bugs: truncate(undefined) now truncates to zero, async recursive readdir fails fast, Git installs run on the install thread loop, shell command substitution no longer splits assignment values, and Windows errno mapping no longer turns real failures into success. There were also fixes for paused sockets, child stdin syscall reporting, bun sqlite empty SQL, and WebView process-pool exhaustion.
Other misc changes
- Fake timers and
performance.timeOriginnow stay in sync, and non-finitenowvalues are rejected bun installgot peer-dedupe, GitHub dependency, and lockfile migration fixesbun:ffi/--no-addonssandboxing was tightened with a new--no-ffi-ccflag- Numerous test, docs, WebKit, and internal refactor/dead-code cleanup commits