Automic VaultAutomic Vault

brew

Install bun with Homebrew, chocolatey, MacPorts, Nix, pacman, scoop, winget

Incredibly fast JavaScript runtime, bundler, test runner, and package manager. Version 1.3.14 via Homebrew; verified 2026-06-03. Also installable with nix: nix profile install nixpkgs#bun.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install bun

local Homebrew formula metadata

MacPortsverified · 94%
sudo port install bun

MacPorts ports tree · devel/bun/Portfile · source: api.github.com

overview

Package summary

Incredibly fast JavaScript runtime, bundler, test runner, and package manager

Commands and aliases

  • bun
  • bunx

history

Project history and usage

Bun is an all-in-one JavaScript and TypeScript toolkit: runtime, package manager, script runner, test runner, package runner, and bundler shipped as a single executable.

Project history

Bun was created as a response to the accumulated layers of Node.js-era JavaScript tooling. The official 1.0 announcement, published on September 8, 2023, framed Bun as a stable, production-ready toolkit for running, building, testing, and debugging JavaScript and TypeScript.

The project is powered by JavaScriptCore rather than V8 and is designed as a faster, leaner, more modern replacement for Node.js while preserving compatibility with npm packages, Node-style module resolution, CommonJS, ES modules, Web APIs, and many Node built-ins.

Bun's documentation later described it as written in Rust and powered by JavaScriptCore, while the GitHub README emphasizes that the single `bun` command includes the runtime plus test runner, script runner, package manager, and package runner.

Adoption history

Bun moved from an alternative runtime curiosity into mainstream JavaScript tooling after the 1.0 release because it promised speed without forcing developers to abandon existing package.json projects. Official install paths include shell installer, npm, Homebrew, Docker, and Windows PowerShell, and package-manager metadata now lists it across Homebrew, Chocolatey, MacPorts, Nix, pacman, Scoop, and winget.

Its adoption is tied to projects experimenting with faster local feedback loops: replacing Node for script execution, replacing npm/yarn/pnpm for installs, replacing Jest/Vitest in some tests, and replacing separate bundlers for simple build cases.

How it is used

Common commands include `bun run` for scripts and TypeScript files, `bun install` for npm-compatible dependency installation, `bun test` for tests, `bun build` for bundling, and `bunx` for executing packages. Configuration is optional and lives in local or global `bunfig.toml` files for Bun-specific settings.

Bun's package manager writes `node_modules`, reads package.json, uses a global cache, and supports workspaces and npm registry configuration. Because it aims to run existing Node.js applications with little or no change, usage often starts as a drop-in replacement for selected scripts rather than a full-stack rewrite.

Why package nerds care

Bun is significant because it collapses several previously separate JavaScript package tools into one binary. For package historians, it marks a major post-Node/npm phase where runtime, package manager, test runner, and bundler compete as integrated developer platforms rather than independent commands.

It is also important because it made package-manager performance and lockfile workflows part of a runtime's identity. Bun's rise pressured the broader ecosystem to treat install speed, TypeScript startup, test speed, and Node compatibility as one developer-experience surface.

Timeline

  • 2023-09-08: Bun 1.0 announced as stable and production-ready.
  • 2024: 1.x releases continued expanding Node.js compatibility and toolkit coverage.
  • 2025: Official docs describe Bun as a runtime, package manager, test runner, and bundler for modern JavaScript and TypeScript apps.
  • 2026-05: GitHub release feed shows Bun v1.3.14 with ongoing 1.3.x releases.

Related projects

  • Bun is most directly related to Node.js, npm, yarn, pnpm, npx, ts-node, tsx, esbuild, webpack, Rollup, Parcel, Jest, Vitest, Deno, and the JavaScriptCore/WebKit project.

security posture

No protected-tool coverage found yet

No matching local secret-handling manifest was found for bun. Nucleus package metadata is still published here so future coverage has a stable package URL.

Install behavior

  • Homebrew declares a post-install hook for this formula.
  • Homebrew bottle metadata is available for 6 platform targets.
  • Build metadata lists 4 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix
bunfig.toml~/.bunfig.toml$XDG_CONFIG_HOME/.bunfig.toml

Credential files

Credential-bearing paths to review before unattended agent runs.

Unix
bunfig.toml~/.bunfig.toml$XDG_CONFIG_HOME/.bunfig.toml

executables

Installed executables

CommandKindExposureNote
buncliglobal executable
bunxcliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-25
manager version1.3.14
manager updated2026-06-03
local dataok
upstreamnot checked
latest detectednot detected

https://github.com/oven-sh/bun

install metadata

Package metadata

Package keybrew:bun
Version1.3.14
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/bun
Homepagehttps://bun.com/
Repositoryhttps://github.com/oven-sh/bun
Upstream docshttps://bun.com/docs
LicenseMIT AND LGPL-2.0-or-later AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND IJG AND LGPL-2.1-or-later AND Zlib AND (Apache-2.0 WITH LLVM-exception)
Source archivehttps://github.com/oven-sh/bun.git
Last updated2026-06-03T16:56:51Z
Pulseupdated
Build dependenciescmake, llvm@21, ninja, rust
Bottleavailable (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-installdefined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namebun
Version Scheme0
Revision0
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Nix95%

bun

nix profile install nixpkgs#bun
  • normalized package name match
  • Matched by: Bun
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/bu/bun/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
pacman95%

bun 1.3.14-1

Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one

https://github.com/oven-sh/bun

sudo pacman -S bun
  • License: MIT
  • Architecture: x86_64
  • 2 dependencies
  • normalized package name match
  • Matched by: Bun
Arch Linux sync databases · geo.mirror.pkgbuild.com · Arch Linux sync databases: bun from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz
MacPorts95%

bun

sudo port install bun
  • normalized package name match
  • Matched by: Bun
MacPorts ports tree · api.github.com · MacPorts ports tree: devel/bun/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1
Chocolatey95%

bun

choco install bun
  • normalized package name match
  • Matched by: Bun
Chocolatey community package catalog · community.chocolatey.org · Chocolatey community package catalog: bun from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','bluejeansapp'
Scoop95%

main/bun

scoop install main/bun
  • normalized package name match
  • Matched by: Bun
Scoop official bucket manifest trees · api.github.com · Scoop official bucket manifest trees: bucket/bun.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1
winget95%

Oven-sh.Bun

winget install --id Oven-sh.Bun -e
  • normalized package name match
  • Matched by: Bun
Windows Package Manager source index · cdn.winget.microsoft.com · Windows Package Manager source index: Oven-sh.Bun from https://cdn.winget.microsoft.com/cache/source.msix

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

Related tools

  • cmakeBuild dependency declared by Homebrew.
  • llvm@21Build dependency declared by Homebrew.
  • ninjaBuild dependency declared by Homebrew.
  • rustBuild dependency declared by Homebrew.
  • bunSame normalized package name appears in another local ecosystem. Shared terms: bun, bundler, bunx, cli, fast.

Same workflow

  • denoShares av.db curated category or tags: cli, javascript, language-runtime, runtime, typescript.
  • duktapeShares av.db curated category or tags: cli, javascript, language-runtime, runtime.
  • fibjsShares av.db curated category or tags: cli, javascript, language-runtime, runtime.
  • nShares av.db curated category or tags: cli, javascript, language-runtime, runtime.
  • nodeShares av.db curated category or tags: cli, javascript, language-runtime, runtime.
  • quickjsShares av.db curated category or tags: cli, javascript, language-runtime, runtime.
  • bunSame normalized package name in another local ecosystem.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated configuration and credential file locations
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment