Bun itself is MIT-licensed.
JavaScriptCore
Bun statically links JavaScriptCore (and WebKit), which is LGPL-2 licensed. WebCore files from WebKit are also licensed under LGPL-2. Per LGPL-2:
(1) If you statically link against an LGPL'd library, you must also provide your application in an object (not necessarily source) format, so that a user has the opportunity to modify the library and relink the application.
Bun's patched version of WebKit lives at https://github.com/oven-sh/webkit. To relink Bun with changes:
git clone https://github.com/oven-sh/WebKit vendor/WebKitbun sync-webkit-source(checks out the version pinned inWEBKIT_VERSIONinscripts/build/deps/webkit.ts)bun run build:local
bun run build:local compiles JavaScriptCore, compiles Bun's .cpp bindings for JavaScriptCore (the object files that use JavaScriptCore), and outputs a new bun binary with your changes.
The Aphrody runtime builds with the same pinned WebKit. Its release builds download prebuilt archives of it from https://github.com/aphrody-labs/WebKit when that repository publishes them, otherwise from https://github.com/oven-sh/WebKit (webkitPrebuiltRepo in scripts/build/deps/webkit.ts).
Linked libraries
Bun statically links these libraries:
| Library | License |
|---|---|
boringssl | several licenses |
brotli | MIT |
libarchive | several licenses |
lol-html | BSD 3-Clause |
ls-hpack | MIT (bundled xxhash is BSD 2-Clause) |
ls-qpack | MIT |
lsquic | MIT (portions derived from Chromium proto-quic, BSD 3-Clause) |
mimalloc | MIT |
picohttp | dual-licensed under the Perl License or the MIT License |
zstd | dual-licensed under the BSD License or GPLv2 license |
simdutf | Apache 2.0 |
tinycc | LGPL v2.1 |
uSockets | Apache 2.0 |
zlib-ng | zlib |
c-ares | MIT licensed |
libicu 78 | ICU license |
libbase64 | BSD 2-Clause |
libuv (on Windows) | MIT |
libdeflate | MIT |
libjpeg-turbo | BSD 3-Clause / IJG / zlib |
libspng | BSD 2-Clause (portions derived from libpng, PNG Reference Library License v2) |
libwebp | BSD 3-Clause |
highway | Apache 2.0 |
HdrHistogram_c | dual-licensed under CC0 1.0 or the BSD 2-Clause License |
sqlite (on Linux and Windows) | public domain |
A fork of uWebsockets | Apache 2.0 licensed |
| Parts of Tigerbeetle's IO code | Apache 2.0 licensed |
Polyfills
For compatibility, Bun embeds the following packages into its binary and injects them if imported.
| Package | License |
|---|---|
acorn | MIT |
acorn-walk | MIT |
assert | MIT |
browserify-zlib | MIT |
buffer | MIT |
constants-browserify | MIT |
crypto-browserify | MIT |
domain-browser | MIT |
events | MIT |
https-browserify | MIT |
os-browserify | MIT |
path-browserify | MIT |
process | MIT |
punycode | MIT |
querystring-es3 | MIT |
stream-browserify | MIT |
stream-http | MIT |
string_decoder | MIT |
timers-browserify | MIT |
tty-browserify | MIT |
url | MIT |
util | MIT |
vm-browserify | MIT |
Additional credits
- Bun's JS transpiler and Node.js module resolver source code is a port of @evanw’s esbuild project.
- Bun's CSS parser source code is derived from the Lightning CSS and Servo projects.
- Credit to @kipply for the name "Bun".