Impact Score: 5/10
Bun v0.0.22
Source available — automated, not human-reviewed
Component: bun · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
Bun bun-v0.0.22. Source highlight: Support resolving `"exports"` field in package.json. Webpack's guide does a great job explaining the `"exports"` field.
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
✨ New Features & Capabilities (6)
- Support resolving `"exports"` field in package.json. Webpack's guide does a great job explaining the `"exports"` field.
- Add parsed lines of code counter to `bun bun`
- Support importing files above the project root. HTTP Requests above the project root are allowlisted to specific file extensions to prevent common webserver security vulnerabilities like reading `/etc/passwd`. Absolute file path imports always start with `abs:`. The security questions aren't as relevant for localhost development, but still worth thinking about.
- Support bundling symlinked workspace packages via `bun bun`. To use this, set `"bun": { "alwaysBundle": ["packageName"] }` in the project's `package.json`.
- When bundling JSON, print the output as `JSON.parse(jsonString)` when the JSON is ASCII. `JSON.parse` is much faster for JavaScript engines to parse.
- Add comment explaining failed package.json parsing optimization
🔧 Bug Fixes & Patches (6)
- Fix handling when file metadata store exceeds statically allocated count (at time of writing, 16k)
- Always log errors when generating `node_modules.server.bun`
- Fix how error lines with strings are highlighted
- Fix parsing/printing JavaScript unicode identifiers
- Slightly improve .env loader string detection
- More correct `export default` transform for bundled code
📄 View Raw Release Notes (Original Developer Log)
### Features
* Support resolving `"exports"` field in package.json. [Webpack's guide](https://webpack.js.org/guides/package-exports/) does a great job explaining the `"exports"` field.
* Add parsed lines of code counter to `bun bun`
* Support importing files above the project root. HTTP Requests above the project root are allowlisted to specific file extensions to prevent common webserver security vulnerabilities like reading `/etc/passwd`. Absolute file path imports always start with `abs:`. The security questions aren't as relevant for localhost development, but still worth thinking about.
* Support bundling symlinked workspace packages via `bun bun`. To use this, set `"bun": { "alwaysBundle": ["packageName"] }` in the project's `package.json`.
* When bundling JSON, print the output as `JSON.parse(jsonString)` when the JSON is ASCII. `JSON.parse` is much faster for JavaScript engines to parse.
#### Bun.js
* Implement `console.time`, `console.timeEnd`
* Implement `Bun.readFileBytes()` to get a Uint8Array of the file's contents without copying.
### Bug fixes
* Fix handling when file metadata store exceeds statically allocated count (at time of writing, 16k)
* Always log errors when generating `node_modules.server.bun`
* Fix how error lines with strings are highlighted
* Fix parsing/printing JavaScript unicode identifiers
* Slightly improve .env loader string detection
* More correct `export default` transform for bundled code
* Fix a JavaScript simplification bug involving ternaries
* Fix a JavaScript parsing bug with arrays in function arguments that have default values
* Fix edgecase with bare imports inside .bun
* Fix edgecase with whether to wrap arrow expressions in parentheses when printing
* Fix edgecase when a bundled module with multiple-levels of nested exports have a boolean value for the `default` export
* Globally define `require()` so that UMD modules which check for the existence of `require()` to determine if it's CommonJS use the CommonJS code path instead of the globalThis code path. This is not great.
* Embed regeneratorRuntime so that modules which expect it to be a global work
* Fix crash when loading JS fails really quickly
### Misc
* Begin adding integration tests with snapshots that run with HMR disabled & HMR enabled
* Add comment explaining failed package.json parsing optimization
* Elaborate on `bun bun` in the readme
* Switch to UTF-8 for prefilled strings, remove eagerly loading identifier_name
* Symlinks work but the readme wasn't updated
* Add skeleton code for macros but do not execute them yet