View packages at a commit

Paste a `locked_commit` from your `minimal.toml`, or a recent commit from the list.

Back to search results
bun owner avatar

bun

Version: 1.3.14

Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one

Install package

min add bun
Languagebunbundlerjavascript

OpenSSF Score

OpenSSF Scorecard — bun

Scored 0–10, as OpenSSF Scorecard reports them.N/A: not applicable or inconclusive.

Binary-Artifacts

Binaries present in source code

0
Branch-Protection

Branch protection is not maximal on development and all release branches

8
CI-Tests

Could not be evaluated.

N/A
CII-Best-Practices

No effort to earn an OpenSSF best practices badge detected

0
Code-Review

Found 12/30 approved changesets -- score normalized to 4

4
Contributors

Project has 61 contributing companies or organizations

10
Dangerous-Workflow

No dangerous workflow patterns detected

10
Dependency-Update-Tool

Update tool detected

10
Fuzzing

Project is fuzzed

10
License

License file detected

9
Maintained

30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10

10
Packaging

Packaging workflow detected

10
Pinned-Dependencies

Dependency not pinned by hash detected -- score normalized to 5

5
SAST

Could not be evaluated.

N/A
Security-Policy

Security policy file detected

10
Signed-Releases

5 out of the last 5 releases have a total of 5 signed artifacts.

8
Token-Permissions

GitHub workflow tokens follow principle of least privilege

10
Vulnerabilities

Could not be evaluated.

N/A

Scored by Minimal's own OpenSSF Scorecard run.

oven-sh/bunscanned

Last scored on

What is "bun"?

Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one

How to use this package

Quick install

Installs the package into the current environment for this session. Use --build or --runtime to persist it as a build-time or runtime dependency.

min add bun

Declare as a task dependency in minimal.toml

Listing the package under tasks.<name>.packages makes it available inside that task’s sandbox.

[tasks.dev]
packages = ["bun"]

Build-time vs runtime

Choose build-time for tools needed during compilation, runtime for dynamic libraries loaded at runtime.

min add --build bun
min add --runtime bun
Compare versions
to

Dependencies (20)

Dependencies
NameVersionKind
automake1.18.1build
base—build
bash5.3runtime
cmake4.4.4build
curl8.23.0build
git2.56.0build + runtime
glibc2.44runtime
go1.27.3build
libtool2.6.2build
llvm21.1.8build
make4.4.1build
ninja1.13.2build
patch2.8.1build
perlCVE:25.44.0build
pkgconf3.0.5build
pythonCVE:13.14.10build
ruby4.0.9build
rust1.99.1build
toolchain—build
unzipCVE:16.0build

Dependants (3)

Dependants
NameVersion
hunk0.24.1
opencode1.19.4
plannotator0.27.16
  1. bun v1.3.14d36c9c5
    Diff
    Lines:+289 / -12Deps:20(+2)CVE:3
    Released:
  2. bun v1.3.1320659ab
    Diff
    Lines:+12 / -23Deps:18(+1)
    Released:
  3. bun v1.3.1137ee2d4
    Diff
    Lines:+7 / -5Deps:17
    Released:
  4. bun v1.3.1011a4145
    Diff
    Lines:+120 / -12Deps:17(+14)
    Released:
  5. bun v1.3.9e4a695e
    Diff
    Lines:+65 / -2Deps:3(+3)
    Released:

Showing 8 advisories, 5 of which are transitive via bun's dependencies

Security advisories for this package
Critical (1)
StatusIDsPackageSeverity
High (5)
StatusIDsPackageSeverity
Unknown (2)
StatusIDsPackageSeverity

Build provenance

Loading provenance

For the signed record of what the build used, see the Provenance tab.

Software Bill of Materials — every package this build depends on
PackagesVersion
bunROOT1.3.14
acl2.4.0
attr2.6.0
autoconf2.73
automake1.18.1
bash5.3
bash-bootstrap5.3
binutils2.47
bison3.8.2
bzip21.0.8
ca-certificates2026.10.20
cmake4.4.4
coreutils9.12
curl8.23.0
diffutils3.12
expat2.9.0
file5.48
findutils4.11.0
flex2.6.4
gawk5.4.1
gawk-bootstrap5.4.1
gcc15.2.0
gdbm1.26
gettext1.0
git2.56.0
glibc2.44
glibc-locale-c-utf82.44
gmp6.3.0
go1.27.3
grep3.12
gzip1.15
libcap2.78
libffi3.8.0
libidn22.3.8
libpsl0.23.3
libssh21.11.1
libtool2.6.2
libunistring1.4.2
libuv1.53.0
libyaml0.2.5
linux_headers6.12.43
llvm21.1.8
llvm-bootstrap21.1.8
lz41.10.0
m41.4.21
make4.4.1
meson1.12.0
mpc1.4.1
mpfr4.2.2
ncurses6.6
ninja1.13.2
openssl3.6.5
patch2.8.1
pcre210.49
perl5.44.0
pkgconf3.0.5
python3.14.10
readline8.3
ruby4.0.9
rust1.99.1
rustc-1.98.11.98.1
sed4.10
setuptools84.2.1
sqlite3.54.0
tar1.35
tzdata2026e
unzip6.0
util-linux2.42.4
xz5.8.4
zlib1.3.2
zstd1.5.7

Join the waitlist

Confirm your identity by email or GitHub.

or