oven-sh/bun
Dependencies
Vendored C/C++/Rust/Zig libraries that ship in the Bun binary, listed under vendor/. None are git submodules — they're copied in directly.
| Path | Library | Used for |
|---|---|---|
vendor/WebKit/ |
WebKit / JavaScriptCore | The JS engine. Forked from upstream WebKit; carries Bun-specific patches (search for // bun: markers). |
vendor/zig/ |
Zig compiler & stdlib | The language Bun is mostly written in. Pinned to a specific (occasionally pre-release) version. |
vendor/boringssl/ |
BoringSSL | TLS, crypto primitives, hashing, secure random. |
vendor/mimalloc/ |
mimalloc | Default allocator for everything outside of JSC. |
vendor/zlib/ |
zlib-ng (zlib-compat mode) | gzip/deflate. Used by HTTP responses, archive extraction, etc. |
vendor/libdeflate/ |
libdeflate | Faster deflate/inflate for hot paths. |
vendor/brotli/ |
Brotli | Brotli compression (HTTP, etc.). |
vendor/zstd/ |
Zstandard | zstd compression. |
vendor/cares/ |
c-ares | Async DNS. Powers node:dns and fetch(). |
vendor/libuv/ |
libuv | Windows event loop primitive. (POSIX uses native polling.) |
vendor/picohttpparser/ |
PicoHTTPParser | HTTP/1 header parsing. |
vendor/lshpack/ |
ls-hpack | HTTP/2 HPACK header compression. |
vendor/lsqpack/ |
ls-qpack | HTTP/3 QPACK header compression. |
vendor/lsquic/ |
lsquic | QUIC + HTTP/3 client. |
vendor/lolhtml/ |
lol-html | HTML rewriter (used by HTMLRewriter). |
vendor/libarchive/ |
libarchive | tar / zip extraction (bun install for tarballs, bun pack). |
vendor/highway/ |
Google Highway | Portable SIMD intrinsics for hashing, base64, string scan. |
vendor/tinycc/ |
TinyCC (oven-sh fork) | FFI JIT — bun:ffi compiles tiny C shims at runtime. |
vendor/nodejs/ |
Node.js headers | N-API + V8 ABI compatibility for native addons. |
vendor/hdrhistogram/ |
HdrHistogram | Latency tracking for benchmarks / bun.serve's metrics. |
vendor/tracy/ |
Tracy (optional) | Profiler integration when built with Tracy support. |
How they're built
Each dependency has a scripts/build/deps/<name>.ts that's invoked by scripts/build.ts. The pattern is consistent: configure with the chosen toolchain, build static archives, hand them to build.zig and CMake to link.
Upgrading
Vendored deps are upgraded by:
- Updating the version pin in
scripts/build/deps/<name>.ts. - Re-fetching and committing the source tree under
vendor/<name>/. - Running the full test suite, especially the ones that exercise the dep (e.g. crypto, fetch, install).
Some deps (WebKit, TinyCC) live in oven-sh forks because of patches.
Why vendor instead of system?
- Reproducibility. A given Bun release links exactly the dependency versions you see in
vendor/. - No system package manager needed. A user who downloads a Bun release tarball gets a hermetic binary.
- Patching. WebKit and TinyCC need Bun-specific patches that aren't upstream.
Top-level package.json deps
Beyond vendored C deps, the repo's package.json lists JS/TS deps used by the build, the CI scripts, and the bundled extensions. Notable ones:
prettier— TS/JS/MD formatting.typescript— type-checking the project's TS files.mitata— benchmarking harness.peechy— schema language used by some internal tooling.bun-tracestrings— companion to the crash handler URL encoder.
These are not shipped in the Bun binary; they run only at build / development time.
Built by Factory AutoWiki from public repository content. It is a generated preview for codebase exploration, not source-maintained documentation.