A patch release with more substance than most major versions
Bun, the all-in-one JavaScript runtime and package manager, shipped version 1.4.1 on September 4, 2026. Despite the minor-looking version number, the release closes 202 open issues and adds real capability across networking, the bundler, package management, and testing, backed by concrete before-and-after benchmarks in Bun's own release notes.
HTTP/2 lands in Bun.serve
The headline feature is HTTP/2 support in Bun.serve(), running on the same port as HTTP/1.1. Over TLS, the protocol is negotiated automatically with Application-Layer Protocol Negotiation (ALPN), and both protocols share the same routes and fetch handler:
Bun.serve({
tls: { key, cert },
http2: true,
fetch(req) {
return new Response("hi");
},
});
Bun's own benchmark for a plain "Hello World" GET request over HTTP/2 measured 291,512 requests per second, against 42,733 requests per second for the same test on Node.js v26, a roughly 6.8x difference. WebSocket clients also gained pause() and resume() methods for TCP-level backpressure, and socket.bufferedAmount now reports real queued byte counts instead of always returning zero.
Less memory for large file writes
Bun.write() now streams Response and Request bodies straight to disk instead of buffering the whole thing in memory first. Bun's figures show writing a 128 MiB file used to add 161 MB to a process's peak resident memory; it now adds about 13 MB, a roughly 12x reduction for that workload.
Where the raw speed gains are
A cluster of changes target hot paths that show up constantly in everyday code:
| Operation | Before | After | Change |
|---|---|---|---|
buf.writeFloatLE() |
2.85 ns | 0.31 ns | ~9.2x faster |
| Printing a 16,000-key object | 140 ms | 3.2 ms | ~43x faster |
Loading node:assert |
6.22 ms | 0.64 ms | ~9.7x faster |
| First HTTPS connection (bundled certs) | 17.6 ms | 10.3 ms | ~1.7x faster |
Buffer read and write methods are now compiled as bounds-checked, just-in-time (JIT) inlined operations rather than function calls, which explains the jump on writeFloatLE. Object inspection, used constantly by console.log, moved from quadratic to linear time. Built-in Node.js modules now lazy-load their internals on first use rather than at startup. AsyncLocalStorage, used for tracing and request-context propagation, also got roughly 2x faster store initialization and no longer allocates memory per await inside a run() call.
Smaller bundles and smaller compiled binaries
Bun's bundler now tree-shakes the exports of a dynamically imported module that the importing code never actually reads. In Bun's own tests, this shrank a Zod bundle from 377.9 KB to 78.2 KB and an Effect bundle from 248.1 KB to 125.7 KB. A new --min-chunk-size flag lets developers fold small code-splitting chunks into whichever parent chunk loads them most often, and browser builds now automatically inject <link rel="modulepreload"> tags so split chunks can fetch in parallel instead of one round trip at a time.
Compiled standalone executables, Bun's answer to packaging a Node.js app as a single binary, also got noticeably leaner. Bun cites its own command-line tool, Claude Code, as a real-world example: compiled install size dropped from 376 MB to 207 MB, a 45 percent reduction, because bytecode overhead fell from roughly 9x the source size down to 3x. Startup time for compiled binaries improved by about 20 percent in the same example.
Package management gets an offline mode
bun install --offline now performs zero network requests and errors out by name on any package missing from the local cache, useful for reproducible builds in air-gapped or flaky-network continuous integration (CI) environments. A softer --prefer-offline flag skips re-fetching metadata for anything already cached while still downloading packages that are missing. Workspaces can also mark specific packages as selfContained in configuration to get an isolated node_modules folder, which matters for tools like Electron that expect a particular dependency layout rather than a hoisted monorepo tree.
This continues a direction Bun has been pushing for several releases: earlier versions added automatic migration of pnpm-lock.yaml and pnpm-workspace.yaml files into Bun's own lockfile format, aimed at making bun install a drop-in replacement for teams currently on npm, Yarn, or pnpm.
Testing gets a memory fix
bun test --isolate now prevents memory from leaking between test files. In an 80-file suite that made heavy use of mocks, memory usage dropped from 1,591 MB to 215 MB and total runtime fell from 1.95 seconds to 1.46 seconds.
What it means for developers
None of these changes require a project rewrite. Existing Bun users get most of the performance gains, like the buffer, inspection, and module-loading speedups, automatically on upgrade with bun upgrade, no code changes needed. The two items worth deliberately adopting are HTTP/2 in Bun.serve() for services that talk to browsers or gRPC-style clients, and bun install --offline for CI pipelines that currently fight with flaky package registry access. Teams shipping compiled Bun binaries, particularly command-line tools, should also notice smaller downloads and faster cold starts without any changes on their end.
